suspicious entry -> message from shell