{"id":"0cb00361-436c-4df8-bc06-c4c917339063","name":"crimson-creaky-porcupine","protocol":"ssh","channel_kind":"shell","src_ip":"86.104.23.207","src_port":17022,"username":"ubuntu","client_version":"SSH-2.0-OpenSSH_9.7p1 Debian-5","auth_attempts":3,"automation":"human","think_ms":5206,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T17:46:46.323836+00:00","ended_at":"2026-08-25T17:51:47.747000+00:00","ended_reason":"eof","commands":32,"transcript_bytes":10842,"events":[{"seq":1,"at":"2026-08-25T17:46:49.654337+00:00","kind":"input","latency_ms":null,"data":"top\n"},{"seq":2,"at":"2026-08-25T17:46:49.656464+00:00","kind":"output","latency_ms":null,"data":"top - 17:46:49 up 5 days, 14:36,  0 user,  load average: 0.14, 0.1, 0.09\nTasks: 115 total,   1 running, 114 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7785 free,    8102 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":3,"at":"2026-08-25T17:46:57.761686+00:00","kind":"input","latency_ms":null,"data":"unset HISTFILE ; unset HISTSIZE\n"},{"seq":4,"at":"2026-08-25T17:46:58.731191+00:00","kind":"output","latency_ms":970,"data":""},{"seq":5,"at":"2026-08-25T17:46:59.453606+00:00","kind":"input","latency_ms":null,"data":"sudo -i\n"},{"seq":6,"at":"2026-08-25T17:47:01.687761+00:00","kind":"input","latency_ms":null,"data":"unset HISTFILE ; unset HISTSIZE\n"},{"seq":7,"at":"2026-08-25T17:47:02.121864+00:00","kind":"output","latency_ms":433,"data":""},{"seq":8,"at":"2026-08-25T17:47:05.740556+00:00","kind":"input","latency_ms":null,"data":"cat /etc/passwd\n"},{"seq":9,"at":"2026-08-25T17:47:09.480249+00:00","kind":"output","latency_ms":3739,"data":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nsystemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin\nsystemd-resolve:x:997:997:systemd Resolver:/:/usr/sbin/nologin\nmessagebus:x:100:102::/nonexistent:/usr/sbin/nologin\nsshd:x:101:65534::/run/sshd:/usr/sbin/nologin\npostgres:x:102:105:PostgreSQL administrator,,,:/var/lib/postgresql:/usr/sbin/nologin\nnode:x:1000:1000:stable service:/opt/stable:/bin/bash\nbrumby:x:1001:1001:Brumby Stable Operator:/home/brumby:/bin/bash"},{"seq":10,"at":"2026-08-25T17:47:19.477865+00:00","kind":"input","latency_ms":null,"data":"ip a\n"},{"seq":11,"at":"2026-08-25T17:47:19.478947+00:00","kind":"output","latency_ms":null,"data":"1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000\n    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\n    inet 127.0.0.1/8 scope host lo\n       valid_lft forever preferred_lft forever\n2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000\n    link/ether f2:3c:91:65:96:d6 brd ff:ff:ff:ff:ff:ff\n    inet 203.0.113.1/24 brd 45.33.68.255 scope global eth0\n       valid_lft forever preferred_lft forever\n    inet6 2001:db8::1/64 scope global dynamic mngtmpaddr noprefixroute\n       valid_lft 5325sec preferred_lft 1725sec"},{"seq":12,"at":"2026-08-25T17:48:10.827920+00:00","kind":"input","latency_ms":null,"data":"uname -a && uptime\n"},{"seq":13,"at":"2026-08-25T17:48:12.067537+00:00","kind":"output","latency_ms":1239,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux\n 03:48:53 up 5 days, 14:38,  1 user,  load average: 0.08, 0.11, 0.09"},{"seq":14,"at":"2026-08-25T17:48:35.731324+00:00","kind":"input","latency_ms":null,"data":"ps -ef\n"},{"seq":15,"at":"2026-08-25T17:48:41.797349+00:00","kind":"output","latency_ms":6066,"data":"UID          PID    PPID  C STIME TTY          TIME CMD\nroot           1       0  0 Aug20 ?        00:00:12 /sbin/init\nroot         612       1  0 Aug20 ?        00:00:01 /usr/bin/systemd-journald\nroot         655       1  0 Aug20 ?        00:00:00 /usr/lib/systemd/systemd-udevd\nsystemd+      702       1  0 Aug20 ?        00:00:00 /usr/lib/systemd/systemd-resolved\nroot         731       1  0 Aug20 ?        00:00:00 /usr/lib/systemd/systemd-logind\npostgres     844       1  0 Aug20 ?        