{"id":"a586cd34-29f7-4fda-942a-60c96ba01d20","name":"lucid-sandy-hare","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":41872,"username":"service","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":415,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T02:46:59.882622+00:00","ended_at":"2026-08-27T02:47:08.597417+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-27T02:46:04.523859+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T02:46:07.674649+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T02:46:08.253898+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T02:46:14.200278+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T02:46:14.754596+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T02:46:18.695951+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:36"},{"seq":7,"at":"2026-08-27T02:46:19.110654+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T02:46:23.097180+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T02:46:23.519711+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T02:46:27.981873+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T02:46:28.446745+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T02:46:32.750471+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T02:46:32.951587+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T02:46:35.581728+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T02:46:35.956737+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T02:46:39.844444+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T02:46:40.080689+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T02:46:43.256342+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T02:46:43.550213+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T02:46:47.576374+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T02:46:47.802254+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T02:46:51.321440+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T02:46:51.787261+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T02:46:55.600049+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-27T02:46:55.788845+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-27T02:46:59.883390+00:00","kind":"input","latency_ms":null,"data":"echo service > /tmp/d.log"}],"credentials":[{"username":"service","password":"service","method":"password","accepted":true,"tier":"common"}]}
{"id":"46fa9eef-1298-4ea2-8f85-049bbb950305","name":"lucid-smooth-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":47942,"username":"service","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":686,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T12:52:03.981951+00:00","ended_at":"2026-08-26T12:52:16.618885+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-26T12:51:02.874660+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T12:51:06.913249+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T12:51:07.393797+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T12:51:10.640574+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T12:51:11.162171+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T12:51:15.310376+00:00","kind":"output","latency_ms":null,"data":"6 days,  9:41"},{"seq":7,"at":"2026-08-26T12:51:16.466630+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T12:51:19.790391+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T12:51:20.254302+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T12:51:23.792784+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T12:51:24.480157+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T12:51:30.381354+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T12:51:31.095306+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T12:51:37.057958+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T12:51:37.791209+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T12:51:41.037011+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T12:51:41.659897+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T12:51:45.106800+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T12:51:46.139170+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T12:51:51.524277+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T12:51:51.789634+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T12:51:56.069217+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T12:51:56.601055+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T12:51:59.272090+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T12:52:00.075335+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T12:52:03.982745+00:00","kind":"input","latency_ms":null,"data":"echo service > /tmp/d.log"}],"credentials":[{"username":"service","password":"service","method":"password","accepted":true,"tier":"common"}]}
{"id":"cbab57ff-5154-46b4-b89b-3dcedaab9d40","name":"valiant-vivid-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":50138,"username":"service","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":230,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T06:35:15.212726+00:00","ended_at":"2026-08-26T06:35:21.513150+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-26T06:34:20.235575+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T06:34:25.460957+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T06:34:25.750698+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T06:34:30.515398+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T06:34:30.738162+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T06:34:33.719855+00:00","kind":"output","latency_ms":null,"data":"6 days,  3:24"},{"seq":7,"at":"2026-08-26T06:34:33.966438+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T06:34:36.844506+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T06:34:37.015642+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T06:34:41.036638+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T06:34:41.332735+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T06:34:46.606065+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T06:34:46.967220+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T06:34:52.211871+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T06:34:52.395068+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T06:34:55.237460+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T06:34:55.469235+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T06:34:58.354013+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T06:34:58.521243+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T06:35:04.187877+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T06:35:04.388112+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T06:35:07.118109+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T06:35:07.349339+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T06:35:11.422746+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T06:35:11.590610+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T06:35:15.213434+00:00","kind":"input","latency_ms":null,"data":"echo service > /tmp/d.log"}],"credentials":[{"username":"service","password":"service","method":"password","accepted":true,"tier":"common"}]}
