No, definitely not copy/paste, like I said, text was question mark delimited, some words i recognised from my SMS history, some words not, also some mention of user/password which is worrying. This was in user not root. ssh server is running but only public key auth. allowed. I don't have .bash_history only .ash_history and nothing interesting is in there.