00:00:05 /usr/lib/postgresql/16/bin/postgres -D /var/lib/postgresql/16/main -c config_file=/etc/postgresql/16/main/postgresql.conf\npostgres     863     844  0 Aug20 ?        00:00:00 postgres: 16/main: checkpointer \npostgres     864     844  0 Aug20 ?        00:00:00 postgres: 16/main: background writer \npostgres     865     844  0 Aug20 ?        00:00:00 postgres: 16/main: walwriter \npostgres     866     844  0 Aug20 ?        00:00:00 postgres: 16/main: autovacuum launcher \npostgres     867     844  0 Aug20 ?        00:00:00 postgres: 16/main: logical replication launcher \nnode         920       1  0 Aug20 ?        00:01:47 node /opt/stable/src/server.js\nwww-data     945     920  0 Aug20 ?        00:00:00 nginx: worker process\nwww-data     946     920  0 Aug20 ?        00:00:00 nginx: worker process\nwww-data     947     920  0 Aug20 ?        00:00:00 nginx: worker process\nroot         918       1  0 Aug20 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;\nroot        1050       1  0 Aug20 ?        00:00:00 /usr/sbin/sshd -D\nroot        1122       1  0 Aug20 ?        00:00:00 /usr/bin/cron -f\nroot        1138       1  0 Aug20 ?        00:00:00 /usr/sbin/rsyslogd -n\nroot        1199    1122  0 03:40 ?        00:00:00 /bin/bash /opt/stable/bin/muck-out.sh\nroot        1204    1199  0 03:40 ?        00:00:00 /usr/bin/gzip -f /var/backups/hayloft/stable_prod.sql\nroot        1210    1122  "},{"seq":16,"at":"2026-08-25T17:49:11.270157+00:00","kind":"input","latency_ms":null,"data":"ls -la /var/backups/hayloft/\n"},{"seq":17,"at":"2026-08-25T17:49:16.171317+00:00","kind":"output","latency_ms":4895,"data":"total 4\ndrwxr-xr-x 2 root root  64 Aug 20 03:10 .\ndrwxr-xr-x 3 root root  22 Aug 20 03:10 ..\n-rw-r--r-- 1 root root 928 Aug 25 03:40 paddock.sql.gz\n-rw-r--r-- 1 root root   0 Aug 25 03:40 stable_prod.sql.gz"},{"seq":18,"at":"2026-08-25T17:49:16.176842+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":19,"at":"2026-08-25T17:49:46.474756+00:00","kind":"input","latency_ms":null,"data":"zcat /var/backups/hayloft/paddock.sql.gz\n"},{"seq":20,"at":"2026-08-25T17:49:51.992291+00:00","kind":"output","latency_ms":5514,"data":"-- PostgreSQL database dump\n--\n-- Dumped from database version 16.3 (Ubuntu 16.3-1.pgdg26.04+1)\n-- Dumped by pg_dump version 16.3 (Ubuntu 16.3-1.pgdg26.04+1)\n\nSET statement_timeout = 0;\nSET lock_timeout = 0;\nSET idle_in_transaction_session_timeout = 0;\nSET client_encoding = 'UTF8';\nSET standard_conforming_strings = on;\nSET search_path = paddock, public;\nSET check_function_bodies = false;\nSET xmloption = content;\nSET client_min_messages = warning;\n\nCREATE SCHEMA paddock;\n\nCREATE TABLE paddock.boarding (\n    id integer NOT NULL,\n    horse_name text NOT NULL,\n    owner_name text NOT NULL,\n    stall text NOT NULL,\n    arrival_date date,\n    departure_date date,\n    active boolean DEFAULT true NOT NULL\n);\n\nCREATE TABLE paddock.bloodlines (\n    id integer NOT NULL,\n    horse_name text NOT NULL,\n    sire text,\n    dam text,\n    breed text,\n    notes text\n);\n\nCREATE TABLE paddock.feed (\n    id integer NOT NULL,\n    horse_name text NOT NULL,\n    ration text NOT NULL,\n    fed_at timestamp with time zone DEFAULT now() NOT NULL,\n    fed_by text\n);\n\nCOPY paddock.boarding (id, horse_name, owner_name, stall, arrival_date, departure_date, active) FROM stdin;\n1\tBucephalus\tEvelyn Hart\t12A\t2026-08-12\t\\N\tt\n2\tMarengo\tThomas Vale\t7B\t2026-08-13\t\\N\tt\n3\tPalomino\tSadie Reed\t4C\t2026-08-14\t\\N\tt\n4\tAppaloosa\tNoah Green\t19D\t2026-08-15\t\\N\tt\n5\tClydesdale\tMarta Shaw\t2F\t2026-08-16\t\\N\tt\n\\.\n\nCOPY paddock.bloodlines (id, horse_name, sire, dam, breed, notes) FROM stdin;\n1\tBucephalus\tSolar Drift\tQueen's Road\tThoroughbred\tHesitates at the wash rack.\n2\tMarengo\tNorthwind Lady\tBridle Path\tMorgan\tRequires steady handling.