{"id":"d8a7c670-158a-4ddc-8838-241d2d1cf16f","name":"vigilant-frugal-fennec","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":53050,"username":"service","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":219,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:30:33.805804+00:00","ended_at":"2026-08-25T01:30:41.815801+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-25T01:29:39.104043+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:29:43.517838+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:29:43.717421+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:29:48.380116+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:29:48.599928+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:29:51.501896+00:00","kind":"output","latency_ms":null,"data":"4 days, 22:19"},{"seq":7,"at":"2026-08-25T01:29:51.711536+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:29:54.340161+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:29:54.505044+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:29:57.996002+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:29:58.207250+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:30:03.413525+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:30:03.597616+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:30:07.323376+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:30:07.698956+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:30:12.022771+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:30:12.321890+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:30:15.044858+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:30:15.208545+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:30:20.585831+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:30:20.923815+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:30:23.484907+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:30:23.797580+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:30:29.631710+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-25T01:30:30.020821+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-25T01:30:33.806372+00:00","kind":"input","latency_ms":null,"data":"echo service > /tmp/d.log"}],"credentials":[{"username":"service","password":"service","method":"password","accepted":true,"tier":"common"}]}
{"id":"5ad7168f-2424-494a-bab4-fe4b5a3a9efe","name":"gritty-solemn-quail","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":52714,"username":"service","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":198,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T09:26:19.140540+00:00","ended_at":"2026-08-24T09:26:25.401494+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-24T09:25:23.001467+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T09:25:27.048125+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T09:25:27.227290+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T09:25:32.895277+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T09:25:33.093685+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T09:25:36.679541+00:00","kind":"output","latency_ms":null,"data":"4 days,  6:15"},{"seq":7,"at":"2026-08-24T09:25:36.926900+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T09:25:40.607264+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T09:25:40.925046+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T09:25:44.578193+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T09:25:44.808935+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T09:25:48.897466+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T09:25:49.096327+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T09:25:54.015429+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T09:25:54.202244+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T09:25:57.633893+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T09:25:57.832621+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T09:26:00.851683+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T09:26:01.150199+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T09:26:06.247262+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T09:26:06.440806+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T09:26:11.834002+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T09:26:12.017051+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T09:26:14.622601+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-24T09:26:14.828167+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-24T09:26:19.141408+00:00","kind":"input","latency_ms":null,"data":"echo service > /tmp/d.log"}],"credentials":[{"username":"service","password":"service","method":"password","accepted":true,"tier":"common"}]}
{"id":"0eab908a-2832-4a63-b5c7-07dfecce0433","name":"sturdy-somber-impala","protocol":"ssh","channel_kind":"exec","src_ip":"92.118.39.78","src_port":49378,"username":"service","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":260,"probe_flagged":0,"exec_command":"echo OK","started_at":"2026-08-23T18:10:00.294750+00:00","ended_at":"2026-08-23T18:10:00.420266+00:00","ended_reason":"exec complete","commands":22,"transcript_bytes":1028,"events":[{"seq":1,"at":"2026-08-23T18:09:54.757372+00:00","kind":"input","latency_ms":null,"data":"echo OK"},{"seq":2,"at":"2026-08-23T18:09:54.758873+00:00","kind":"output","latency_ms":null,"data":"OK"},{"seq":3,"at":"2026-08-23T18:09:55.038435+00:00","kind":"input","latency_ms":null,"data":"cat /etc/os-release 2>/dev/null | head -1"},{"seq":4,"at":"2026-08-23T18:09:55.325083+00:00","kind":"input","latency_ms":null,"data":"cat /etc/lsb-release 2>/dev/null | head -1"},{"seq":5,"at":"2026-08-23T18:09:55.607365+00:00","kind":"input","latency_ms":null,"data":"cat /etc/debian_version 2>/dev/null | head -1"},{"seq":6,"at":"2026-08-23T18:09:55.890064+00:00","kind":"input","latency_ms":null,"data":"cat /etc/redhat-release 2>/dev/null | head -1"},{"seq":7,"at":"2026-08-23T18:09:56.165121+00:00","kind":"input","latency_ms":null,"data":"cat /etc/centos-release 2>/dev/null | head -1"},{"seq":8,"at":"2026-08-23T18:09:56.435962+00:00","kind":"input","latency_ms":null,"data":"cat /etc/fedora-release 2>/dev/null | head -1"},{"seq":9,"at":"2026-08-23T18:09:56.704742+00:00","kind":"input","latency_ms":null,"data":"cat /etc/arch-release 2>/dev/null | head -1"},{"seq":10,"at":"2026-08-23T18:09:56.969519+00:00","kind":"input","latency_ms":null,"data":"cat /etc/SuSE-release 2>/dev/null | head -1"},{"seq":11,"at":"2026-08-23T18:09:57.230427+00:00","kind":"input","latency_ms":null,"data":"cat /etc/alpine-release 2>/dev/null | head -1"},{"seq":12,"at":"2026-08-23T18:09:57.491928+00:00","kind":"input","latency_ms":null,"data":"nproc"},{"seq":13,"at":"2026-08-23T18:09:57.492448+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":14,"at":"2026-08-23T18:09:57.752237+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep 'model name' | head -1 | cut -d':' -f2"},{"seq":15,"at":"2026-08-23T18:09:57.753202+00:00","kind":"output","latency_ms":null,"data":"model name\t: AMD EPYC 7713 64-Core Processor"},{"seq":16,"at":"2026-08-23T18:09:58.009485+00:00","kind":"input","latency_ms":null,"data":"uptime"},{"seq":17,"at":"2026-08-23T18:09:58.009969+00:00","kind":"output","latency_ms":null,"data":" 18:09:58 up 3 days, 15:00,  0 user,  load average: 0.03, 0.02, 0.02"},{"seq":18,"at":"2026-08-23T18:09:58.269676+00:00","kind":"input","latency_ms":null,"data":"ls -la / 2>/dev/null | head -20"},{"seq":19,"at":"2026-08-23T18:09:58.524549+00:00","kind":"input","latency_ms":null,"data":"ps aux 2>/dev/null | head -10"},{"seq":20,"at":"2026-08-23T18:09:58.776536+00:00","kind":"input","latency_ms":null,"data":"netstat -tulpn 2>/dev/null | head -10"},{"seq":21,"at":"2026-08-23T18:09:59.027863+00:00","kind":"input","latency_ms":null,"data":"hostname"},{"seq":22,"at":"2026-08-23T18:09:59.028333+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-23T18:09:59.277219+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":24,"at":"2026-08-23T18:09:59.277745+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":25,"at":"2026-08-23T18:09:59.528562+00:00","kind":"input","latency_ms":null,"data":"netstat -tulpn 2>/dev/null | grep LISTEN | head -20"},{"seq":26,"at":"2026-08-23T18:09:59.785851+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1"},{"seq":27,"at":"2026-08-23T18:10:00.039750+00:00","kind":"input","latency_ms":null,"data":"echo \"ametist\" > /tmp/.ametist 2>/dev/null"},{"seq":28,"at":"2026-08-23T18:10:00.295715+00:00","kind":"input","latency_ms":null,"data":"cat /tmp/.ametist 2>/dev/null"}],"credentials":[{"username":"service","password":"service","method":"password","accepted":true,"tier":"common"}]}