\n3\tPalomino\tGolden Hour\tMidnight Pearl\tPalomino\tShod last on 2026-08-18.\n4\tAppaloosa\tRed River\tSpotted Crown\tAppaloosa\tProne to drifting right on turns.\n5\tClydesdale\tIron Bell\tStone Meadow\tClydesdale\tNeeds larger water bucket.\n\\.\n\nCOPY paddock.feed (id, horse_name, ration, fed_at, fed_by) FROM stdin;\n1\tBucephalus\t2 scoops oats, hay\tnet_manager\t\\N\n2\tMarengo\t1.5 scoops pellets, hay\tnet_manager\t\\N\n3\tPalomino\t2 scoops oats, beet pulp\tnet_manager\t\\N\n4\tAppaloosa\t1 scoop pellets, hay\tnet_manager\t\\N\n5\tClydesdale\t3 scoops oats, hay\tnet_manager\t\\N\n\\.\n\nSELECT pg_catalog.setval('paddock.boarding_id_seq', 5, true);\nSELECT pg_catalog.setval('paddock"},{"seq":21,"at":"2026-08-25T17:49:51.996255+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":22,"at":"2026-08-25T17:50:52.525220+00:00","kind":"input","latency_ms":null,"data":"top\n"},{"seq":23,"at":"2026-08-25T17:50:52.526179+00:00","kind":"output","latency_ms":null,"data":"top - 17:50:52 up 5 days, 14:40,  0 user,  load average: 0.14, 0.1, 0.09\nTasks: 115 total,   1 running, 114 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7785 free,    8102 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T17:50:55.143753+00:00","kind":"input","latency_ms":null,"data":"wget\n"},{"seq":25,"at":"2026-08-25T17:50:55.879688+00:00","kind":"output","latency_ms":733,"data":"wget: missing URL\n"},{"seq":26,"at":"2026-08-25T17:51:18.893205+00:00","kind":"input","latency_ms":null,"data":"ps -ef\n"},{"seq":27,"at":"2026-08-25T17:51:22.284693+00:00","kind":"output","latency_ms":3386,"data":"UID          PID    PPID  C STIME TTY          TIME CMD\nroot           1       0  0 Aug20 ?        00:00:12 /sbin/init\nroot         612       1  0 Aug20 ?        00:00:01 /usr/bin/systemd-journald\nroot         655       1  0 Aug20 ?        00:00:00 /usr/lib/systemd/systemd-udevd\nsystemd+      702       1  0 Aug20 ?        00:00:00 /usr/lib/systemd/systemd-resolved\nroot         731       1  0 Aug20 ?        00:00:00 /usr/lib/systemd/systemd-logind\npostgres     844       1  0 Aug20 ?        00:00:05 /usr/lib/postgresql/16/bin/postgres -D /var/lib/postgresql/16/main -c config_file=/etc/postgresql/16/main/postgresql.conf\npostgres     863     844  0 Aug20 ?        00:00:00 postgres: 16/main: checkpointer \npostgres     864     844  0 Aug20 ?        00:00:00 postgres: 16/main: background writer \npostgres     865     844  0 Aug20 ?        00:00:00 postgres: 16/main: walwriter \npostgres     866     844  0 Aug20 ?        00:00:00 postgres: 16/main: autovacuum launcher \npostgres     867     844  0 Aug20 ?        00:00:00 postgres: 16/main: logical replication launcher \nnode         920       1  0 Aug20 ?        00:01:47 node /opt/stable/src/server.js\nwww-data     945     920  0 Aug20 ?        00:00:00 nginx: worker process\nwww-data     946     920  0 Aug20 ?        00:00:00 nginx: worker process\nwww-data     947     920  0 Aug20 ?        00:00:00 nginx: worker process\nroot         918       1  0 Aug20 ?        00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;\nroot        1050       1  0 Aug20 ?        00:00:00 /usr/sbin/sshd -D\nroot        1122       1  0 Aug20 ?        00:00:00 /usr/bin/cron -f\nroot        1138       1  0 Aug20 ?        00:00:00 /usr/sbin/rsyslogd -n\nroot        1199    1122  0 03:40 ?        00:00:00 /bin/bash /opt/stable/bin/muck-out.sh\nroot        1204    1199  0 03:40 ?        00:00:00 /usr/bin/gzip -f /var/backups/hayloft/stable_prod.sql\nroot        1210    1122  "},{"seq":28,"at":"2026-08-25T17:51:26.384638+00:00","kind":"input","latency_ms":null,"data":"netstat -anp\n"},{"seq":29,"at":"2026-08-25T17:51:26.385586+00:00","kind":"output","latency_ms":null,"data":"Active Internet connections (only servers)\nProto  Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name\ntcp         0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      698/sshd: /usr/sbin\ntcp         0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      731/nginx: master p\ntcp         0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      731/nginx: master p\ntcp         0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      812/postgres\ntcp         0      0 127.0.0.1:3000          0.0.0.0:*               LISTEN      944/node\ntcp         0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      612/systemd-resolve"},{"seq":30,"at":"2026-08-25T17:51:31.593041+00:00","kind":"input","latency_ms":null,"data":"poweroff\n"},{"seq":31,"at":"2026-08-25T17:51:32.178793+00:00","kind":"output","latency_ms":585,"data":"System has been shut down."},{"seq":32,"at":"2026-08-25T17:51:34.467745+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":33,"at":"2026-08-25T17:51:35.173614+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":34,"at":"2026-08-25T17:51:35.397745+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":35,"at":"2026-08-25T17:51:35.597622+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":36,"at":"2026-08-25T17:51:35.823998+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":37,"at":"2026-08-25T17:51:36.041644+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":38,"at":"2026-08-25T17:51:37.805033+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":39,"at":"2026-08-25T17:51:38.340454+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":40,"at":"2026-08-25T17:51:38.541054+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":41,"at":"2026-08-25T17:51:38.743289+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":42,"at":"2026-08-25T17:51:39.479258+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":43,"at":"2026-08-25T17:51:39.688783+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":44,"at":"2026-08-25T17:51:39.890926+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":45,"at":"2026-08-25T17:51:44.149683+00:00","kind":"input","latency_ms":null,"data":"shutdown -h now\n"},{"seq":46,"at":"2026-08-25T17:51:44.659071+00:00","kind":"output","latency_ms":508,"data":""},{"seq":47,"at":"2026-08-25T17:51:46.005929+00:00","kind":"input","latency_ms":null,"data":"\n"}],"credentials":[{"username":"ubuntu","password":null,"method":"publickey","accepted":false,"tier":null},{"username":"ubuntu","password":null,"method":"publickey","accepted":false,"tier":null},{"username":"ubuntu","password":"P@ssw0rd.12","method":"password","accepted":true,"tier":"other"}]}
{"id":"bd4e374a-71a3-4f10-9577-2f0b994ae77a","name":"proud-whispering-adder","protocol":"ssh","channel_kind":"exec","src_ip":"211.221.196.103","src_port":36928,"username":"deploy","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":606,"probe_flagged":0,"exec_command":"uname -a","started_at":"2026-08-23T12:58:24.747263+00:00","ended_at":"2026-08-23T12:58:25.825009+00:00","ended_reason":"exec complete","commands":6,"transcript_bytes":2652,"events":[{"seq":1,"at":"2026-08-23T12:58:15.811120+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":2,"at":"2026-08-23T12:58:15.811915+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":3,"at":"2026-08-23T12:58:16.214127+00:00","kind":"input","latency_ms":null,"data":"cat /etc/passwd"},{"seq":4,"at":"2026-08-23T12:58:20.747558+00:00","kind":"output","latency_ms":4539,"data":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nsystemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin\nsystemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin\nmessagebus:x:100:102::/nonexistent:/usr/sbin/nologin\npolkitd:x:996:996:polkit:/nonexistent:/usr/sbin/nologin\npostgres:x:110:113:PostgreSQL administrator,,,:/var/lib/postgresql:/usr/sbin/nologin\nsshd:x:111:65534::/run/sshd:/usr/sbin/nologin\nbrumby:x:1000:1000:Brumby Stable Admin:/home/brumby:/bin/bash"},{"seq":5,"at":"2026-08-23T12:58:21.147306+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep processor | wc -l"},{"seq":6,"at":"2026-08-23T12:58:21.149076+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":7,"at":"2026-08-23T12:58:21.756072+00:00","kind":"input","latency_ms":null,"data":"passwd"},{"seq":8,"at":"2026-08-23T12:58:22.573183+00:00","kind":"output","latency_ms":817,"data":"passwd: You may not view or modify password information for root.\npasswd: Authentication token manipulation error\npasswd: password unchanged"},{"seq":9,"at":"2026-08-23T12:58:23.238131+00:00","kind":"input","latency_ms":null,"data":"rm -rf .bash_history;rm -rf /var/run/utmp;rm -rf /var/run/wtmp -;rm -rf /var/log/lastlog;rm -rf /usr/adm/lastlog;rm -rf .bash_history;cd /home;rm -rf yum.log;cd /var/log/;rm -rf wtmp;rm -rf secure;rm -rf lastlog;rm -rf messages;touch messagess;touch wtmp;touch secure;touch lastlog;cd /root;rm -rf .bash_history;touch .bash_history;unset HISTFILE;unset HISTSAVE;history -n;unset WATCH;cd;HISTFILE=/dev/null;history -c && rm -f ~/.bash_history;cd .."},{"seq":10,"at":"2026-08-23T12:58:23.846172+00:00","kind":"output","latency_ms":606,"data":""},{"seq":11,"at":"2026-08-23T12:58:24.748365+00:00","kind":"input","latency_ms":null,"data":"kill -9 $(ps aux | grep xrx |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep biden1 |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep zzh |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep arx645 |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep kthreaddk |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep ab |grep -v grep | awk '{print $2}');kill -9 $(ps aux | grep kdevtmpfsi |grep -v grep | awk '{print $2}')"},{"seq":12,"at":"2026-08-23T12:58:25.624791+00:00","kind":"output","latency_ms":875,"data":"kill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process\nkill: (1): No such process"}],"credentials":[{"username":"deploy","password":"deploy","method":"password","accepted":true,"tier":"common"}]}
{"id":"d8d4986c-595c-49cf-997c-a99158c4685b","name":"languid-idle-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"47.107.183.85","src_port":34854,"username":null,"client_version":"SSH-2.0-Go","auth_attempts":0,"automation":"bot","think_ms":1955,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T06:40:48.583350+00:00","ended_at":"2026-08-20T07:44:44+00:00","ended_reason":"stale: no end frame","commands":3,"transcript_bytes":1960,"events":[{"seq":1,"at":"2026-08-20T06:40:41.019124+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":2,"at":"2026-08-20T06:40:41.020590+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":3,"at":"2026-08-20T06:40:41.568530+00:00","kind":"input","latency_ms":null,"data":"cat /etc/passwd"},{"seq":4,"at":"2026-08-20T06:40:46.629708+00:00","kind":"output","latency_ms":5059,"data":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\npostgres:x:113:120:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash\nsystemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin\nsystemd-resolve:x:997:997:systemd Resolver:/:/usr/sbin/nologin\nftp:x:1000:1000:ftp:/root:/bin/bash\nbrumby:x:1001:1001:Brumby Stable Account:/home/brumby:/bin/bash\nseabiscuit:x:1002:1002:Seabiscuit Stable Account:/home/seabiscuit:/bin/bash\nmarengo:x:1003:1003:Marengo Stable Account:/home/marengo:/bin/bash\ncopenhagen:x:1004:1004:Copenhagen Stable Account:/home/copenhagen:/bin/bash\nbucephalus:x:1005:1005:Bucephalus Stable Account:/home/bucephalus:/bin/bash\npalomino:x:1006:1006:Palomino Stable Account:/home/palomino:/bin/bash\nappaloosa:x:1007:1007:Appaloosa Stable Account:/home/appaloosa:/bin/bash\nclydesdale:x:1008:1008:Clydesdale Stable Account:/home/clydesdale:/bin/bash\nmustang:x:1009:1009:Mustang Stable Account:/home/mustang:/bin/bash\npinto:x:1010:1010:Pinto Stable Account:/home/pinto:/bin/bash"},{"seq":5,"at":"2026-08-20T06:40:48.584967+00:00","kind":"input","latency_ms":null,"data":"passwd"},{"seq":6,"at":"2026-08-20T06:40:49.220528+00:00","kind":"output","latency_ms":636,"data":"New password: \nRetype new password: \npasswd: password updated successfully"}],"credentials":[{"username":"ftp","password":"ftp","method":"password","accepted":true,"tier":"common"}]}
{"id":"ec2b333e-bca8-4398-921f-0dc6980806fd","name":"stoic-silent-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"127.0.0.1","src_port":50628,"username":"root","client_version":"SSH-2.0-AsyncSSH_2.24.0","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"ls -la /opt/stable","started_at":"2026-08-20T06:34:50.105624+00:00","ended_at":"2026-08-20T06:34:51.260988+00:00","ended_reason":"exec complete","commands":5,"transcript_bytes":2024,"events":[{"seq":1,"at":"2026-08-20T06:34:42.556248+00:00","kind":"input","latency_ms":null,"data":"ls -la /opt/stable"},{"seq":2,"at":"2026-08-20T06:34:44.633186+00:00","kind":"output","latency_ms":2074,"data":"total 28\ndrwxr-xr-x  5 root root 4096 Aug 20 03:09 .\ndrwxr-xr-x 18 root root 4096 Aug 20 03:09 ..\ndrwxr-xr-x  2 root root 4096 Aug 20 03:09 bin\ndrwxr-xr-x  3 root root 4096 Aug 20 03:09 src\ndrwxr-xr-x  2 root root 4096 Aug 20 03:09 logs"},{"seq":3,"at":"2026-08-20T06:34:44.640438+00:00","kind":"input","latency_ms":null,"data":"cat /etc/passwd | tail -4"},{"seq":4,"at":"2026-08-20T06:34:45.774928+00:00","kind":"output","latency_ms":1133,"data":"mustang:x:1004:1004::/home/mustang:/bin/bash\npinto:x:1005:1005::/home/pinto:/bin/bash\npostgres:x:111:114:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash\nbrumby:x:1000:1000:Brumby Stable Admin,,,:/home/brumby:/bin/bash"},{"seq":5,"at":"2026-08-20T06:34:45.799616+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":6,"at":"2026-08-20T06:34:47.146812+00:00","kind":"output","latency_ms":1349,"data":"# m h  dom mon dow   command\n17 * * * * /usr/local/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n*/15 * * * * /usr/local/bin/feed-cycle.timer >> /var/log/feed-cycle.log 2>&1\n0 3 * * * /usr/local/bin/gallop-backup.sh >> /var/log/gallop-backup.log 2>&1\n*/5 * * * * /usr/local/bin/bridle-sync >> /var/log/bridle-sync.log 2>&1\n30 2 * * 1 /usr/local/bin/canter-deploy.sh stable_prod >> /var/log/canter-deploy.log 2>&1"},{"seq":7,"at":"2026-08-20T06:34:47.153399+00:00","kind":"input","latency_ms":null,"data":"ps aux | head -7"},{"seq":8,"at":"2026-08-20T06:34:50.101565+00:00","kind":"output","latency_ms":2946,"data":"USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND\nroot           1  0.0  1.1  29036 10480 ?        Ss   03:09   0:01 /sbin/init splash\nroot         612  0.0  0.4  21980  4032 ?        Ss   03:09   0:00 /usr/lib/systemd/systemd-journald\nroot         689  0.0  0.3  18840  3120 ?        Ss   03:09   0:00 /usr/lib/systemd/systemd-udevd\npostgres     744  0.0  2.1 221664 20096 ?        Ss   03:09   0:00 /usr/lib/postgresql/15/bin/postgres -D /var/lib/postgresql/15/main -c config_file=/etc/postgresql/15/main/postgresql.conf\nroot         801  0.0  0.5  11240  4896 ?        Ss   03:09   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;\nroot         812  0.0  0.6  14488  5792 ?        Ss   03:09   0:00 node /opt/stable/src/server.js"},{"seq":9,"at":"2026-08-20T06:34:50.107354+00:00","kind":"input","latency_ms":null,"data":"ls /var/backups"},{"seq":10,"at":"2026-08-20T06:34:51.235231+00:00","kind":"output","latency_ms":1125,"data":"total 16\ndrwxr-xr-x  2 root root 4096 Aug 20 03:12 .\ndrwxr-xr-x 14 root root 4096 Aug 20 03:09 ..\n-rw-r--r--  1 root root  842 Aug 19 23:00 bridle-sync.1.log\n-rw-r--r--  1 root root 1248 Aug 20 02:45 canter-deploy.1.log\n-rw-r--r--  1 root root 2048 Aug 20 03:05 gallop-backup.tar.gz"}],"credentials":[{"username":"root","password":"root","method":"password","accepted":true,"tier":"common"}]}